# 📍 Free Tool That Pulls GPS, IP, and Selfies From a Click **URL:** \ **Category:** Tools & Scripts\ **Tags:** hacking, tips-tricks\ **Created:** [May 7, 2026, 3:01pm UTC](https://onehack.st/t/free-tool-that-pulls-gps-ip-and-selfies-from-a-click/321853 "2026-05-07T15:01:07Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![Matsomot](https://onehack.st/user_avatar/onehack.st/matsomot/32/146573_2.png) [@Matsomot](https://onehack.st/u/Matsomot)\ **Post date:** [May 7, 2026, 3:01pm UTC](https://onehack.st/t/free-tool-that-pulls-gps-ip-and-selfies-from-a-click/321853/1 "2026-05-07T15:01:07Z")
Every website you open can ask your browser for permissions — same way phone apps do. _“Allow this site to use your location?”_ _“Allow this site to use your camera?”_ You’ve tapped these popups a hundred times. **Normal sites only ask when there’s an obvious reason** — Google Maps for directions, Zoom for your meeting, your bank for check scanning. **r4ven is a webpage whose ONLY job is to dress those popups up as normal, then ship whatever it gets to the attacker’s Discord channel.** That’s the entire mechanism. **No malware. No exploit. No fancy hacking.** Just a webpage exploiting one universal habit: _tapping Allow without reading._ > 💡 **The real kicker:** even if the target taps **Block** on the popup, the page already silently grabbed their **IP, device model, browser, OS, and rough city** — _the second they clicked the link._ That part needs no permission at all. The GPS pin and selfies are just the bonus prize for tapping Allow. ![](https://odysee.com/public/favicon_128.png)[Odysee](https://odysee.com/@spyboy:b/R4ven:8) ![](https://thumbnails.odycdn.com/card/s:1280:720/quality:85/plain/https://thumbs.odycdn.com/61e3df0829262299f4abecc05e93f191.webp) ### [R4ven - Track Someone’s Location Over The Internet](https://odysee.com/@spyboy:b/R4ven:8) The tool hosts a fake website that uses an iframe to display a legit website and, if the target allows it, it will fetch the target’s GPS location (latitude and longitude), and capture multiple pictur… * * * ### 🤩 Why it’s awesome - 🆓 **Free, open-source, 1.3k stars** — anyone can read every line of the code - 🎯 **Works because the weakness is human, not technical** — same reason real phishing works - ☁ **“Run in Google Cloud Shell” button on the repo** — zero install needed to play with - 🎭 **Pairs with a URL masker** so links look like `youtube-shorts.com/abc123` instead of an ugly IP address - 📲 **Captures arrive in Discord** like notifications — easy to scroll back through later - 🧠 **Best phishing-awareness teacher in 5 minutes** — once _your own_ GPS pin shows up in _your own_Discord from _your own_ click, the lesson sticks for life * * * ### 🎲 Fun use cases | Use case | The vibe | | --- | --- | | 🧪 **Test it on yourself** | Send the link to your own phone, watch your data pour out in real-time. Eye-opening doesn’t cover it. | | 🐟 **Smoke out a catfisher** | _“Wow you’re really in Miami?”_ → “wanna see my pic?” link → coordinates say Lagos call center | | 🔍 **Sniff a sketchy seller** | Marketplace seller claims “local pickup only” but the messages feel off — one click, truth confirmed | | 🧑‍🏫 **Family security demo** | Run it at the dinner table on someone who consents — instant lesson on why permissions matter | | 📱 **Find your own lost phone** | Email yourself the link, click it the moment you spot the phone briefly, get coords back | | 🥷 **Authorized pentest demos** | Red-team gigs, classroom labs, security meetups — exactly what it was built for | > 💡 **Obvious caveat:** aiming this at someone who hasn’t consented is illegal in most countries. The fun is in _understanding the trick_, not weaponizing it. Run it on yourself or active scammers — not your ex. * * * **Repo:** [github.com/spyboy-productions/r4ven](https://github.com/spyboy-productions/r4ven) * * * _Run it on yourself first. Watch your own coordinates land in your own Discord from a single click. That’s the moment “Allow Location?” stops being a reflex tap — forever._