In this demonstration,
we will create a credential harvesting attack and look at how we
can harvest credentials by cloning a website.
Now, let's perform a website attack.
This is done from the social engineering attacks category,
and we will select Website Attack Vectors.
There are a number of different types of attacks that you can
create using the Social‑Engineering Toolkit.
The one that we're going to use is one that's commonly used in the real world,
and that is the Credential Harvester Attack.
The aim of the Credential Harvester Attack is really to
harvest credentials that can be used by a malicious attacker
for any type of malicious activity.
The way that this attack works is by making a copy of a legitimate site and
tricking the user into entering their credentials into the site.
So we will select Credential Harvester Attack Method,
and we have a number of options.
We can use web templates, clone a specific site,
or we can use a custom import for any site that we have already copied.
Let's start with the Site Cloner.
Now,
what's important to note with the Credential Harvester Attack is
that it is looking for form fields to rewrite.
What that means is that the site you are trying to clone should have both
the login or username section and the password section.
In this specific attack vector,
the Social Engineering Toolkit makes use of Harvester.
So let's get started with creating the attack.
The first option we have is to define the IP address
where the data will be posted back to.
In this case, it's the machine that we are using to attack.
I'm going to keep the default IP address, and now I have the option
to define the website that I would like to clone.
SET supports both HTTP and HTTPS,
which gives you a wide variety of websites that you can actually clone.
So I will define the website that I am looking to clone right now, and SET will
go ahead and start the cloning process. Depending on the site and the size of
the site, the cloning process can take some time.
Once the website has been cloned,
the Credential Harvester will be running on a web
server on your attacking machine.
So now, if I navigate to that IP address,
I would be presented with the cloned website.
Since we're doing this in the lab environment,
all I need to do on my target machine is navigate to the IP
address, and I will be presented with the URL.
In a real‑world solution,
you would need to find a way to mask your malicious URL so
that the user that's not notice that they are browsing to a
fake URL instead of the real deal.
There are various ways that you can do this,
and this can be accomplished by using a few different tools.
You can use things such as DNS interception or various homograph attacks.
It can actually make a malicious URL be perceivable as a legitimate URL.
Let's jump now to the Windows machine and navigate to
our IP address and see what happens.
So now that I'm on my Windows machine, I'm going to go ahead and
navigate to my malicious URL. And in this case,
since we're doing this on a lab environment,
I'm going to use the IP address, and now you'll see
that I'm presented with a login page,
which looks exactly like the website that we have cloned.
I will navigate to the website, the real website,
and you can see that the resemblance is exactly the same. Of course, since
the site uses HTTPS, since we are using a fake site,
we would not match the HTTPS certificate, and hence,
this would be a very good telltale sign that the user is browsing
to an insecure or a malicious URL; however,
in most cases,
users don't actually notice this and still fall victim to this type of attack.
So now, I'm going to go ahead and enter an email address and password.
Let's see what happens. As soon as I click on Login, what happens is it
actually redirects me back to the legitimate site,
and now I'm going to jump to my Kali Linux machine and see what we
have captured, and you'll notice in the terminal window, we now have
both the username and password of that user.