Now we'll see how to hack into Facebook Twitter and Gmail accounts.
There is an application that comes with Kelly under the social engineering tools called SETI which is
the social engineering toolkit you can press the icon from here to run it or open the terminal and right
set toolkit you will be prompted with a menu of six items.
We are interested in social engineering attacks.
Press 1.
Then it will prompt to another menu with 11 different social engineering techniques or methods to execute
in this tutorial.
We're interested to execute website attack vectors so press on to then select credential harvester attack
method number three.
Here you will be able to select web templates that already exist within the as each tool.
Or you will be able to tell the tool to clone a website or you'll reference the tool to a custom import
directory in order to input the website.
And this tutorial will choose one which is the existing what templates in the SBT tool IP address for
the post but is the local IP address we're using here 1 9 2 1 6 8 or 2 on 1 or 22 just to make sure
I have config and this is my IP address.
Press enter then it will tell you which template you want to use.
First of all let's use the Google template so template number 2 and the.
It has created the file or the Web site under the static duties so it's actually created a fake Gmail
Web site.
So that will use in order to harvest the credentials from the user's stress enter.
You want to attempt to disable it but she seems a patch is running.
And this website wants to run.
So press yes harvest is ready have the Tim browser for your site.
So actually my IP address now is hosting a fake Gmail Web site.
How to test that.
I need to go to a browser on my windows machine and type the IP address.
Elf the caliber machine.
And here you go.
It has Google page.
So for example Chris any email type any email
and any password.
Okay.
And then sign and observe the behavior here.
It will direct you.
To the Google page.
And if I go to my machine here I'll be able to capture the credentials.
This is the email I used.
And this is the password that I used.
Simple huh.
So similarly you can generate the report as well et cetera.
We'll do the same thing for the Twitter
select a Twitter template.
Street turn and let's go to the website here again.
1 until that turns into 2 1 1 0 2 1 3 2.
And here you go you have a Twitter sign and again just try to use any email and any password press sign
in it to capture their credentials and redirect you to the Twitter home page.
The user the normal user will not notice this kind of behavior again.
If you go to the machine you'll be able to capture the credentials here.
So this is regarding the attacks for Gmail and Twitter.
Let's see how Facebook works.
So in the Facebook example will select custom will select cyclones.
So select two and then use the local host IP and then enter the site that you want to clone.
In this case it's Facebook.
In this case it's H TGP as log in Facebook com.
It says that the files have been copied and it's running on port 80.
So let's go here again and use the same IP
so here it seems some gross scripting just press control at 5.
So did some CSR s and JavaScript issues pest control of 5.
And here we go.
Just puts any email
and puts any password press log in again the same behavior it will take it to the legitimate Facebook
page.
And if you go here you'll see where is that the credentials that we use now are captured quite easy
huh.
Now if you go to sometimes it's not easy to show this link to a 1 6 8 2 1 1 3 2.
So this link is actually we're still working in our lab and our internet.
But once you publish this and we'll see going forward in the videos how to publish this on the Internet.
It is not advisable to send such a link here so you can go to the site.
But Li dot com and just put your public link here.
What's that.
Just copy this address of the and copy it exactly so it'll give you this shorthand here you can send
it through email to anyone.
And once he presses on that it will be a redirect to the webpage hosted on your server.
So now we learned how to spoof Facebook Twitter Gmail pages and how to harvest the accounts.
Now if you can link it to some of the techniques we studied earlier such as DNS poisoning art poisoning
you will be able to link the chains and come up with a scenario which is the real world scenario and
how to combine social engineering with network attack techniques.