Let's try a few attack from social engineering to get them going to start with a simple attack that
is not detectable and can run on any platform.
You can send this to a Windows machine a Mac machine a Linux machine Android device token anything because
the way talking.
It cannot be detected which is a credential harvest attack number three an intervention harvest.
You just create a fake peach and you try to convince users to open the speech and whatever information
you put inside it would be captured and sent to you.
So let's see how how this is created so I'm going to choose number three which is the credential harvest
and you're gonna click on enter.
And here you have two options.
You can choose from web template.
They have some fake Web sites themselves.
The common one Facebook Twitter regime or you can use site crooner a future site crooner.
That's mean you need to create or you want a set to create a fake website for you.
So if I choose for instance I need to create a fake website for my company and then convince the employer
to go and write their user name and password and that information on the site I'm going to site crooner.
He's going to request for what site.
Would you like to clone but this may take time.
But it's effective actually.
And you can try.
Let me for simplicity try.
Number one first which is a web template.
So the second question would be asking about your IP.
Because what happened is the information will be sent back to you.
So he need to get your IP which is the Kelly UNIX machine to be able to send the information back for
you.
So what are going to do.
We will open another terminal and check our I.P. come thick
and our IP is 1 9 2 1 6 8 163 130.
Okay excellent.
So this is IP that I'll be using.
So we're gonna type 1 9 2 1 6 8 1 6 3 the 1 3 8 and then he's asking you from the template template
that he got he got those.
I'm gonna choose Google but if you want to your own Web site or if the fee is the size that you want
to fake is not.
You can choose a site cleaner and he will create a site for you.
You just give him the name and he will create a similar site.
So for me I'm going to use Google number two and that's it.
So now uh you can send the link which is uh uh the IP uh of your Kelly Linux machine and I'm gonna show
you how to because you know it's not easy to send someone an IP but I'm gonna show you how they are
manipulating that.
So uh everything is set as you can see and it's telling you that you know this is for penetration testing
it is not for anything that you know is bad.
So what you need to do right now is to convince the user to open the IP as a Web site.
We're gonna see how to manipulate the user.
But let's assume that you convince him to open this IP so let's open some machine.
I'm going to start with my windows 7 machine.
Okay.
This is my Windows 7 and uh I'll open any browser
it's open already.
And we will type the IP of the victim here.
Which is which TTP column is uh 1 9 2 1 6 8 1 6 3 1 3 8 right.
And I want you to notice what will happen now.
So as you can see it will open Google page asking for email and password.
Right.
Forget about you know how you'll be convincing the user to open this show as this IP because I'm gonna
show you how it's done.
And then if the user type anything here like uh we tried to log in as using this uh uh G.M. dot com
with any password.
Let's put one two three four five and you click on sign in.
Now I want you to notice what will happen here.
Okay.
He will be directed to the original Google.
That's mean that he will not noticed that the IP or the information as a username and password has been
uh what can I say uh has been captured.
I mean he saw the maybe he wrote it wrong.
Forget about this message.
This is easy to bypass but what will happen is that he will be redirected to the original pages.
Now getting back here to Michael in the next machine and let's see how I was able to get the e-mail
and I was able to get the password as well.
Okay okay let's do that from a different machine.
So let's go to a Windows XP machine this one for instance.
And uh here you go.
I'm gonna type here as IP one more time which is 1 9 2 1 6 8 2 3 8 and Same here.
I'm gonna type for instant uh you actually mean
dot com and the password uh for instance QQQ Q Anything.
And let's see what will happen here.
Sign in.
It has been redirected to Google and let us go here.
To our Kelly Linux machine.
And you can see that it has been captured.
If you open it from any platform it would be captured and sent.
Now the first question is why it cannot be discovered by any protection.
And why is antivirus will never say anything or is a firewall.
Because what happened is when you tried the credential harvest that a key will transfer your Kelly Linux
machine to a Web hosting or a web server.
And he will host a fake webpage.
So what you are doing on the victim machine you are going to a Web site that is on a web server.
So nothing suspicious.
I mean it's not like the site will install any payload on your machine on the victim machine which you
cannot rise at any different attack.
So it will not be discovered.
But the point was you know how can I send user uh this IP Uh and how to convince it to open that.
This is Google.
Now you have two different ways for doing that.
The first way if the user is on the same network you can use the attacks that we explained on the network
section which is a DNS spoofing and DNS spoofing will make this process automated in a sense that the
user open a browser type Google dot com the DNS is spoofed or poisoning.
I mean that the IP of the Google has been changed to the fake Web site.
So he will be directly uh uh more redirected to the fake Web site automatically.
So you have to convince with anything.
We just need to point out that the poisons the DNS and change the Google Web site with the fake Google
Web site.
So the user type Google here will be redirected automatically.
This is in case the user are on the same net or they're connected to a wireless in a mall or a coffee
shop or any place you can direct people to what everyone Facebook Twitter fig page on the server.
The second way and usually is they are doing that on social network.
I mean I don't know if you noticed or not but sometimes on Facebook or Twitter they will never put a
link to an subject they will say there is a likely big event and this is a link for this event or there
is the news about something.
And so they usually put a short link.
So what you can do is you can go to some Web sites that do that to shorting to the two
websites so we have many Web site actually but the one that is commonly used it's called called bit
book NY and uh here you go.
Mm hmm.
And embittered NY you just put anything here and it will be uh transferred to a short on your end.
So in my case the IP that I'm trying to send to people is TTP column and then the IP which is 1 9 2
1 6 8 uh 1 6 3 1 3 8 which is Michael in this IP and you can click on Shorten and what will happen is
uh shorten it has been changed to this year in which if you are using it if you use it in any social
media like Twitter or Facebook just not a lot of people are using short term.
So considering the tools that fake email and considering the DNS poisoning and considering different
attack if you relate things together you would be able to do an complete attack.
You can use an attack that depend on user tried to convince him or you can even do not depend on user
and do DNS poisoning and user just you know honestly go open the browser type of Facebook and you would
be automatically redirected to the fake face book page.
So this is the simplest attack that it can be done and said By the way.
You can even use it on Android.
If you send someone and you open the link from his mobile and write any credential it will be sent as
well and you can do at one point remaining before moving to the next attack which is can I do that remotely.
Yes you can.
And by the end of this course I'm going to add a section about remote attack if you need to do that
from outside because you're going to need to change some configuration your router to accept information
from outside.
So if you think about how can I do that remotely.
You will find this section by year's end of this call as it explains this part.