Downloaded 21 times
Uploaded byHaydn Johnson
Phishing dc618 haydnjohnson
The document provides a comprehensive overview of phishing, including definitions, types of phishing attacks, and statistics. It discusses techniques for phishing, the importance of social engineering, and the tools used to execute phishing attacks. Additionally, it notes the significance of understanding email security and the potential risks associated with phishing campaigns.
![[BDD 2025 - Mobile Development] Mobile Engineer and Software Engineer: Are we...](https://cdn.slidesharecdn.com/ss_thumbnails/md-mobileengineerandsoftwareengineerarewestillrelevantsidiqpermana-251127010650-55224ef1-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Exploring Apple’s On-Device FoundationModels](https://cdn.slidesharecdn.com/ss_thumbnails/md-exploringappleson-devicefoundationmodels-251124030840-d690542c-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Full-Stack Development] The Modern Stack: Building Web & AI Appli...](https://cdn.slidesharecdn.com/ss_thumbnails/fs-themodernstackbuildingwebaiapplicationswithserverless-251124030844-388cf04f-thumbnail.jpg?width=640&height=640&fit=bounds)
![[BDD 2025 - Mobile Development] Crafting Immersive UI with E2E and AGSL Shade...](https://cdn.slidesharecdn.com/ss_thumbnails/md-craftingimmersiveuiwithe2eandagslshaderveronicaputrianggraini-251124030840-0c677f44-thumbnail.jpg?width=640&height=640&fit=bounds)
Phishing dc618 haydnjohnson
- 1. @haydnjohnson Phishing For the shell DC618-> Thank you for having me
- 2. @haydnjohnson WhoAMI ❏ Security Analyst| Manager | Purple Teamer ❏ Points (points.com) ❏ Talks: BsidesTO, Circle City Con, HackFest, SecTor ❏ OSCP, Offsec, Purple Team, Gym?? ❏ http://www.slideshare.net/HaydnJohnson Views are my own :) @haydnjohnson
- 3. @haydnjohnson Outline ❏ What isphishing: Phishing Attacks | Real world ❏ Different ‘Phishing’: Clicks | Creds | Shells ❏ Email Minefield ❏ To learn phishing - What does that involve | require ❏ How I learned to phish - frameworks, Payload, VM
- 4. @haydnjohnson Real attacks -stats * Why should you care about phishing * Phishing is now the #1 delivery vehicle for ransomware and other malware. https://blog.barkly.com/phishing-statistics-2016
- 5. @haydnjohnson Top 10 InternetScams 1. Phishing emails and Phony Web pages 2. The Nigerian scam, also known as 419 3. Lottery scams 4. Advanced fees paid for a guaranteed loan or credit card 5. Items for sale overpayment scam 6. Employment search overpayment scam 7. Disaster relief scams 8. Travel scams
- 6.
- 7. @haydnjohnson Phishing Examples -@johnLaTwc Excel
- 8. @haydnjohnson Phishing Examples -@johnLaTwc AV
- 9.
- 10. @haydnjohnson ❏ Many emails ❏High amount of emails hoping for high amount of victims ❏ “Spray and pray” ❏ Not specific to one person or company Spam Campaign
- 11.
- 12. @haydnjohnson ❏ Few emails ❏Research ❏ High value target ❏ Like marketing, entices you to open Spear Phishing Campaign
- 13.
- 14. @haydnjohnson Phishing Types Counting Clicks GatheringCredentials Gaining Command & Control
- 15.
- 16. @haydnjohnson Counting Clicks “Click ThroughRate” http://www.dummies.com/web-design-development/site-development/calculating-click-through -rates-for-e-mail-campaigns/
- 17.
- 18. @haydnjohnson Counting Clicks PHP code <?php if(file_exists('count_file.txt')) { $fil = fopen('count_file.txt', r); $dat = fread($fil, filesize('count_file.txt')); echo $dat+1; fclose($fil); $fil = fopen('count_file.txt', w); fwrite($fil, $dat+1); } else { $fil = fopen('count_file.txt', w); fwrite($fil, 1); echo '1'; fclose($fil);
- 19.
- 20. @haydnjohnson Counting Clicks Click LinkCount ClicksReceive Mail Open Mail
- 21.
- 22.
- 23. @haydnjohnson Getting Credentials Click LinkEnter CredentialsReceive Mail Open Mail Attacker receives credentials Credentials sent to attacker
- 24. @haydnjohnson Getting Credentials ISSUES: ❏ Haveto reset passwords ❏ Exposing passwords
- 25.
- 26. @haydnjohnson Command & Control TYPESOF SHELLS Synchronous (Reverse, Bind) Asynchronous (Beacon, Empire Agent)
- 27. @haydnjohnson Command & Control ClickLink Download / executeReceive Mail Open Mail
- 28.
