I was honored to present to students an the public about phishing techniques we use at Pondurance. By request I also demonstrated my PhishAPI tool @ https://github.com/curtbraz/Phishing-API

1. Phishing
IUPUI Cyber Security Club
Curtis Brazzell
Principal Security Consultant

2. THREAT HUNTING AND RESPONSE | SECURITY
CONSULTING
CONTENTS
Introduction
Phishing vs Spear-phishing
Reconnaissance
Statistics
Campaign Creation
Techniques
Demo?
Q & A

3. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
01 | INTRODUCTION

4. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
PHISHING
INTRO
» Purpose
• Security Awareness
• NOT for Humiliation
» Phishing vs Spear-Phishing
• KnowBe4, etc
» Lateral
» Under the Umbrella of Social Engineering

5. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
02 | PHISHING VS SPEAR-PHISHING

6. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
» Phishing
• Casts a Wide Net
• Not as Effective
• lack of personalization / too generic
• spam filters
• poor grammar
• 1% of 1,000 is still 10
• Scams and Spams
• Scripted and Automated
» Spear-phishing
• Targeted Attacks
• Mission / Objective Based
• Highly Effective
• Takes Time / Not Easily Automated
PHISHING vs SPEAR-
PHISHING

7. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
03 | RECONNAISSANCE

8. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
OSINT
RECONNAISSANCE
» What is OSINT?
» Doing Our Homework (sorry)
» Targets
• Organizations
• Individuals

9. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
ORGANIZATIONS
RECON - OSINT
» Subdomains / Attack Surface
• Mail Server
• Remote Access (MFA?)
• Citrix / TeamViewer / Logmein / VMWare Horizon, etc
• VPN
• Careers Portal
• Contact Us
• Wappalyzer
• OS Fingerprinting
» Information Disclosure
• Google Dorking (Files, Dir Listing, Exposed Portals)
• Configuration Mistakes
» Vulnerabilities (Legitimate URLs)
• Cross-Site Scripting (XSS)
• Content Modification (iframes)
• Redirects
• Form Jacking
• Session Hijacking
• Click Jacking
• Open Redirects
• Unrestricted File Uploads
» URL Encoding Techniques / Obfuscation

10. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
ORGANIZATIONS
RECON - OSINT
» Tools
• Passive vs Active Enumeration
• Active
- MailSniper
- Application Vuln Scanners (Burp Suite, ZAP, etc)
- Network Vuln Scanners (Nessus, Nexpose, Qualys,
OpenVAS, etc)
• Passive
- Shodan
- Discover
- Dnstwist
- Amass
- Dnsdumpster
- Prowl

11. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
INDIVIDUALS
RECON - OSINT
» Breach Lists
• HIBP / Paste sites
• Shared Creds
• SSO
» About Us
» Google
» LinkedIn
» Tools (Limited List)
• LinkedINT
• Recon-ng
• theHarvester
• Maltego

12. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
» Spear-phishing (Targeted)
• Information Gathering
• Company’s “About Us” Page
PONDURANC
E
12
INDIVIDUALS
RECON - OSINT

13. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
» Spear-phishing (Targeted)
• Information Gathering
• Social Media (Linked-In, etc)
PONDURANC
E
13
INDIVIDUALS
RECON - OSINT

14. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
» Spear-phishing (Targeted)
• Information Gathering
• Recon-ng
PONDURANC
E
14
INDIVIDUALS
RECON - OSINT

15. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
» Spear-phishing (Targeted)
• Information Gathering
• Breach Lists
PONDURANC
E
15
INDIVIDUALS
RECON - OSINT

16. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
» Spear-phishing (Targeted)
• Information Gathering
• Maltego
PONDURANC
E
16
INDIVIDUALS
RECON - OSINT

17. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
» Non-Targeted
• Information Gathering
• TheHarvester
PONDURANC
E
17
INDIVIDUALS
RECON - OSINT

18. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
04 | STATISTICS

19. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
TRACKING
STATISTICS
» Ties Back to Purpose - Reporting
» Opened Emails
• 1x1 Pixel Image
<IMG
SRC="https://DOMAIN.com/campaigns?target=EMAIL@RECIPIENT.COM&camp
aignname=ITCAMPAIGN" height="1" width="1">

20. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
TRACKING
STATISTICS
» Link Clicks
• Landing Page Requests
• BeEF Hooking
• Google Analytics, etc

21. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
TRACKING
STATISTICS
» Captured Credentials
• Password Strength
• Password Uniqueness
• HIBP
• Internal
» Compromised Hosts

22. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
05 | CAMPAIGN CREATION

23. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
BELIEVABILITY
» How to create a convincing email?
• Choose a scenario
• Work from Home
• Employee Gift Card Raffle
• Management Request
• IT Department
• PhishAPI has a re-usable repository
• Will be community driven soon
PONDURANC
E
23

24. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
BELIEVABILITY
CAMPAIGN CREATION
» Customized
• TO field instead of BCC
• Match formatting of body and writing style
• Grab an email signature
• Sales Reps
• Customer Support
• Job Application
• Create your own w/ Logo

25. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
BELIEVABILITY
CAMPAIGN CREATION
» Exploit Relationships Between Employees
• HR
• IT
• Hierarchy of Seniority
» Social Tactics
• Scare
• Urgent
• Context
• Calendar Events
• Ticketing Portals / Help Desk

26. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
• Spoof the Sender
PONDURANC
E
26
BELIEVABILITY

27. THREAT HUNTING AND RESPONSE | SECURITY CONSULTINGPONDURANC
E
27
• Spoof the Sender
BELIEVABILITY

28. THREAT HUNTING AND RESPONSE | SECURITY CONSULTINGPONDURANC
E
28
• Spoof the Sender
BELIEVABILITY

29. THREAT HUNTING AND RESPONSE | SECURITY CONSULTINGPONDURANC
E
29
• If spoofing isn’t an option, create similar domain
BELIEVABILITY

30. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
OBJECTIVES
CAMPAIGN CREATION
» Credentials
• Fake Landing Pages (New Citrix Login, Finance Page, etc)
• Existing Cloned Pages w/ Company Logo
• OWA / VPN / Remote Admin Portals
» Malicious Documents (maldocs)
• Hashes
• Macros
• Credentials
» Malware
• Trojans, Keyloggers, Ransomware, etc

31. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
CREDENTIALS
CAMPAIGN CREATION
» Components
• Keep Independent
• Front-end
• Static Web Page
- GitHub Pages
- Google Sites
- EC2
• Submits Critical Info (Project, Target, etc)
• Back-end
• Receives Requests
• Processes Results
• Alert Capability
- Necessary for MFA tokens
- Time is critical for account takeover, especially when suspicious
» Cloning Tools
• Social Engineering Toolkit (SET)
• PhishAPI
• Manual
• Browser Tools
• Backend

32. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
CREDENTIALS
CAMPAIGN CREATION
» Exploit User’s Misunderstanding of Security
• Subdomains
• secure-iupui.edu VS secure.iupui.edu
• HTTPS
• LetsEncrypt
• Mention “Security” in the body
• Disable “Protected View”
• Double security banners (lol)
• Hash Stealing in email (“But I didn’t open it!”)
• BeEF Hooking (“But I didn’t enter my credentials!”)
• Failure to Properly Terminate Sessions / Persistence

33. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
CREDENTIALS
CAMPAIGN CREATION
» Tools for Capturing Credentials (Limited List)
• Phishery
• Plaintext Creds via Basic Auth
• Evilnginx
• Session Tokens via Transparent Proxy
• Modlishka
• Session Tokens via Transparent Proxy
• PhishAPI
• Plaintext Creds with Real-time Alerting (+ Basic Auth and Hashes)
• Old School (netcat, verbose python simple web server, etc)
» Once Captured
• Use Domain / SSO Creds to Log Into External Services (Email, VPN)
• Reset Passwords for Third Party Sites (MFA Services, etc)
• Search keywords in inboxes (“password”, “vault”, etc)
• Check Cloud Storage for Goodies (OneDrive if O365 / Google Drive, etc)
• Phish Laterally
• Inbox Rules
- Delete Replies, Password Reset Emails / Sent Messages
- Alert on keywords

34. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
MALDOCS
CAMPAIGN CREATION
» Examples
• PDF Adobe Reader Zero Day
• Weaponized MS Office Documents
• Macros
• Basic Auth Requests
- Captured Plaintext Credentials
• SMB / UNC Requests
- Hash Disclosure
• Other Techniques
- DDE
- Protected View Bypass
- HTTP Calls (Information Disclosure)

35. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
MALWARE
CAMPAIGN CREATION
» Traditional Malware
» Compromise of Internal Environment
» Leverage Cloud Storage
• OneDrive Sharing
• Google Drive Sharing
» More Easily Detected
» File Type Blocking

36. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
06 | TECHNIQUES

37. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
TECHNIQUES
» Phish early or late in the day
» Calendar invites
» MFA bypass
» SIM swapping
» Hashes in email body
» Check Out of Office in O365
» Establish persistence
• Log in with multiple sessions
• Try credentials on other services
» Use valid creds to export GAL or phish laterally
» Look for patterns
• Password length / requirements
• Repeated default passwords
• Season + Year

38. THREAT HUNTING AND RESPONSE | SECURITY CONSULTING
07 | DEMO?

39. QUESTIONS?
THANK YOU!
THREAT HUNTING AND RESPONSE | SECURITY
CONSULTING