Instructor: In the previous lecture,
we've seen how to use an SMTP server
to spoof emails and make them appear like they're sent
from any other email address we want.
I also mentioned in the previous lecture
that there is another way of doing this
and that is using a web hosting.
Web hosting is simply a service
that allows us to cost files on the internet.
Therefore, we can use it to host our own website,
we can use it to share files
or we can even use the server resources
to send emails, as I'm gonna show you in this lecture.
So as you can see, learning how to set up
and use a web hosting can be useful
in many scenarios
and you can actually use it to do much more
than what I'm gonna show you here.
Now, if you look on Google,
you'll find a lot of free web hosting providers.
Unfortunately though, none of them allow you
to send emails.
That's not really a big problem
because even paid web hosting plans
are very, very cheap.
You can look online for the cheapest
and you can use any provider you want
because the steps that I'm gonna show you
will work with any provider.
But right here, I have a web hosting provider
called DreamHost.
They are pretty cheap and they work well.
So if we click on Get Started in here,
you'll see the cheapest plan is $2.95 per month.
So we're gonna click on Sign Up.
I'm gonna set this to monthly
and you'll notice the price will actually increase slightly,
so now it's $5 per month
instead of 2.95 if you paid for a year.
But that's fine.
And I'm gonna say chose a domain later.
You'll only really need to use a domain
if you're hosting your own website.
The domain is what you see here on top
when it says, for example, dreamhost.com
or zsecurity.com but in our case,
we don't need that,
so we're just gonna say choose a domain later.
And we're gonna select our payment method.
I'm gonna pay with PayPal.
Next, you have to put the billing address.
Now, you don't don't have
to put correct information in here.
You can put whatever you want.
So I'm just gonna fill this randomly.
Next, we have the account setup.
Make sure you put a valid email in here
because they will send you a confirmation.
So I'm gonna use my own email
and put a first name, last name, phone number.
Again, it doesn't have to be real.
We're gonna uncheck this to not receive marketing.
We don't want WordPress installed,
so we're unchecking this.
We don't want protection, so we're unchecking this.
And we don't want the email service that they provide,
so we're unchecking this
because we're actually gonna rely on PHP
to send the email using the mail function in PHP.
So we're basically unchecking everything.
We're going for the most basic plan they have
and we're just gonna click on Submit Order.
Now, the sign up might be slightly different
if you're using a different providers
but the steps are very simple
and it's more or less the same.
It's asking us to set a password now.
And we're gonna continue to our control panel.
And perfect, now we have a web hosting plan
that we can use to host our own websites,
host our own files if you wanted
to deliver back doors and such
to your targets
or you can use it to send fake emails,
as I'm gonna show you.
Now, again, using this dashboard
might be slightly different
depending on the provider that you have
but you'll notice that the steps are pretty much the same.
You wanna first access your management page
for the website.
So you can see in here,
it's giving us this button called Manage My Website.
We can see this is our website right now
but it's saying it unavailable
'cause it's still being set up.
So we're gonna give it its time to set up
and we'll resume the video once it's ready.
Okay, so now that the website is ready
and we can see a preview of it here,
we simply click on it to actually access it.
As you can see right now,
this is the URL for our website
and you can see it's a simple website
that has nothing that tells you you should go
to the admin to add stuff to this website.
So back to the management page.
We're gonna click on Manage.
And depending on which provider you have,
you wanna look for the File Manager.
So in my case, you can see in here,
it's saying Manage Files
and if we click on the Manage in here,
we're gonna get our File Manager.
From here, you wanna navigate to a directory
that is called public.html
or a directory that has the name
of your website as we have in here.
So this is actually the name that I signed up with.
It's gibberish but that's what I actually set it to.
So we're just gonna click on it.
This is the directory where you should upload your files.
So if you're hosting a website,
you should upload the website files here.