- 29. @haydnjohnson Command & Control ISSUES: ❏Hijacking control ❏ Unencrypted communications ❏ Data out of the network
- 30.
- 31.
- 32.
- 33.
- 34. @haydnjohnson NOT SPAM DNS records| DKIM - email spoof protection No-deliver notice for recon https://en.wikipedia.org/wiki/Sender_Policy_Framework https://en.wikipedia.org/wiki/Bounce_message https://en.wikipedia.org/wiki/DomainKeys_Identified_Mail Sender Policy Framework
- 35.
- 36.
- 37. @haydnjohnson Mail Anti-Virus Sender Policy Framework Mail Anti-Virus https://github.com/carnal0wnage/malicious_file_maker Test withdifferent files: ❏ Exe ❏ Javascript etc
- 38.
- 39.
- 40.
- 41.
- 42. @haydnjohnson Host Anti Virus Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus http://www.blackhillsinfosec.com/?p=5570 http://www.blackhillsinfosec.com/?p=5555 https://null-byte.wonderhowto.com/how-to/bypass-antivirus-using-powershell-and-metas ploit-kali-tutorial-0167601/ https://blog.netspi.com/10-evil-user-tricks-for-bypassing-anti-virus/ Runin memory PowerShell DLL Remove ‘mimikatz’
- 43.
- 44.
- 45. @haydnjohnson Pentest part Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus ❏ FirstLanding ❏ AV bypassed ❏ Whitelisting ❏ Constrained Language mode https://www.lifewire.com/introduction-to-intrusion-detection-systems-ids-2486799
- 46.
- 47. @haydnjohnson Intrusion Detection System &Prevention Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS ❏ NIDS ❏ HIDS ❏ Signature ❏ Anomaly ❏ Passive ❏ Active https://www.lifewire.com/introduction-to-intrusion-detection-systems-ids-2486799
- 48. @haydnjohnson Intrusion Detection System Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS ❏Not easy to bypass ❏ Bypass Intranet Proxy | Supply creds ❏ Obfuscation ❏ False negatives https://arno0x0x.wordpress.com/2016/04/13/meterpreter-av-ids-evasion-powershell/ https://www.sans.org/reading-room/whitepapers/detection/intrusion-detection-evasion-attackers-burglar-alarm-1284 “%2e%2e%2f%2e%2e%2fc:winntsystem32netstat.exe” Instead of “../../c:winntsystem32netstat.exe”
- 49.
- 50. @haydnjohnson Firewall Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS Firewall ❏ BastionHost ❏ DMZ ❏ Deep Packet inspection ❏ Reassemble packets ❏ “NEXTGEN” https://blog.fortinet.com/2014/10/09/a-few-words-about-evasion-techniq ues
- 51. @haydnjohnson Firewall Sender Policy Framework Mail Anti-Virus DELIVERED Host Anti-virus Code Execution IDS Firewall ❏ Fragmentation ❏Tunnel ICMP | HTTP ❏ Encryption ❏ Firewalk http://stephenperciballi.blogspot.ca/ https://www.cybrary.it/video/ids-firewalls-honeypots-whiteboard/
- 52.
- 53.
- 54.
- 55. @haydnjohnson Phishing - whatwe need to do ❏ Domain ❏ Send Email ❏ Deliver Email
- 56. @haydnjohnson Phishing - whatwe need to do ❏ Social Engineer ❏ Click Link
- 57. @haydnjohnson Phishing - whatwe need to do ❏ Interact ❏ Download ❏ Execute
- 58. @haydnjohnson Phishing - whatwe need to do ❏ Send Email ❏ Deliver Email ❏ Social Engineer interaction ❏ Receive shell
- 59. @haydnjohnson Considerations - whatdo I need to learn ❏ Build a convincing email | pretext ❏ Build a website that is convincing (framework / manual) ❏ Bypass email minefield ❏ Understand payloads and user interaction References: https://arstechnica.com/information-technology/2014/02/how-to-run-your-own-e-mail-server-with-yourown-domain-part-1/2/ https://arstechnica.com/information-technology/2014/03/taking-e-mail-back-part-2-arming-your-serverwith-postfix-dovecot/ https://arstechnica.com/business/2014/03/taking-e-mail-back-part-3-fortifying-your-box-againstspammers/
- 60. @haydnjohnson Sending an Email ❏MTA (Mail Transfer Agent), sending and receiving e-mail MDA MUA ❏ MDA (Mail Delivery Agent) POP / IMAP email into inbox MTA ❏ MUA Mail User Agent – email client
- 61. @haydnjohnson Sending an Email ❏Must have a valid SSL/TLS certificate for your mail server – not self signed ❏ /etc/ssl/private ❏ Virtual or Real accounts I trust ya
- 62. @haydnjohnson Sending an Email- Fighting Spam ❏ Probably not an issue ❏ Others can validate we are real ❏ Spam filtering
- 63.
