WEBVTT 00:00.450 --> 00:04.750 Now we'll see how to hack into Facebook Twitter and Gmail accounts. 00:04.770 --> 00:12.360 There is an application that comes with Kelly under the social engineering tools called SETI which is 00:12.360 --> 00:20.140 the social engineering toolkit you can press the icon from here to run it or open the terminal and right 00:20.140 --> 00:26.670 set toolkit you will be prompted with a menu of six items. 00:26.700 --> 00:29.750 We are interested in social engineering attacks. 00:29.910 --> 00:31.770 Press 1. 00:31.770 --> 00:39.540 Then it will prompt to another menu with 11 different social engineering techniques or methods to execute 00:39.650 --> 00:41.070 in this tutorial. 00:41.070 --> 00:50.730 We're interested to execute website attack vectors so press on to then select credential harvester attack 00:50.850 --> 00:53.190 method number three. 00:53.190 --> 01:00.070 Here you will be able to select web templates that already exist within the as each tool. 01:00.140 --> 01:08.200 Or you will be able to tell the tool to clone a website or you'll reference the tool to a custom import 01:08.200 --> 01:10.050 directory in order to input the website. 01:10.080 --> 01:16.620 And this tutorial will choose one which is the existing what templates in the SBT tool IP address for 01:16.620 --> 01:25.260 the post but is the local IP address we're using here 1 9 2 1 6 8 or 2 on 1 or 22 just to make sure 01:27.870 --> 01:33.030 I have config and this is my IP address. 01:33.030 --> 01:38.450 Press enter then it will tell you which template you want to use. 01:38.460 --> 01:44.910 First of all let's use the Google template so template number 2 and the. 01:45.030 --> 01:53.790 It has created the file or the Web site under the static duties so it's actually created a fake Gmail 01:53.790 --> 01:54.430 Web site. 01:54.540 --> 02:01.560 So that will use in order to harvest the credentials from the user's stress enter. 02:01.620 --> 02:05.700 You want to attempt to disable it but she seems a patch is running. 02:05.760 --> 02:07.380 And this website wants to run. 02:07.560 --> 02:11.970 So press yes harvest is ready have the Tim browser for your site. 02:11.970 --> 02:17.700 So actually my IP address now is hosting a fake Gmail Web site. 02:17.700 --> 02:18.910 How to test that. 02:19.410 --> 02:26.460 I need to go to a browser on my windows machine and type the IP address. 02:29.990 --> 02:31.880 Elf the caliber machine. 02:31.880 --> 02:33.090 And here you go. 02:33.170 --> 02:35.240 It has Google page. 02:35.390 --> 02:40.070 So for example Chris any email type any email 02:43.820 --> 02:44.860 and any password. 02:46.530 --> 02:47.080 Okay. 02:47.180 --> 02:51.740 And then sign and observe the behavior here. 02:51.740 --> 02:52.870 It will direct you. 02:53.930 --> 02:55.610 To the Google page. 02:55.610 --> 03:00.470 And if I go to my machine here I'll be able to capture the credentials. 03:00.470 --> 03:02.470 This is the email I used. 03:02.660 --> 03:06.440 And this is the password that I used. 03:06.440 --> 03:07.170 Simple huh. 03:07.250 --> 03:11.620 So similarly you can generate the report as well et cetera. 03:11.780 --> 03:14.900 We'll do the same thing for the Twitter 03:18.950 --> 03:21.620 select a Twitter template. 03:21.720 --> 03:26.160 Street turn and let's go to the website here again. 03:26.210 --> 03:29.900 1 until that turns into 2 1 1 0 2 1 3 2. 03:30.090 --> 03:40.110 And here you go you have a Twitter sign and again just try to use any email and any password press sign 03:40.110 --> 03:45.630 in it to capture their credentials and redirect you to the Twitter home page. 03:45.630 --> 03:51.060 The user the normal user will not notice this kind of behavior again. 03:51.060 --> 03:56.760 If you go to the machine you'll be able to capture the credentials here. 03:58.200 --> 04:02.490 So this is regarding the attacks for Gmail and Twitter. 04:02.970 --> 04:04.710 Let's see how Facebook works. 04:04.740 --> 04:10.110 So in the Facebook example will select custom will select cyclones. 04:10.320 --> 04:21.220 So select two and then use the local host IP and then enter the site that you want to clone. 04:21.240 --> 04:24.200 In this case it's Facebook. 04:24.210 --> 04:33.480 In this case it's H TGP as log in Facebook com. 04:33.560 --> 04:37.940 It says that the files have been copied and it's running on port 80. 04:38.010 --> 04:42.150 So let's go here again and use the same IP 04:46.470 --> 04:52.220 so here it seems some gross scripting just press control at 5. 04:52.500 --> 04:59.810 So did some CSR s and JavaScript issues pest control of 5. 04:59.940 --> 05:01.030 And here we go. 05:01.080 --> 05:02.880 Just puts any email 05:07.680 --> 05:15.720 and puts any password press log in again the same behavior it will take it to the legitimate Facebook 05:15.720 --> 05:16.220 page. 05:16.740 --> 05:26.700 And if you go here you'll see where is that the credentials that we use now are captured quite easy 05:26.700 --> 05:28.000 huh. 05:28.110 --> 05:35.430 Now if you go to sometimes it's not easy to show this link to a 1 6 8 2 1 1 3 2. 05:35.430 --> 05:39.480 So this link is actually we're still working in our lab and our internet. 05:39.540 --> 05:46.020 But once you publish this and we'll see going forward in the videos how to publish this on the Internet. 05:46.260 --> 05:51.930 It is not advisable to send such a link here so you can go to the site. 05:51.960 --> 06:00.900 But Li dot com and just put your public link here. 06:00.960 --> 06:01.470 What's that. 06:03.650 --> 06:13.850 Just copy this address of the and copy it exactly so it'll give you this shorthand here you can send 06:13.850 --> 06:15.950 it through email to anyone. 06:15.950 --> 06:21.620 And once he presses on that it will be a redirect to the webpage hosted on your server. 06:22.010 --> 06:31.040 So now we learned how to spoof Facebook Twitter Gmail pages and how to harvest the accounts. 06:31.050 --> 06:39.350 Now if you can link it to some of the techniques we studied earlier such as DNS poisoning art poisoning 06:39.860 --> 06:47.320 you will be able to link the chains and come up with a scenario which is the real world scenario and 06:47.340 --> 06:51.560 how to combine social engineering with network attack techniques.