-: In the previous videos,
we learned how to create a Trojan
by back-dooring normal files,
such as images, documents, songs, and so on.
So that when executed, the user sees the normal file.
But at the same time,
our evil code gets executed in the background.
So the challenge now is how to deliver
this Trojan to the target.
The first delivery method that we're going to talk about,
and my personal favorite, is the mail delivery.
Now this delivery method,
just like any other delivery methods,
relies on the information that you gathered so far.
So information gathering is very,
very important when it comes to this.
This delivery method is really handy,
because you can use it in so many scenarios.
You can use it to deliver all the back doors
and the evil files that we see so far.
You can use it to pretend to be a friend
and contact your friend and tell him to download something.
You can use it to pretend to be a website
that the target website interacts with
and pretend to be the admin of the other website
and ask the target to do something,
you can pretend to be a member of the support team
that the target website uses,
and then ask them to change their password.
For example, for the web server that they're using,
you can use it to pretend to be a company that your target
interacts with and tell them that there's a new update
of your software that they already use,
and then get them to download and install a backdoor.
So the possibilities are limitless really,
when it comes to mail delivery.
In this lecture, I'm going to show you an example
of targeting a person that's called Zaid.
And I have the information that we gathered already
in our information gathering lecture.
And after we gathered everything,
we managed to see that Zaid has a number of friends in here.
And the same friends, we managed to see their emails here.
And we managed to get Zaid's email,
which is zaid@isecurity.org.
Now Zaid could be just the normal person
that you want to hack.
He could be a friend of a person that you want to hack,
but you want to hack Zaid first
and then hack to that person.
He could be the admin of a website,
or he could be an employee of a company.
It really doesn't matter.
What we're looking at in this lecture is how can a person,
that's called Zaid, and then from there,
you can leverage that person to hack into other systems
or into other networks or into a different company.
Now, from the information that we gathered,
we see Zaid has these friends,
and these are the emails of his friends.
So what we're going to do is we're going to pretend
to be one of these guys.
So I'm .askar@icesecurity.org.
And it's this person in here, his name is Mohammad Askar.
So we're gonna pretend to be that person.
We're going to send an email to Zaid.
And the email is going to look as if
it's coming from this person.
And then we're going to ask Zaid to download a file.
Let's see how this works,
and this is going to be a more realistic delivery method
that you can actually use in real life.
Now, there are a number of ways to do this.
The easiest is just to go on Google
and look for spoof emails online.
You'll see a lot of websites that will allow you to do this.
The only problem with these websites is the email
that you're going to send will end up
in the spam directory of the target person.
So it will not be delivered into their inbox,
which is not great.
The main reason for this is
because these websites are public
and a lot of people use them for spamming,
mail servers, such as Google, Hotmail,
and Yahoo have blacklisted the servers,
and any email that comes from these servers that
these websites use, will be marked as spam.
Therefore, in order to bypass this,
you can either use your own server,
if you already have a web hosting plan,
or you can sign up for a free web hosting plan
and use that to send your fake emails,
or an even better solution is to sign up
for an SMTP or a mail server.
Now, again, there are a number of websites that offer this.
A lot of them are paid, but with the paid websites,
you'll actually get really,
really good results because they are used
by actual marketers and by actual companies to send emails.
So spam is never sent through these servers.
If you look through Google for a free SMTP server
or a free mail server, you will find some websites.
And an example of this is this one right here,
and this is also a really,
really good website because it is a paid website,
but they offer a free plan,
which we can use to send our fake emails.
Again, this website is designed for email marketing
and for actual companies
to communicate with their customers.
So when you send emails through the servers of this website,
they will not be marked as spam,
because it's very rarely used for spam.
So we're going to sign up with this website.
We're just going to pick a username.
And I just going to set it to "jhnwck",
the same user name I use for my email.
Then I'm going to input my email
and I'm going to set a password and create the account.
Now I'm going to go to the email
that I used when I signed up,
and you'll see that we got a welcome message.
I'm going to open it.
And I'm going to confirm my email address
to activate my account.
Now it's asking me for more questions.
So it's asking for my first name, last name, company name,
phone number, company website, and so on.
You don't have to fill this very accurately.
I'm just going to use any information for it.
Just make sure you put a correct phone number
because they will send a verification code
to this phone number.
Agree to the terms and submit the form.
Now it's asking us for the verification code.
I have it here on my phone number.
So it's 8-1-0-5-3-9.
And finally, it's asking us to select the plan.
Like I said, the free one is fine,
unless you want to send a lot of emails on the same day.
And that's it, we're good to go.
So in the next lecture,
I will show you how to use the SMTP servers offered
by this website in order to send fake emails.