Recommended
Recommended
More Related Content
What's hot
Viewers also liked
Viewers also liked (18)
Similar to Phishing Forensics - SnowFROC - Denver Chapter of OWASP
Similar to Phishing Forensics - SnowFROC - Denver Chapter of OWASP (20)
More from Frank Victory
More from Frank Victory (11)
Recently uploaded
Recently uploaded (20)
Phishing Forensics - SnowFROC - Denver Chapter of OWASP
- 1. Phishing Forensics Frank Vianzon GISP, GPEN, GCWN, ACE, CompTIA Network+, CompTIA A+ Principal Security Engineer Instructor Red Rocks Community College Board Member of OWASP
- 2. RRCC Cybersecurity Program recognized by NSA and Department of Homeland Security
- 3. What is being presented • Types of Phishing • Check your phish • Basic analysis • Advanced analysis • Tracking analysis • Browser Forensics • How does phishing happen, do not contribute
- 4. • Deceptive Phishing – e-mails claiming to come from recognized sources ask you to verify your account, re-enter your information or make a payment • Spear Phishing – customized attacks within the target’s name, position, company, etc.
- 5. • Dropbox Phishing – emails claiming to come from Dropbox requesting the user to click through to secure their account or download a shared document • Google docs – view documents on Google Docs ends on entering your credentials
- 6. • CEO Fraud – phishers use an e-mail address similar to that of an authority figure to request payments or data from others within the company • Pharming – hijack a website’s domain name and use it to redirect visitors to an imposter site
- 8. • Submit to phishtank • Run by OpenDNS • API available
- 9. Advance Analysis Use a clean machine and clean network!!! • Boot USB (but make sure your drive is encrypted) • Factory Image • Clean Network – attributable hot spot or other network • Download Burp Proxy Suite and step through the site.
- 10. Review the header information
- 11. Find bad sites • Alienvault
- 12. Maltego Case File • Track your information to see relationships
- 17. Investigation of a pharming site
- 19. The captured data showed • News.yahoo.com – Associated Press – ebola-diagnosed-in-second-dallas-nurse-105542930.html ../../../.. Cd /etc/passwd Put *.* • Select statements
- 20. One gets through
- 21. Browser Forensics The three major browsers • Google Chrome • Mozilla Firefox • Internet Explorer and Edge
- 22. Google Chrome Analytics • Hindsight by Obsidian Forensics
- 23. Win UFO This is a Python script that also includes a EXE and GUI • Run at a command line ./hindsight.py -i "/users/frank/Library/Application Support/Google/Chrome/Default/" -o test_case
- 26. Internet Explorer Internet Explorer • Browsing History View
- 28. Don’t Contribute Help stop the phishing sites by checking your own network • Secure mail relays in your own network • SMTP
Editor's Notes
- Last presentation of the day – only thing standing between you and happy hour You should have started drinking before the presentation – as my wife likes to tell me, I sound a lot better when she is drunk
- Phishing is so prevalent they have created different types
- That is the easy way of doing it, but you are here because you want to do it yourself. Hover over the link Look at the header Perform a recon on the site. Check DNS records – plug that into ARIN
- Pull the header and then do DNS lookups against the domains and use ARIN
- Used to use freemind or xmind to track information – visual thinker
- User clicks on a link! We want to see what the user did
- Make sure you quote it Pull all kinds of info
- Show spreadsheet