Let's see how to make use of this new information, how to modify a use a neutral or a Web address by
using the symbol to put something before the URL that allows us to trick the user into thinking they're
going to use that Facebook dotcom, for example, and really send them to our Calli Linux computer.
Then we're going to make use of that integer version of a U.S. URL instead of the Tendo nine address
or one more time than you call Linux Box.
Let's get that IP address of the Calli Linux box.
If config, make sure we're still on a ten point nine to four address and let's copy that or 10.
DataDot, whatever your address is, is fine.
Come back into Chrome.
Make sure that we can still pull up our Web page, make sure that you're still running the social engineering
toolkit.
If not, you can rerun the credential harvester just by using the social engineering tool kit on the
left hand menu there or other applications.
Number 13, social engineering techniques.
And remember, that credential harvester is under the menu entries, one for social engineering toolkit,
two for Web attacks, three for the credential harvester.
And what we have done is set that up and got it running.
And if we go to ten point nine for four, you notice it takes us to something that looks exactly like
the Facebook log in.
Well, let's convert that ten point nine for address first into an integer.
So I'll do IP address.
Converter to decimal, and I'll use the same tool IP address guide, I'll use the ten point nine for
dress now or whatever the address of your Kalay Linux box is.
Convert that to an integer notice that gave me one hundred sixty seven million seven hundred seventy
four thousand four hundred sixty eight.
Copy that integer come up here.
Just give it an HDTV colon slash slash.
And then paste that integer one six seven seven seven four four six eight.
And notice that takes us to ten tonight, nine, but for now, let's obfuscate that even more.
Let's make it HDTV Coingate don't forget the colon slash slash w w w dot Facebook dot com at and then
paste that number and let's go ahead and copy this whole address, because that's what we're going to
use in our new version of the spear phishing email www.youtube.com at one six seven seven seven four
six eight.
If you copied that address from the IP address converter correctly, now we should be able to copy that
and lets it enter.
And remember this WWOR, Facebook dot com at is going to treat it like there's a username we Facebook
dotcom at this web server address and that htp colon slash slash before it means that it'll force us
to go to this address that's represented by this integer.
So let's see what happens.
I just hit a link called HDB Coingate, W-W that Facebook dot com at a long integer and it gave me my
Calli Linux box.
Let's go back to our Gmail email, and we're going to change out all of those links, not with 10.1,
and for that looks obviously like a phishing email, but with www.youtube.com with that HTP launch before
and some number that's going to look like a Web address.
In fact, the Facebook dot com web address with just some other information, like a username or something
else after it.
Most people won't spot this type of attack.
So copy this address WDW that Facebook dot com, make sure your HTP comes before it at and you're calling
Linux boxes address and we'll come back over into Gmail on any of our other computers and we'll be able
to craft the email.
So I have pulled open that email that I sent earlier.
I'm going to forward it one more time.
I'll send this to one of my addresses.
I will clean up any extra in email and now I'm going to click on each of those links, I happen to be
using Gmail, but you can right click in Microsoft Outlook or whatever other email program you're using.
Just select the text.
Sometimes it'll ask you to do that.
And we're not going to give it that obvious phishing email address tonight at nine four, we're going
to give it this new much more difficult to spot to be Coingate WWOR, Facebook, dotcom at one six seven
seven seven four four six eight.
This euro is very difficult, even for experienced people to understand as a phishing email address
or phishing.
Website address w w w dot Facebook dot com at this address.
That's going to be a really tough one for even your most experienced users to spot.
In fact, that symbol is one of the most important things to educate your users on, if they ever see
this or Facebook, dotcom and anything else after it, they need to be suspicious of that email and
go out to the real Facebook dotcom web address.
Don't enter in the don't just click through and address in an email, but I'm going to change all.
I'm going to copy that one more time.
Copy it.
And I'm going to change all of these addresses to that address just by clicking, going to change and
pasting that, make sure that Congress comes before it or work at WWLP, that Facebook dotcom at the
integer version of our Tendo DOT nine four address in this case for our Cauli Linux computer change.
All of the URL in the email go all the way to the bottom of your email so that every single address,
including the Facebook icon, will now go to your fake Facebook dot com at address.
When I send this now and then open it on my other computer.
I'll be able to see the effect that this Facebook dotcom at address has now, if I switch over to my
work email account from Firefox and hover over one of those links from the Facebook email, it looks
like it came from WWLP that Facebook dotcom at some address and this case, Firefox will convert it
for you in Chrome.
It may convert it all the way down to the ten point ninety four.
But that do Facebook dot com is realistic enough that someone might click through Firefox.
It's going to give me a warning that this is using the username Facebook Dotcom.
But if I click through and it anyway, I'll see Facebook and in Chrome it just takes me directly to
the Tendo nine to four address without any warning.
And if I enter my past my username and password.
Wilma at Flintstone dot com.
And Fred, as my password press log in, it will just reload the Facebook dot com web page and I'll
have no idea that it just sent my information to the other server.
We'll see how to capture all of those usernames and passwords that might have fallen for this phishing
attempt in the next lesson.