One of the most important security considerations you can learn and you can teach your family, your
co-workers, your friends is how to spot and stop fishing.
So we're going to see how a spear phishing email works from beginning to end and see why so many people,
as many as 23 percent of people click through spearfishing or even regular phishing emails.
They're not like they were in the old days where all the emails were poorly written and misspelled.
Nowadays, we see much more sophisticated attacks, and that's what we're going to build.
We're going to build a spear phishing attack using Calli Linux.
So first of all, let's take a look at how we might start a spear phishing email.
We start with a real email from Facebook or a real notification from Twitter, a real email from your
bank, a real email from you get the picture, any place that has the username and the password on the
same page.
I'll demonstrate that with Facebook.
When you go to Facebook, you see that the username and the password are both on the same page together.
That's going to be pretty important because we'll need to capture both the username and the password
for a phishing attempt to work.
If you're doing this at work, you want to pick a page that you think your employees will visit so that
if they fall for this phishing attempt from you as a security person, you will be able to do a little
bit of training with them and teach them how to spot phishing attempts.
You could also use a bank Web site.
I just picked a random bank here.
This username and password, both together on the front page, are one indication that this could be
used as a potential phishing attack site.
The important thing is that we use a real Web site when we're crafting a spear fishing campaign.
So I'm going to use Facebook.
That just happens to be a quick, easy one.
And then we will make use of a real Facebook notification, an email sent to me in this case with all
the names changed, of course, so that we can see how to craft a spear phishing email using Caleigh
and the social engineers toolkit.
What are we going to need to victims for this to work?
Well, to do the full demonstration.
So we're going to open up virtual box.
And before we open our Caleigh and our Windows computers, I'm going to change the network on both to
the public ten point nine Madde address.
So the public network.
So my Caleigh Linux, I'll go to that network public Matt and hit.
OK, remember this is our Ten DataDot Nine Network and the same for the Windows 10 computer.
I want both of these on a public network because they'll need to see out to Facebook or Twitter or to
your bank website to be able to make this phishing attack work.
So I will choose the Nat'l Network and I'm going to choose public that that is our network public,
Matt, because we'll need both of these computers to see out to the public web so that we can simulate
a real phishing attack like it happens in real life.
Once you have both machines connected to the public network, let's start both Caleigh and Windows 10,
once you have both your Caleigh and your Windows 10 computers open.
Let's go ahead and make Calli full screen.
And in Kalay, we're going to open the social engineers tool kit.
This is under applications.
And on this current version of Calli Linux 2.0, it is under a number 13 social engineering tools.
And you notice that there are tons of menus, tons of attacks, tons of tools on the cauli menus.
Take your time to click through each one of these and get to know each one a little bit.
We can only cover so much in a in an online course.
We might do an advanced course if some folks are interested, but come to the social engineers tool
kit or set when the social engineers tool kit loads, you'll be able to agree to the terms of service.
And then you'll see we have a menu of tools, this is going to be a command line driven application,
but it's going to be very powerful.
It's going to allow us to gather someone's username and password from a popular bank or social media
or any other website by closing that site, just like we saw the Facebook Web page, we're going to
be able to create an exact duplicate of that page and we'll see how to do it in the next lesson.