Social engineering has become the most common attack method with these attacks.
Hackers can use emails and Web sites to try to steal information from users.
Phishing is a social engineering attack that uses emails to trick users into clicking on malicious links
or attachments Let's hop into the Kelly lab and I'll demonstrate how an attacker could use a fishing
attack.
So what I'm going to demonstrate is how an attacker could create a fake Web site and use it to harvest
credentials.
So in Cali we'll go to applications social engineering tools and then the social engineering toolkit.
Then we'll select option one.
Here's a list of social engineering attacks you could do with Kelly.
We're going to do web site attack of factors that almost like the option 3 and a site cloner.
So the site cloner attack has the ability to actually clone a web site page which could then be used
to direct people to your version of the web page which could be used to harvest credentials.
So what I'm going to do in my lab I'm not doing this actually outside in the real world because I'm
just doing this for demonstration purposes.
I'm going to clone the Facebook log in page and then I'll access that page put in my credentials and
then show you how you can see what credentials are entered into the fake web page in Kalya.
So let's get started.
We'll go to you site cloner.
So now he wants us to put in the IP address that we will want to direct people to for this web page.
So I'm just going to use the local IP address of my Kelly box.
I'm only going to be testing it locally.
I had someone to copy my Kayley IP address
close this window paste that in.
Now we just need to put in the you are l of the Web site that we want to clone which in my case is going
to be Facebook
hit enter.
So at this point if I were to browse to the IP address of my call box I should get the Facebook log
in page.
I'll put in credentials and then we'll be able to see which credentials were entered.
So minimize this pull up a web browser
and I'll put in the IP address of this Kelly box and there you go.
I have a Facebook logon page so this looks legitimate.
To be honest if I was redrafted to this page regardless of the you are all being different I would probably
look at this and just put in my credentials.
So let's do that let's put in Kaylie at gmail dot com and then on password I'll just use Cisco and log
in.
And then it just fails and takes you directly to the Facebook page.
So what what happened here is the victim would put in their credentials get redirected to the actual
Facebook page log in and not know the difference they would have no idea that they just entered their
credentials on a fake Web site
so let's minimize this and go back to our terminal.
And here you go.
I now have harvested the council's our answer on that log in page.
So you might be thinking to yourself well that's a great attack attacker could just launch this locally.
But an attacker would have to do to make this actually work in the real world would be to create some
hyperlink e-mail to you have the e-mail tied back to Facebook somehow they click on that link and then
be connected to the fake web page.
So please do not use this in the real world.
I am only showing you this so that you understand what attackers can do and how easily they could use
a fishing attack to steal somebody's credentials.