How easy is it to build a phishing page?
A walkthrough of how phishing attacks work under the hood, from cloning a login page to capturing credentials, and what you can do to protect yourself.
Social engineering remains one of the most effective attack vectors in cybersecurity. To understand why, it helps to see just how simple it is to create a convincing phishing page — and more importantly, how to defend against one.
The anatomy of a phishing attack
A phishing attack typically starts with a replica of a trusted website's login page. In this demonstration, we recreated a social media login screen using basic HTML and CSS. The visual result is nearly indistinguishable from the real thing — same layout, same branding, same input fields.
The difference? The form submits credentials to an attacker-controlled backend instead of the legitimate server.
How the backend works
On the server side, a simple PHP script receives the submitted username and password and logs them to a text file. That's it — no complex infrastructure, no advanced tooling. A few lines of code is all it takes.
The local server was hosted using XAMPP, a common development environment. To make the page accessible over the internet, ngrok was used to create a public tunnel to the local server. A URL shortener then masked the suspicious-looking ngrok URL into something more clickable.
The social engineering angle
The technical setup is only half the equation. The real power of phishing lies in the message that delivers the link. Something as simple as "Hey, can you like my latest post on this link? It's for a charity thing" exploits existing trust relationships and creates urgency without raising suspicion.
How to protect yourself
- •Always check the URL before entering credentials. Look for the correct domain, HTTPS, and no unusual subdomains.
- •Enable two-factor authentication on all accounts. Even if credentials are captured, 2FA adds a critical second barrier.
- •Be skeptical of unsolicited links, even from people you know — their accounts may be compromised.
- •Use a password manager that auto-fills only on legitimate domains, making it harder to accidentally submit credentials to a fake site.
The takeaway isn't that phishing is sophisticated — it's that it doesn't need to be. Awareness is your best defense.
Screenshots
The cloned login page — visually identical to the real thing
HTML source of the phishing page
PHP backend capturing submitted credentials
Credentials logged to a text file on the server
Using ngrok to tunnel the local server to the internet
URL shortener masking the phishing link