CamJacking is an enterprise-grade security awareness training framework designed to simulate realistic phishing attacks targeting camera permissions and user awareness
CamJacking is an enterprise-grade security awareness training framework designed to simulate realistic phishing attacks targeting camera permissions and user awareness. Built for ethical hackers, penetration testers, and security professionals, CamJacking enables organizations to:
โ
Assess employee awareness and susceptibility to social engineering
โ
Train teams on camera security risks and best practices
โ
Simulate realistic attack scenarios in controlled lab environments
โ
Measure security posture with detailed analytics and reporting
โ
Educate through hands-on, practical cybersecurity training
๐จ DISCLAIMER: This tool is strictly for authorized security training, educational purposes, and lab environments only. Unauthorized use is illegal and unethical. Always obtain proper authorization before testing.
- ๐ธ Camera Phishing Create realistic camera capture pages for security awareness and testing.
- ๐ฅ๏ธ Admin Dashboard (GUI Panel) Manage campaigns, view logs, and monitor activity through a web-based interface.
- ๐ค Telegram Bot Integration Receive real-time alerts and captured data directly on Telegram.
- ๐ Template Auto-Updating Automatically fetch and update phishing templates with the latest designs.
- ๐๏ธ Campaign History & Logs View and manage previous campaigns with detailed activity records.
- ๐ Automatic Port Forwarding (Local โ Internet) Expose local services to the internet automatically for testing and demos.
- GIT CLI
- Node JS
- npm
- cloudflared (CLI)
| Platform | Supported | Notes |
|---|---|---|
| Debian / Kali / Ubuntu | โ | Recommended for best compatibility |
| macOS | โ | Works well with Homebrew setup |
| Windows | Use WSL for best experience |
The project relies on the following Node.js packages:
axiosโ HTTP client for API requestsbcryptโ Secure password hashingbody-parserโ Parse incoming request bodiescorsโ Cross-origin request handlingcryptoโ Cryptographic utilitiesdotenvโ Environment variable managementexpressโ Web server frameworkform-dataโ Multipart form handlingjsonwebtokenโ JWT-based authenticationlowdbโ Lightweight JSON databasemd5โ Legacy hashing (for compatibility)multerโ File upload handlinguuidโ Unique ID generation
๐ก Tip: Make sure youโre running a recent Node.js LTS version (v18 or later) for best stability and security.
# Install globally
npm install camjacking -g# Start the Camjacking tool
camjacking- Open the Admin page:
https://cappriciosec.com/camjacking๐ Click here to open and log in.
| Parameter | Type | Default Credentials |
|---|---|---|
username |
string |
cappriciosec |
password |
string |
cappriciosec@hacker |
๐จ Note: Before opening the webpage, make sure the Camjacking tool is running locally. This URL internally checks
http://localhost:5000to verify whether the service is running.
- If the local service is running, the login page will be displayed.
- If it is not running, you will be redirected to the landing page.
After logging in with the default credentials, you can update your username and password from the Admin Dashboard.
-
Open Telegram and search for ๐
@CappricioSecuritiesTools_bot -
Click Start or send
/start, then tap the Get Chat ID button. -
Copy the Chat ID shown by the bot.
-
Go back to the Admin Dashboard โ Profile / Settings โ Paste the Chat ID and save your profile.
๐ก Tip: Once configured, youโll receive real-time notifications and alerts from Camjacking directly in Telegram.
When the Camjacking tool starts, it automatically clones the template repository from:
https://github.com/Cappricio-Securities/camjacking-templates
into the local directory: ~/camjacking-templates/
If you already have custom templates in this folder, they will not be deleted.
Your existing templates will be preserved, and newly updated templates from the repository will be added automatically.
You can add your own custom templates by creating a new folder inside:
~/camjacking-templates/
Example structure:
camjacking-templates/
โโโ your-template-name/
โ โโโ index.html
โ โโโ index.css
You can find the complete setup instructions in this repository: https://github.com/Cappricio-Securities/camjacking-templates ๐ Clickme
- Template folder names must not contain spaces or special characters.
- Only the following characters are supported:
AโZ,aโz,0โ9,_(underscore),-(hyphen) - Do not use the same name for multiple templates.
- The server automatically loads the correct template based on user input or the default configuration.
- You do not need to write any extra code to access the camera or collect data.
- Camjacking dynamically injects the required camera access logic into your templates and automatically handles routing to receive captured images.
๐ก Tip: Focus only on the HTML/CSS design of your template. The tool handles camera access and data collection for you.
