FotoSploit Termux : Best Phishing Tool for Termux

In my previous posts, I have written about how you can mask any phishing URL and make your URL look more natural using the MaskPhish tool. and using the mask phish tool you can make your URL look like facebook.com (basically a top-level domain).  In this post, I am gonna tell you about FotoSploit tool, using fotosploit tool you can make your URL look like an Instagram post and that will be another level of link masking🔥.

What is FotoSploit tool in Temux?

Whenever you share any youtube or Instagram video on WhatsApp or telegram a description gets loaded, it's like a preview of that link. FotoSploit is a tool that will make your link look like a preview of any social media site.

The FotoSploit tool helps you create a highly customizable phishing link, and this tool only works if you share your link on WhatsApp and telegram. You can customize your Link preview so it can work with your social engineering method.

NOTE: This post is only for educational purpose. I and this site do not support any criminal activity. If you are doing any sort of misuse of this information This site is not responsible for that. THIS SITE ONLY SUPPORT ETHICAL HACKING.

Install FotoSploit in Termux [ UPDATED COMMANDS ]:

To install Fotosploit in termux you have install multiple dependencies as well as you need to download git to fetch the project from the Github repository. To save your time I have combined all the commands so you can just copy and paste the below command and the tool will be installed in your termux.

pkg update && pkg upgrade -y && pkg install php python2 git wget -y && cd && wget https://download844.mediafire.com/iot744ake2kgbohL6IbMH3MsDcIyY3kvwxr96ca4V2ZM5k24TygLQN1YJ0ddXQsac8eMMkHw88YkVGYIcz9kqCQcnPn5LpbfqXJXCBwGCh5OJ7uZ6VstU7VGRPL0FZAMxFrbUZBIjv6RQNP9p1jdJ2qupsT7nhgHToJSFSuELdgHBy9M/cgjxkb3z4hqkhj8/Fotosploit-master.zip && unzip Fotosploit-master.zip && cd Fotosploit-master && bash install.sh --install --premium && cd && mv Fotosploit-master FotoSploit && exit

The Termux application will be automatically closed after this command completes so re-open termux and then follow the below steps.

Use FotoSploit in Termux:

This is an example of how your phishing link will look by using this tool. You can use the below steps and change the Picture, title, Description and make your own custom Preview Link. 

whenever you open termux again and you wanna use this tool then you need to follow the below steps.

Step 1:

After restarting termux you will be in-home directory and to use foto sploit you need to change your directory to Fotosploit folder. run below command.

cd FotoSploit

 

Step 2:

Now you need to run the fotosploit bash file to execute the tool. just type the below command and the tool will start.

bash FotoSploit

Now you are in the FotoSploit tool.

Step 3 :

To know the options you need to type the below command, if you know how to use Metasploit then you can easily use this tool.

show options

after typing this command you will see the list of things that you need to set in order to make this tool work and create a fake WhatsApp invite of any post. 

Step 4 :

before doing this step you need to find a photo in your phone which you wanna show in your link, Make sure the size of the photo is very less (5kb to 10k is good.) If you don't have any image file and you wanna download the image file Direclty in termux then read this post [How to Download Files In Termux - 2021] and now you need to copy the path of that photo and paste in below command.

set foto path-of-your-picture

 

e.g: set foto /data/data/com.termux/files/home/pic.jpg 

Step 5 :

Now you need to set your view, the view is the website phishing page that you wanna use, I am gonna make a phishing page for Instagram so I am setting my view as Instagram. you can type set view --help to get the list of views and to set the view you need to type the below command.

set view instagram

Step 6 :

The title URL is the text that you will see at the top of the phishing link post on Whatsapp. You can use the below command to set the title, make sure to keep the title interesting.

 set title url Steve Jobs Actually Alive

You can add your own text in the above command.

Step 7 :

Now you need to set the action URL, This is the redirect URL and after the victim fills the credentials then the victim will be redirected to this Link. type below command to set action url.

set action url https://www.instagram.com/stevejobs

Change the URL in the above command to your redirection URL.

Step 8 :

Now you need to set the red social, here you need to choose which type of phishing page you want to create, if you need help then you can type set red social --help and you will see multiple versions of the same website, select a version that suits your social engineering. I am using normal Instagram in below command.

set red social instagram

 change the green part with other websites, Like facebook.

Step 9 :

Now the last thing that you need to set is mini title, here you need to type the description of the post. type something attractive so everyone can blindly click on it, below you can see my description, just change it yours.

set mini title It's widely known that Steve Jobs is Dead but his insta ID is still active and his images... 

Step 10 :

Now everything is done and you just have to run the fotosploit tool, before running the tool make sure you turn on your Hotspot. type below command to run the tool.

go

Step 11 :

Now you will see multiple URLs and you have to copy the ngrok URL and you need to paste it on the victim's WhatsApp chat box and wait for 10 sec so images and texts can get loaded. after everything is loaded then you can click on the send button.

Step 12 :

After the victim clicks on the link you will get the username and password in your termux terminl like shown in the below picture.

Things you should know about this tool:

• This tool only works when you share the link on WhatsApp and telegram.
• Fotosploit uses Ngrok so you need to turn on your hotspot, so basically, it won't work on wifi network.
• sometimes Ngrok tunnel fails so that is totally normal just try again. (It's ngrok's fault maybe)
• You need to paste the link on WhatsApp and then wait for 10sec so everything can load properly.
• If you try to use this tool more than once in the same session then it won't work so if anything is not working, Just Restart your Termux.

Its a possibility that Ngrok won't work in 2023 so Please use this method to make your link shareable on the internet : [ Solve Ngrok Error in Termux with Cloudflare ]

READ: [ Fix port forwarding issues in Termux ]

Conclusion:

The FotoSploit tool is a good tool for creating phishing links that look very genuine. This tool is probably not so common so no one knows about this attack. This tool is very badly designed because you need to type commands rather than just entering things. I have tested it a few times,  but if you think there is something new about this tool or I missed something, then you can tell me comments. If wanna know about other Link masking tools then you should check out [ Termux Maskphish : Mask URL in Termux ]. also check out the other posts that I have written only for termux. I am running out of ideas so if you have any new post ideas, drop them in the comment section. Thanks for reading guys, and as always Stay Ethical👾.