Or if you're sharing files,
then you should upload them in here as well
or in our case, we wanna send fake emails,
so we're gonna upload the PHP file
that we're gonna use to send the emails to this location.
Now, the file is in the resources of this lecture.
So download it.
I have it already downloaded in here.
And as you can see in the file name,
you're gonna have to rename this file to send.php
because I can't upload PHP files,
that's why I uploaded it in TXT format.
So we're gonna go up again
and you're gonna need to find the Upload button.
In my case, it's in here.
I'm gonna click on it.
Upload File and select the file that I wanna upload,
which is in my Downloads and it's this file right here.
I'm gonna double click it
and we have the file right here, send.php.
So all we have to do now
is go to the website
and I have it opened in this tab in here.
And we're gonna put a forward slash
after the website name.
And type the file name, which is send.php.
So using this is very simple.
All you have to do is set the email
that you want to send this email to
and just to switch it up,
I'm gonna send this to my other email,
which is zaid@zsecurity.org.
Next, we're gonna set the from email,
this is the email that this email will appear
like it's coming from.
So again, just to change things around,
we're gonna set the from email this time
to adrian@zsecurity.org.
Now again, when you're setting the from email,
make sure that you set it to an email
that actually exists
and make sure that your target actually receives emails
from this email and communicates with them.
This will ensure that the email will land
in the inbox and it will also increase the chances
of your target of opening the email and interacting with it.
Adrian works with me in the same company.
We frequently exchange emails,
therefore, this is a really good from email to spoof.
The next field is the name field.
This is similar to the from header
that we set manually in the previous lecture.
So let me go to my inbox
to show you where this name shows up.
Right here, I have an actual email
that it got from Adrian.
And this part right here is the name.
So whatever you set in here
will be displayed in that part.
If you don't set that up,
it will automatically be set to the email
and it will appear like this one,
which is not identical to the real one
that I can get from him.
So we're gonna set this to Adrian's name.
We're gonna set the subject
and let's just set the subject of this to Test
and we're just gonna set the body
to this is another email spoofing test.
Now, I don't really need to send a back door in this.
The whole point of this lecture
is to show you another method of spoofing emails.
So now that we're done with everything,
I'm gonna click on Submit to send the email
and as you can see, it's saying email sent.
So that means the email got sent and delivered.
So let's go to the inbox.
Let's see if it looks identical to the real one
and let's see if it actually get delivered
into our inbox.
So right here, I have my inbox
and as you can see,
here, the bottom one is an actual email
that I got from Adrian.
This is a real email from Adrian.
You can see the name here correct.
Similar to the name here.
If I stay hovering on the real email,
as you can see, I'll get a card that shows his name,
his email and his phone number
and if I hover over the spoofed one,
again, I get the exact same card
because it's pulling this from my contacts.
So it's automatically populating this.
If I go on the real email right here,
again, you can see this is a real email by him.
You see the name, you see the profile
and you see the from is from Adrian Bude.
Now, let's go to the spoofed one.
Again, you have the picture,
you have the name and if we look in here,
you have the correct email,
adrianbude@zsecurity.org.
The only part that might look a little bit suspicious
is the fact that it's saying via this.
But a lot of people are not gonna pay attention to this
and this is only displayed in Gmail.
So we tested with Live.
This doesn't even show up on it
and even with Gmail,
we have the correct profile picture,
we have the correct name,
we have the correct email if you look in here
and we even have the correct phone number.
So this is just another method
to show you how to spoof emails
in case the previous method didn't work
or if you just didn't like it, you can try this one.
Again, like I said, you can use any web hosting provider.
You do not have to use this one that I used.
You can try the free ones, you can try the paid ones
and like I said, you will get better results
with the paid ones.
The steps are pretty much the same.
The only difference might be the sign up process
and the process of uploading the file
to the website.
But the idea is the same.
You sign up with a web hosting provider,
you upload the send.php file,
you browse the .php file
from your web browser and you use it to send the email.