The social engineers toolkit in Cauli Linux is set up for a number of social engineering and penetration
testing attacks, you can see there's a full menu at every level that we're going to go through today.
We're going to use one attack from one submenu in the social engineer toolkit.
But it is a really important tool kit to get to know, to understand.
I'm just going to show you today how we can spot spearfishing, how we can stop spearfishing, and how
we can train other people on how to spot spearfishing in our organizations and our families so that
your friends and family don't get taken by scammers online.
So let's first open up Meenu number one social engineering attacks.
You notice there are lots of other things down through here, but we're just going to take it one piece
at a time.
We're selecting menu number one social engineering attacks under this menu.
You see once again, we have everything from Arduino based attacks, mass mailers, payloads, listeners,
infectious media generators, so we can inject malware into an MP for or an MPEG movie that we send
someone to a wave file to and a Windows media file.
We can send malware over wireless access points.
We can generate a bad QR code that will take someone to the wrong website.
So these are all social engineering related attacks.
People think that they're getting one thing.
We send them something for free or give them a chance to click through an email or click through and
watch a video.
And you can see it's a really mean world out on the Internet.
People can use these tools for bad.
You're just going to be using these tools ethically to teach other people and to train yourself on why
it's so important to know what you're clicking through every time in this first manual we want to do
is click through to just the website attack vectors number two.
And once again, in the social engineer toolkit, you'll see that just this one submenu to Submenus
Down has a full set of eight attacks.
We have Java applet attacks, Métis browser exploits, credential harvester's tab nabbing means taking
over tabs in your browser web.
JIANQING So it makes it look like they're going to one site, but they're actually going to a different
multi attack where you can combine three or four, all of these into a single attack so that if a person
clicks through, you try everything all at once, a full screen attack, H.T. attacks, all of these
are things that you should get to know and come back and look through, because you should understand
how vulnerable your computer is and how vulnerable your networks computers are, your family and friends
computers are.
But we're going to use just one really clever spearfishing technique under the credential harvester.
When it comes to fishing, we're usually trying to get someone's credentials, their username and their
password.
The credential harvester's the perfect tool for setting someone up for spearfishing attack.
So number three, the credential harvester attack method hit enter three and enter.
And again on this submenu, you'll see that there are lots of options for attacking or for testing your
network.
Number one, you have web templates.
These are templated sites that look like familiar things.
Your your users might go through number to the site cloners what we're going to use.
And then number three, a custom import so that we can build something specific and bring it in to the
social engineers tool kit.
So if your site doesn't clone perfectly using the cyclone or you can actually make a copy of the HTML
page of your organization's email log in, for example, and then you can bring it in with a custom
import.
We're going to use the site, Kloner, because Facebook has a public Web page, Web login page, and
we will use the site, Kloner, to grab that site.
So come with me to number to the site cloner.
And now it's asking for the IP address of the post back.
Well, what we're going to do is set up a fake Facebook page.
It's going to copy that page and run it on our Calli Linux server.
This call Linux VM is going to act like a Web server in just a moment and copy that Facebook page.
So we need to make sure that we're on the right network so you can either come to the left of your screen
and come to terminal.
And open a new window or while you're in the terminal here, we can come to file and open terminal.
We want to double check our IP address, so I'm going to increase the size, so in this separate terminal
window, I'm going to check two things.
I'm going to make sure that I can get my IP address and I'm going to make sure that I've got outside
connectivity because we just switched over to the public network if config will tell us our IP address.
And we do have a ten point nine four, you're going to need this IP address later, so you remember
your call Linux box, yours may be slightly different from mine, minus ten point nine four.
That's going to be very important.
Ten point nine four.
And let's just check to make sure that we have good outside connectivity, ping, Google, for example,
dotcom, and we are getting connectivity out.
If you're not getting either of those things, you can either reboot your Calli Linux box or you can
just go through the steps to restart your network service with pseudo service network dash manager space
restart.
Let me get that if config one more time and my IP address is ten, nine, four, we're going to memorize
that, but we'll also copy it just in case we want to paste it.
And then we can minimize this terminal window, so the IP address for the post back, that means where
it should send the username and password is this computer our calling Linux box?
So we're going to.
Right.
Click and paste that tendo name for address.
Just this to whatever your call Linux boxes.
If Config said the IP address for your machine was on the public mat, make sure you're on the public
map.
That's our ten point nine four.
That's how we can see to the outside world.
So the IP address for the post back is ten point nine four for me.
Now it's asking us to enter the URL, to clone we're going to clone WDW, dot Facebook dot com, but
you could add your bank Web site, your company's email log in your school, only your school.
If you are teaching your friends how to avoid and how to spot these of these social engineering attacks,
you could enter your bank, your favorite social media site, your organization's email login.
If you're doing training for your employees, they need to know how to spot all of those kinds of things
because attackers will try those types of sites.
So we're going to clone the site.
We got Facebook dot com and notice it tells you a few things when you run.
The clone is is cloning the website.
Log in to Facebook dot com slash login that notice we just typed in Facebook dotcom, but it found the
login page specifically and it's cloning that.
And now it says it's running that port 80.
It also gives us the hint that we want to use sites that have a username and a password field on the
same page.
Well, let's just see locally what this Port 80 looks like.
All that means is that it's running a Web server on Port 80.
That's the normal Web server port.
If I just say localhost in my browser, that is the one twenty seven Otto 0.01 one address that is.
The Facebook login page, how can that be?
Well, we have cloned the Facebook login page and notice it's sharing some information back here.
It's saying that someone is on this Facebook page, so if I put Facebook log in like Fred.
At Flintstone Dotcom.
And then give a password of this is a bad password.
And hit enter log in.
Says, would you like Firefox to remember the slogan we'll see in the password section, why you should
never store your passwords on a computer that you don't own and you may not want to store them on a
computer that you do?
Well, it didn't do anything that looks like it just took my information.
But it.
Says Facebook dot com slash log in again, well, for most people, that just seems like almost a mistype
something.
So they reiterate what the social engineering toolkit has done is set up a clone and redirected the
user to the real Facebook login page so that they're not as aware of what happened to them.
But if you look back here in the browser, in our terminal window.
My email address and password.
Went to that the password harvester, the credential harvester on my McCawley Linux computer.
This is damaging enough all by itself.
But in the next lesson, we're going to see how to send this out as a spear phishing attempt and do
some really serious training for our users so that they understand how dangerous it is to click through
a link, even one that looks familiar and enter your information.
Let's see how to make a spear phishing email in the next lesson.