Seeker is a social engineering tool that locates smartphones by hosting a fake website requesting location permission.
The tool exploits the browser's geolocation API to extract precise GPS coordinates from target devices. When a user grants location permission on the fake webpage, Seeker captures longitude, latitude, accuracy, and optionally altitude, direction, and speed. Beyond location data, it collects device information without requiring permissions, including canvas fingerprint-based unique identifiers, operating system details, CPU core count, RAM amount, screen resolution, GPU information, browser identification, and both public and local IP addresses. The tool then performs automatic reconnaissance on the gathered IP address.
Seeker differs fundamentally from IP geolocation services, which provide only approximate ISP locations rather than actual device positions. By leveraging GPS hardware present in smartphones, Seeker achieves accuracy to approximately thirty meters when users grant permission, whereas IP geolocation lacks this precision. The tool falls back to IP geolocation or cached coordinates on devices without GPS hardware, such as laptops. Accuracy depends on device GPS capability, browser JavaScript support, and GPS calibration quality. The project is presented as a proof of concept for educational purposes, demonstrating what data malicious websites can harvest and why users should avoid clicking suspicious links and granting critical permissions.
Development activity shows consistent maintenance with regular updates addressing functionality and user experience. The project maintains active documentation and provides multiple template options for deployment scenarios. Community engagement appears steady through the associated blog and social channels, with the tool available in multiple languages to reach a broader audience.
