What is it?

It consists of creating an email, website or message that impersonates a legitimate company, so that the victim enters important data believing they are doing it on the real site

Social engineering

Social engineering is the set of techniques used to manipulate or deceive people in order to infect them with malicious files or obtain information or access to computers, networks, companies…

Types of phishing

• 📲 Smishing

  Done through text messages

• ☎️ Vishing

  Done through phone calls

• 💿 Baiting

  Done through USB sticks, DVDs, CDs that drop a malicious file onto the device

  Example of social engineering using the baiting technique in the series Mr. Robot

There are several tools for phishing, such as Social-Engineer Toolkit, which comes preinstalled on Kali Linux and Parrot. Besides phishing, it can also be used for many types of social engineering attacks. Zphisher is another phishing tool that comes with many templates of common websites already installed

Simulating a web phishing attack with Social-Engineer Toolkit

This is done for educational purposes, to raise awareness of the dangers of the internet

github.com/trustedsec/social-engineer-toolki

For this example we’ll use Social-Engineer Toolkit.

The website we’re going to clone will be https://www.nhseportfolios.org/Anon/Login/Login.aspx

And our target will be pepito

Setting up Social-Engineer Toolkit

When we run it, a menu with several options appears. We’ll choose “Social-Engineering Attacks”, “Website Attack Vectors” and “Credential Harvester Attack Method”. Now it gives us 3 options

• Web Templates

  This option clones websites the program already has cloned. It offers Google and Twitter

  Google template:

  

• Custom Import

  This option lets us build the website from scratch or import it manually. To pass it to the program, we have to give it the full path to where the website’s files are on our machine

• Site cloner

  This is the most interesting option, since you just give it a website’s link and it clones it

Since we want to clone the nhseportfolios.org website, we’ll choose the site cloner option and give it the URL

set:webattack> Enter the url to clone:https://www.nhseportfolios.org/Anon/Login/Login.aspx

Now we’ll have a website running locally that is exactly like the original, and the program will keep listening for connections

Result

From the victim’s point of view, when they click on this link http://attacker_ip they will see the clone of the original website

When they enter their credentials… on the attacker’s side, in the terminal where the program was running, we see it has captured the credentials!

POSSIBLE USERNAME FIELD FOUND: $UserName=pepito
POSSIBLE PASSWORD FIELD FOUND: $Password=secret123

This method works, but having an IP as the URL isn’t very convincing.

There are several ways to make it more convincing, for example by changing /etc/hosts, hosting it on a server or combining it with a QR code

Changing /etc/hosts

There is a file on Linux, /etc/hosts/, and on Windows, C:\Windows\System32\drivers\etc\hosts. This file is used to map IPs to domains. If we add a line with the following

192.168.1.142 nhseportfolios.org
#IP atacante   Dominio

Now, every time we go to nhseportfolios.org, it will send us to 192.168.1.142. This method works, but it isn’t very practical, because you can only do it with someone on your same network and you have to change their etc/hosts, which requires administrator permissions on the victim’s machine (although it could be changed with a trojan). It isn’t very efficient

Email

The most common way to send fake websites is by email. Attackers send emails trying to create a sense of panic so that the victim gets nervous and clicks on the link

QR

Another way to sneak in the phishing would be through a QR code that leads to the page we cloned. We can do this in Social-Engineer Toolkit itself, in the QR section

It asks for the website we want the QR code to lead to

We see that it has generated the QR image and saved it to /root/.set/reports/qrcode_attack.png

This can be combined with an email.

How to spot it

Before clicking on or downloading anything from an email, follow these steps

• Check that the address is from a known site and that it doesn’t have extra letters, numbers in place of letters, lots of dots…

• Before clicking any link, it’s important to verify that it is the company’s real one. If it’s a button and you can’t see the link, you can hover over it with the mouse without clicking so the link shows up at the bottom left. It’s best to go to the website manually rather than through email links

• Many attacks are made with translators, so the grammar in phishing messages is usually not very good

Remember that the biggest vulnerability of any device is its user

How to prevent it

It’s a good idea to have an antivirus on your PC; nowadays almost all antivirus programs have an option to block possible phishing

If you are a company’s IT technician, what you can do is block all the possible variations of a domain from the antivirus. For example, if you work at a bank and employees always have to access bancoseguro123.com to work, you can use the urlcrazy tool to generate domains similar to the original and add them to the antivirus blacklist, as long as no legitimate website gets blocked, since that could affect the employees

$ urlcrazy -r bancoseguro123.com

Typo Type              Typo Domain                              
----------------------------------------------------------------
Original               bancoseguro123.com                       
Character Omission     bacoseguro123.com                        
Character Omission     bancoeguro123.com                        
Character Omission     bancosegro123.com                        
Character Omission     bancoseguo123.com                        
Character Omission     bancosegur123.com                        
Character Omission     bancoseguro12.com                        
Character Omission     bancoseguro123.cm                        
Character Omission     bancoseguro123.co                        
Character Omission     bancoseguro13.com                        
Character Omission     bancoseguro23.com                        
Character Omission     bancoseuro123.com                        
Character Omission     bancosguro123.com                        
Character Omission     bancseguro123.com                        
Character Omission     banoseguro123.com                        
Character Omission     bncoseguro123.com                        
Character Repeat       baancoseguro123.com                      
Character Repeat       banccoseguro123.com
...                    ...

What to do if you’ve already fallen for a phishing attack

The first thing is to contact the company’s support. If what was stolen were your passwords, change them, and if you use the same password on another website, it’s also important to change it there. Finally, you can report it to the police as fraud