To start a new campaign, simply run:
camjackingYou will be greeted with the main menu:
โโโ(Hacker@linux)-[~]
โโ$ camjacking
v2.0
โโโโโโโ โโโโโโ โโโโ โโโโ โโโ โโโโโโ โโโโโโโโโโ โโโโโโโโโโ โโโ โโโโโโโ
โโโโโโโโโโโโโโโโโโโโโ โโโโโ โโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโ โโโโโโโโโโโ
โโโ โโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโ โโโโโโโโโ โโโโโโ โโโโ
โโโ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโ โโโโโโโโโโโโโโโโ โโโ
โโโโโโโโโโโ โโโโโโ โโโ โโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโโโ โโโโโโโโโโโโโโโ
โโโโโโโโโโ โโโโโโ โโโ โโโโโโ โโโ โโโ โโโโโโโโโโ โโโโโโโโโ โโโโโ โโโโโโโ
Author: @karthithehacker
Website: karthithehacker.com
Main Menu
โโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโโโโ
โ No. โ Option โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ 1 โ๐ฏ Create new Target โ
โ 2 โ๐ Select Existing Target โ
โ 0 โโ Quit โ
โโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Select an option: 1
๐ Enter target name: Bob- Choose option
1โ Create New Target - Enter a name for your target (e.g.,
Bob)
After creating a target, you will be prompted to choose a phishing template:
v2.0
โโโโโโโ โโโโโโ โโโโ โโโโ โโโ โโโโโโ โโโโโโโโโโ โโโโโโโโโโ โโโ โโโโโโโ
โโโโโโโโโโโโโโโโโโโโโ โโโโโ โโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโ โโโโโโโโโโโ
โโโ โโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโ โโโโโโโโโ โโโโโโ โโโโ
โโโ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโ โโโโโโโโโโโโโโโโ โโโ
โโโโโโโโโโโ โโโโโโ โโโ โโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโโโ โโโโโโโโโโโโโโโ
โโโโโโโโโโ โโโโโโ โโโ โโโโโโ โโโ โโโ โโโโโโโโโโ โโโโโโโโโ โโโโโ โโโโโโโ
Author: @karthithehacker
Website: karthithehacker.com
Select Template
โโโโโโโณโโโโโโโโโโโโโโโโโโโโโโโโ
โ No. โ Templates โ
โกโโโโโโโโโโโโโโโโโโโโโโโโโโโโโโฉ
โ 1 โ GoogleMeet โ
โ 2 โ TikTok โ
โ 3 โ instagram โ
โ 4 โ instagramCamera โ
โ 5 โ instagram_videocall โ
โ 6 โ telegramCamera โ
โ x โ Previous Menu โ
โ 0 โ โ Quit โ
โโโโโโโดโโโโโโโโโโโโโโโโโโโโโโโโ
๐ Select a template: 3
Starting server โ ธ- Select the template number you want to use (e.g.,
3for Instagram). - Once selected, the phishing server will start automatically.
After the server starts, you will see output similar to the following:
v2.0
โโโโโโโ โโโโโโ โโโโ โโโโ โโโ โโโโโโ โโโโโโโโโโ โโโโโโโโโโ โโโ โโโโโโโ
โโโโโโโโโโโโโโโโโโโโโ โโโโโ โโโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโ โโโโโโโโโโโ
โโโ โโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโ โโโโโโโโโ โโโโโโ โโโโ
โโโ โโโโโโโโโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโ โโโโโโโโโโโโโโโโ โโโ
โโโโโโโโโโโ โโโโโโ โโโ โโโโโโโโโโโโโโ โโโโโโโโโโโโโโ โโโโโโโโโ โโโโโโโโโโโโโโโ
โโโโโโโโโโ โโโโโโ โโโ โโโโโโ โโโ โโโ โโโโโโโโโโ โโโโโโโโโ โโโโโ โโโโโโโ
Author: @karthithehacker
Website: karthithehacker.com
[+] New Target Created: Bob
[+] Bob UUID: 8ad78792-827e-43c0-b36e-4397c0b96e88
[+] Template selected: instagram
[+] Admin page URL: https://cappriciosec.com/camjacking/
[+] Camjacking server running at: http://localhost:8080/?uuid=8ad78792-827e-43c0-b36e-4397c0b96e88
[+] Camjacking server Target URL: https://convert-findings-founder-abroad.trycloudflare.com?uuid=8ad78792-827e-43c0-b36e-4397c0b96e88
[+] Serving files from: /home/Hacker/camjacking-templates/instagram
[+] Created At: 2026-02-25 01:11:11
[+] Enter x to stop the server
[โ] Server running on port 8080- Local URL: Used for local testing
- Public URL: Share this link with the target
- Admin Panel: Monitor logs and captured data from the web dashboard
When a user opens the target URL, activity will be logged automatically:
[+] User opened url /?uuid=03ed244c-c5d3-496d-becd-99ad13c00778
[+] IP Address: โโโโโโโโโโโโโโโโโโโ
[+] User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
[+] Log Timestamp: 2026-02-24T19:44:21.751Z
[+] Saved file: /home/Hacker/camjacking-photos/8ad78792-827e-43c0-b36e-4397c0b96e88/1771962261751.jpg- Captured images are saved under:
~/camjacking-photos/<TARGET-UUID>/- All logs and media can also be viewed in the Admin Dashboard.
To stop the running server at any time: x
Coming Soon:
- AI integration for webcloing and prompt to template designing
Our mission is to make cybersecurity simple, accessible, and easy for everyone.
We believe that while experienced hackers and security professionals may love the command line, powerful tools shouldnโt be limited to complex commands and scripts. Our goal is to build cybersecurity tools that are:
- โ Easy to install
- ๐งญ Simple to navigate
- ๐ข Menu-driven (numeric options instead of hard commands)
- ๐ฅ๏ธ Friendly for beginners with a clean GUI
- ๐ Designed to help learners understand cybersecurity concepts easily
We aim to bridge the gap between beginners and professionals by creating tools that combine the power of CLI with the simplicity of modern user interfaces, making cybersecurity learning and practice more approachable for everyone.
๐ก โCybersecurity should be powerful, but it should also be simple.โ
KarthiTheHacker
- ๐ Website: karthithehacker.com
- ๐ GitHub: @karthi-the-hacker
- ๐ ๏ธ Contributions: Core CLI, database layer, APIs, authentication, and core backend logic
Akash K
- ๐ GitHub: @Ak4sh2523
- ๐ผ LinkedIn: Akash K
- ๐จ Contributions: GUI/UI design, phishing templates, and Admin Dashboard frontend
< Built by hackers who care about security โ Team Cappricio Securities. />
www.cappriciosec.com