- 64.
- 65.
- 66.
- 67. @haydnjohnson What I did ❏Installed ❏ Played around ❏ Decide on preferred tool
- 68.
- 69.
- 70. @haydnjohnson Framework Criteria ❏ Sendemail ❏ Track email opening ❏ Clone a website & save credentials ❏ Ability to edit cloned site (for c2) ❏ Graphs / Result recording
- 71.
- 72. @haydnjohnson Gophish ❏ Download binary ❏Chmod ❏ RUN ❏ literally…. https://getgophish.com/
- 73.
- 74.
- 75.
- 76.
- 77.
- 78.
- 79.
- 80.
- 81.
- 82.
- 83.
- 84. @haydnjohnson SET Installed in Kaliby default!
- 85. @haydnjohnson SET Installed in Kaliby default!
- 86.
- 87.
- 88. @haydnjohnson Requirements - Phishingframework ❏ Send email ❏ Track email opening ❏ Clone website & save credentials ❏ Graphs / Results
- 89. @haydnjohnson Requirements - Phishingframework Send Email FiercePhish YES GoPhish YES SET YES Cobalt Strike YES
- 90.
- 91.
- 92.
- 93. @haydnjohnson Requirements - Phishingframework Track Opening email FiercePhish NO GoPhish YES SET YES Cobalt Strike YES
- 94.
- 95.
- 96. @haydnjohnson Requirements - Phishingframework Clone a website & save credentials FiercePhish NO GoPhish YES SET YES Cobalt Strike YES
- 97.
- 98.
- 99.
- 100. @haydnjohnson Requirements - Phishingframework Graphs / Result recording FiercePhish YES GoPhish YES SET YES Cobalt Strike YES & YES
- 101.
- 102. @haydnjohnson Morning Catch VM Practice Phishing NoDNS https://blog.cobaltstrike.com/2014/08/06/introducing-morning-catch-a-phishing-paradise/
- 103.
- 104.
- 105.
- 106.
- 107.
- 108.
- 109.
- 110.
- 111.
- 112.
- 113. @haydnjohnson Website - SSL ❏It's just too easy ❏ Seems more legit Sources: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-onubuntu-14-04 http://www.irongeek.com/i.php?page=videos/bsidesphilly2016/cj00-attackers-perspective-a-technicaldemonstrat ion-of-an-email-phishing-attack-zac-davist
- 114. @haydnjohnson Website - SSL ❏Create demo user ❏ Download letsencrypt + install (python) ❏ Run – add domain + allow 443 ❏ SSL encrypted Sources: https://www.digitalocean.com/community/tutorials/how-to-secure-apache-with-let-s-encrypt-on-ubuntu-14-04
- 115. @haydnjohnson Website - SSL ❏Started with no SSL
- 116. @haydnjohnson Website - SSL ❏sudo add-apt-repository ppa:certbot/certbot ❏ sudo apt-get install python-certbot-apache ❏ sudo certbot --apache -d example.com
- 117. @haydnjohnson Website - SSL ❏allow port 443 through firewall!
- 118. @haydnjohnson Website - SSL ❏It is secure!
- 119.
- 120. @haydnjohnson Payloads ❏ HTA ❏ ClickOnce ❏ DLL
- 121.
- 122.
- 123.
- 124.
- 125.
- 126.
- 127.
- 128.
- 129.
- 130.
- 131.
- 132.
- 133.
- 134.
- 135.
- 136.
- 137. @haydnjohnson Click Once Works upto Win 7 Requires Internet Explorer Win 8 == Smart Screen Filter (Signed Cert) https://blog.netspi.com/all-you-need-is-one-a-clickonce-love-story/ https://msdn.microsoft.com/en-us/library/t71a733d.aspx https://msdn.microsoft.com/en-us/library/748fh114.aspx
- 138. @haydnjohnson Click once Placed inCOA/Application Files/
- 139.
- 140. @haydnjohnson Click Once Using JavaScript ❏window.open() ❏ IE blocks popup
- 141. @haydnjohnson Click Once Using JavaScript ❏window.open()
- 142. @haydnjohnson Click Once Using JavaScript ❏window.open() ❏ IE blocks popup
- 143.
- 144.
- 145.
- 146.
- 147. @haydnjohnson Click Once PHP toCOA folder ❏ header()
- 148.
- 149.
- 150.
- 151. @haydnjohnson Lesson Learned ❏ Considerthe user interaction ❏ Consider the technology to bypass
- 152. @haydnjohnson Lesson Learned ❏ Thingsgonna not work ❏ Try and test ❏ Think outside the square
- 153.