In this demo,
we're going to explore phishing techniques to unlock ways
to gain initial access through phishing.
First, we'll enumerate our victim company to identify potential targets.
Then we will dive deeper into the domain to identify limitations and how
we plan to target the victim with a phishing attack.
We will also run through an alternative phishing attack scenario
using the MITRE tactic spearphishing via a service.
We're going to start off on our Kali attack system,
which is a prebuilt VM provided by Offensive Security
available on their virtual image download page.
This VM will come with King Phisher preinstalled on it.
And to ensure clarity in our demo scenarios,
I recommend you using this VM in your lab.
If you prefer to install King Phisher manually,
you can perform the install on either Kali or other supported
Linux distros of choice by using the terminal instructions
found on the King Phisher GitHub page,
which I'll include a link to in the resource section at the end of the course.
With our attack system ready, let's go ahead and identify our victim.
We're going to be targeting the Globomantics corporation.
To accomplish initial access,
let's open up our web browser from the terminal by typing
firefox and navigate to the Globomantics website,
which is globomantics.lan.
We can use the public information provided on the
Globomantics website to help us enumerate our target and
identify potential victims to attack.
The information found on the Globomantics company website will also
serve as a great repository of information that will help us craft a
convincing attack using King Phisher.
To help identify a victim to target,
let's navigate to the Our story website section.
Scrolling down the page,
we see that Globomantics is detailing information about their CEO.
This will make a great target for a phishing attack.
Now let's navigate to our social media platform of choice to
gather further information on our victim.
Here we see on the social media platform that the CEO is providing some of
his personal data associated with Globomantics publicly.
We see that we are able to collect his Globomantics email address,
which we can use for our King Phisher attack.
While we're on the social media platform,
let's take the opportunity to perform a quick
phishing attack against our victim.
In addition to using social media platforms to help enumerate victims,
we can use the platform to send messages to facilitate a phishing attack.
Like King Phisher,
social media platforms offer us a unique way to
target victims with a phishing attack.
While we can use King Phisher to send phishing messages mapping to MITRE
tactics spearfishing via link or spearfishing via an attachment,
social media can be used to phish victims mapping to the
MITRE tactic spearfishing via a service.
We see here on our social media platform,
we have the ability to post a message to our victim.
Let's type a message to the CEO,
enticing him to click on a malicious link that we purport is
related to a potential job opportunity.
While phishing the victim using this method has some advantages,
including typically a less strict security policy on data
transmitted to the user base of the media platform than that of an
enterprise such as the Globomantics email domain,
which we will need to take into account with our King Phisher attack,
using social media,
we do run into limitations on how successful we can
report on and customize our attack.
Both are limitations which the King Phisher feature set will solve for.
Now let's close our browser and pivot back to the enumeration of the
Globomantics domain with the information we have gathered from the company
website and the victim's public social media profile.
From the terminal,
we can enumerate the Globomantics mail domain by querying the DNS records for
the email domain to see if the company has created an SPF record to control
who can send mail from the Globomantics domain,
a tactic we will want to employ in order to increase the likelihood
that our phishing attack will work against our victim.
In terminal,
we type nslookup space ‑type=txt space globomantics.lan and press Enter.
Here we see that Globomantics does indeed employ the use of an SPF record,
which is instructing recipient email domains to only except
globomantics.lan mail from servers registered with the Globomantics
domain MX record and drop all messages from senders not originating
from the servers contained in the record.
This will create a problem for us if we try to spoof the
globomantics.lan domain in our attack,
and we'll need to keep this information in mind as we
craft our phishing attack in King Phisher.
Now that we have completed our enumeration against our victim,
let's go and open King Phisher to get started crafting our attack.
From the terminal,
we will type /usr/share/king‑phisher/KingPhisher and press Enter.
Note here that the path we are accessing King Phisher from is the
default path on Kali Linux with King Phisher preinstalled,
but will differ from the default location if you've installed King
Phisher manually on Kali or a different Linux distro.
As the King Phisher client opens,
we'll be prompted to enter credentials to access the
database of the King Phisher server.
Both client and server are residing on our Kali Linux system.
However, if you prefer, you can run the client on a separate system,
including on the Windows operating system.
We enter our Kali user credentials with a username of kali
and a password of kali and click Connect.
We notice here that we have received a connection error
that the server refused the connection.
This is most likely because while we have opened the King Phisher client,
the King Phisher server is not currently running.
We can validate this by checking on the King Phisher
service status from the terminal.
Let's click OK on the client error message and open a new terminal tab
and enter systemctl space status space king‑phisher and press Enter.
We can indeed validate that the King Phisher server is inactive. To
start the service type sudo space systemctl space start space
king‑phisher and press Return.
Reviewing the status command again now shows that the
King Phisher server is now running.
Now let's retry our Kali credentials in the King Phisher
client, entering the username of kali and the password of
kali and click Connect. Success.
This will end our demo where we enumerated our victim
both through the company website, DNS records, and social media,
as well as learned how to use social media platforms to
perform a spearphishing as a service attack.
We are now equipped with the information we will need to use King Phisher
and begin crafting our attack to spearphish our victim.