In the last lesson, we saw how to use the social engineers toolkit to clone the Facebook website and
to capture people's usernames and passwords, but we were working on the same call Linux computer,
we logged in from that same machine.
You want to send this out to someone somewhere else for training within your organization's network
or for showing your friends and your family how to spot and avoid phishing emails?
Will the first thing that we do when we were crafting a spear phishing e-mail, a targeted phishing
email as we start with a real email from that organization.
So in this case, Facebook has sent me a notification and I have changed some of the names, of course,
to protect the identities.
But Alice Smith updated her status.
Bob Smith, Charles Doe and 16 others reacted to this open Facebook.
And you can see it has links and things like that.
What I'm going to do is use this as the foundation for a new email that I'm going to send so I can either
forward it or I can just copy and paste it into a new email.
So from your favorite social media account, from your bank account, from your organization's website,
if you get a notification, you've got the foundation of a spear fishing email.
You can find templates out on the web if you don't have any, but you can find one in your own email
account.
So I'm going to come down to the forward option and I'm going to clean up this email just a little bit
so that it has just the notification information.
It doesn't have anything else in it.
You can copy and paste this or you can just forward it like I've done and clean it up.
I'm going to forward this to two accounts, my Gmail account and my work account at the university.
And remember, you must do this only where you have explicit permission.
Don't send this to anyone that you don't have express written permission to do this testing with in
an organization you need that.
The CEO and CEO's permission express written permission before you can send this kind of phishing email
out to train employees.
So for spearfishing to work, in the simplest sense, all we have to do is right.
Click on each of these Web addresses or click on each of these addresses and come to change the euro.
And because we know the Yucel or the IP address of our Cauli Linux box, all we need to put in here
is htp, colon, slash, slash.
Ten oh nine dot four, that's HTP Kalinga ten days ago that nine four have zoomed in just a little bit
more.
So you can see I have the ten Dotto DOT nine Darfor address and I'm going to copy that because I'll
use it in all the other links and click.
OK, go to the Facebook icon itself, change that address to Tendo nine four or whatever the IP address,
if you call Linux box, was it OK?
And we'll go through the entire email making these same changes.
Make sure you change it for every single one of these links.
Just click the link and Gmail or use your favorite email editor and you're going to change the hyperlink.
You might have to.
Right.
Click in Microsoft Outlook, for example, and go to edit hyperlink.
But we're going to change where that link goes.
Instead of Facebook, it's going to go to our Calli Linux Computer Tendo DOT nine.
For once.
You've made these changes.
For every one of the links in your email, you're ready to send a phishing test email.
And if you're calling Linux computers still running in the background, we're going to be able to open
this email up and our Windows box and see how it behaves.
So I've changed all my HTTP, all my URLs, all of my hyperlinks in this Facebook email.
Now go to my Calli Linux listener.
If I come to my email on my computer, on your Windows box or on any of your other VMS, you should
be able to find your email.
And if you hover over each link, you may notice in the far bottom left of your browser, depending
on your browser, you'll see ten point nine four.
But most people don't look at that.
In fact, I'll see that for every single one of the links in this email.
If I called them all a missed one, I'll fix that in the spearfishing upgrade in the next lesson.
But if I click on this Facebook link, it's going to take me to my Tendo nine for Facebook login page.
Now, most people don't recognize this tendo nine four.
And so they might see this warning that I'm getting in Firefox.
This connection is not secure.
Logins in here could be compromised, but most of the time, if we're in a hurry, we'll just try our
log in.
Fred Flintstone, Dotcom and Willmar as a password and click login.
Oh, that didn't work, but notice it took me to Facebook dotcom.
Well, the user thinks it didn't work.
Switch back over to Kelly Linux box and you will see that Wilma at the Wilma password for Fred Flintstone
dot com just got captured.
So even from a different computer running another browser, we can see the username and password that
people are putting in to these phishing web pages and reloads the Facebook page.
So it looks like nothing suspicious to the other user.
But you need to understand that that ten point nine four is one dead giveaway any useful other than
Facebook.
Dotcom, for example, is a dead giveaway that the email is a phishing email attempt.
But in the next lesson, we're going to understand how to modify that you URL so that it can fool even
experienced users.
And you need to be much more careful with this technique that we're about to show you.
So come back in the next lesson.
Let's see how to modify and play with that you URL so that it doesn't give off the immediate red flag
that it's a tendo nine four address.