In this section I'll focus more about the tools that can be used in social engineering.
It's not really an attack section but it will show you that you should not trust anything.
E-mail can be spoofed as a mess can be spoofed mobile or a cellular number can be spoofed.
So my point is people trust e-mail blindly.
They receive an e-mail coming from their manager they will execute whatever is inside.
They will never think that mail can be spoofed or fake.
Same concept apply for Sim as you receive an M.S. as a message from your bank.
You think as a mess cannot be fixed it can be fixed mobile number it can be fixed so it's not really
an attack session section it's more into the tools that is used into the attack.
So if a malicious hacker utilize such tools it would be very easy for him to convince anyone to do anything
that you want him to do.
So if I sent an e-mail coming from your friend or from your manager if you don't have enough background
or you are not aware enough you may be spoofed by this email and you will trust that the email is coming
from this sender.
So the first demo I want to show you it's the spoofed website or the fake I'm sorry the spoofed email
or the fake email.
If you search on Google for fake email you will see this specific Web site.
This is a quite interesting Web site.
It's free.
It's very effective.
Most probably it would go to your inbox.
If you don't have a proper meal sitting it may go to the junk but it may go to the inbox you can test
it.
You can fake an email showing it's coming from anyone to anyone and you can attach whatever you want.
You can send it in a text or as an edgier metal so to intros like you know this message coming from
LinkedIn or from Twitter or this kind of thing.
So using such tool it's very very convenient and adenoids out keeping such Web sites up and running
because actually this is very dangerous.
So let's try a demo here.
I'm going to send the mail that choice coming from John Smiths and I'm going to put an e-mail or let's
make it a yes let's make a John Smiths and the mail will be coming from John Smith's ABC dot com you
can put anything you want I can type this Miss
G Smith's
ad for instance.
Uh m as an dot com and we're going to send this email to myself I'm going to send it to different email.
So let's try it was the email that I'm using on my distinct mobile and not out if at.
Sorry and thought this uh at G M X dot com
g x com and let's try any subject test you made.
Let me put any test you mean.
Okay so the point is that can I fake an e-mail or mock.
Let's see.
And I'm not a robot
and let's send it.
Now he's saying that the e-mail has been successfully sent.
Let's see if this is the case.
So I'm going to get to my mobile.
Now this can be used on mobile or off a computer or whatever and let's see are we going to get anything
or up.
Let me refresh you wriggle.
It's coming from John Smith which it's not an existing person.
And as you can see it's showing that it came from John Smith and this is his e mail to my e-mail.
So imagine what can be done using this tool that you can like convince someone at an e-mail he received
coming from his manager or his wife or his girlfriend or whatever was the case and you tried to convince
him what it was whatever it may show it's coming from Microsoft or it's coming from their bank.
But I have to tell you this is is completely illegal.
And in some country it's a federal crime.
So it's not something to play with.
If you are doing a proper penetration testing in any organization and you see you need to check if people
you know they have enough awareness that if they receive a suspicious e-mail they will verify you can
use the stores.
Now only one weakness we have in such tools it's a one way process.
I mean you can send an e-mail showing that it's it's coming from someone.
But what if the victim replied back the reply will be going to the right person.
That's why when people use such tools they will never ask you they will never ask you to reply back.
They will usually ask you to do something and says e-mail please click on the link please don't the
attachment.
But they will never ask you to reply back sending them your credential or any kind of information.
So if you receive an e-mail and you are us you are suspecting that this is a fake e-mail.
You can try to reply back asking that you send me this e-mail.
This would be gone to the Web site and same concept apply for any spoof technique if you received a
fake mobile or a fake phone call from a fake number.
You can try to disconnect and call them back and so on.
So this is one of the tool that if you use such tool with a technique that we explained in the previous
lecture it would give you an
extremely good results.
But one more time this should be done in a proper frame.
If you are doing a penetration testing with prior approval her.