SayCheese is a tool designed to capture images using a target’s webcam remotely. It uses a phishing attack methodology by generating a fake webpage and prompting the target to allow access to their camera. Once they grant permission, the webcam captures photos which are then sent to the attacker’s system.
Important Disclaimer:
SayCheese and similar tools are intended for educational purposes or ethical hacking with permission. Unauthorized use is illegal and unethical.
Features of SayCheese:
- Generates phishing links to prompt camera access.
- Captures webcam images in real-time.
- Works on Termux, Linux, and similar environments.
- Requires port forwarding tools like Ngrok for remote access.
Installation of SayCheese in Termux
Step 1: Update Termux
Always ensure Termux is updated:
pkg update && pkg upgrade
Step 2: Install Required Packages
Install the essential tools for SayCheese:
pkg install git php openssh curl -y
Step 3: Clone the SayCheese Repository
Download the tool from its GitHub repository:
git clone https://github.com/thelinuxchoice/saycheese
Step 4: Navigate to the SayCheese Directory
Go to the SayCheese folder:
cd saycheese
Step 5: Run the SayCheese Script
Run the main script to start the tool:
bash saycheese.sh

Using SayCheese
- Start the Tool:
- After running the script, choose an option (usually port forwarding with Ngrok or similar tools).
- Generate a Link:
- SayCheese will provide a phishing link. This link is used to simulate the target accessing the camera.
- Send the Link:
- Send the link to the target (with permission) via email, message, or other platforms.
- Wait for Target Interaction:
- Once the target clicks the link and grants camera access, SayCheese captures images via their webcam.
- Access Captured Images:
- The images will be saved in the SayCheese directory.
Setting Up Port Forwarding
Using Ngrok:
- Install Ngrok:
pkg install wget wget https://bin.equinox.io/c/4VmDzA7iaHb/ngrok-stable-linux-arm.zip unzip ngrok-stable-linux-arm.zip - Authenticate:
./ngrok authtoken <your_auth_token> - Select Ngrok Option in SayCheese:
- Ngrok will generate a public URL for the phishing link.
Ethical Use
- Testing and Education:
- Use the tool to demonstrate webcam vulnerabilities to educate people on recognizing and avoiding phishing attempts.
- Consent is Mandatory:
- Always seek explicit permission before running tests.
Key Points
- Real-Time Image Capture:
- SayCheese captures photos instantly once the target grants access.
- The images are saved and can be viewed on your Termux.
- Phishing URL:
- The tool uses Ngrok to create a public URL that connects the target’s browser to your local Termux environment.
- Storage of Captured Images:
- All captured images are stored in the
captureddirectory in the SayCheese folder.
- All captured images are stored in the
Example of What Happens
- You:
- Send the phishing link (e.g.,
https://example.ngrok.io) to the target.
- Send the phishing link (e.g.,
- Target:
- Clicks the link and sees a request like, “This site wants to access your camera.”
- If they allow it, their webcam activates.
- SayCheese:
- Takes photos from the target’s webcam and saves them to your device.
Ethical Reminder
- This tool is strictly for educational purposes.
- Always obtain consent before testing someone’s security. Misuse can lead to serious legal consequences.
Discover more from MNS.Code.Blog
Subscribe to get the latest posts sent to your email.
