In this demonstration, we will look at one of the
third‑party modules of the Social‑Engineering Toolkit and
perform a Google Analytics attack.
The Social‑Engineering Toolkit supports some third‑party modules.
Currently there are three that are available.
The first two relate to a remote administration tool, and the
third one relates to a Google Analytics attack.
We will perform a Google Analytics attack on one of my websites.
I will select the attack, and I have two options. I can either choose
the automatic mode or manual mode. With the automatic mode, all I need
to do is provide the URL and the Social‑Engineering Toolkit will take
care of the rest. But let's go ahead and use the manual mode so we can
see what it actually does.
I will type in manual, and now I need to provide the tracking ID,
which is provided on the website when the website is linked to Google Analytics.
Now that I've provided my tracking ID, I need to provide
my targeted host website. Next, I need to provide the page
that I'm looking to target.
Since I'm going to be targeting the home page, I'm not
going to define a page in the step.
I can also go ahead and define the page title,
but I'm going to leave this blank. And now I need to provide the referral page,
which I'm looking to spoof.
In this step,
you would provide your fake malicious site where you are
looking to perform any type of website attack or any type
of social engineering attack.
So I'm going to provide fakesite.com, and now the payload is ready.
I can print the payload to see what it looks like,
and then I have the ability to send a payload.
Once the payload is sent,
the Social‑Engineering Toolkit presents me with the payload URL. It also
gives me the ability to send the payload in a loop,
which I'm going to do.
I'm going to choose the time of 1 second in between each send, and then once
I'm ready to send, I'll hit Enter. And now the Social‑Engineering Toolkit will
go ahead and send this attack every 1 second. Let's jump now to the Google
Analytics Admin page and see what happens.
And now when I take a look at my Google Analytics page,
I can see that my top referral shows the fakesite.com,
which we have created in the Google Analytics attack.
Now an unsuspecting user might wonder what the site
really is and navigate to the site.
At that point,
depending on what payload you have configured on the fake site, that can be
delivered to your victim and ultimately they can be exploited.