If I switch back to my Linux box and come back to the terminal window that's still running the social
engineering tool kit, you will see a lot more information.
And right here is the Wilma Flintstone dotcom and password, Fred, that I just entered a moment ago.
And it's not sent any of these credentials to Facebook yet, because if you remember, it pulled up
the Facebook dotcom login.
So Facebook is still sitting there and the user thinks, well, I thought I had my password correctly.
I'll just enter it one more time.
Unfortunately, they sent their username and password to this Calli Linux computer running at ten point
nine four, even though the Web address that we used was something more like this Facebook dotcom at
and some integer or at the number ten point nine to four it gave us.
Our fake Calli Linux log in instead, and so I can switch back to my terminal using the alt tab key
or I can switch back to Chrome or to Firefox, ESR, either one is fine.
If I enter a new username and password.
Barney
at Flintstone.
Blackcomb.
With the password of Betty.
And try to log in on this ten point ninety four address.
It'll look like it just failed and tried to again, but it's actually sent me to the real Facebook dot
com address and if I enter my user information here, that would actually log me into Facebook.
But if I switch back to the terminal window, I can use alt tab and Linux.
I will see Barney Flintstone dotcom with a password of Betty.
Now, the whole time that I leave this terminal window running with social engineer toolkit in the background,
I will be collecting usernames and passwords from this phishing email.
If you're doing this inside an organization, again, with the express written consent of the CEO and
or CIO, the chief information officer or the chief executive officer or the owner, the president of
the business.
Then what will you do after we get these usernames would be to go educate those individuals and just
let them know, hey, you're not in any trouble, but you just fell for an inside phishing attempt?
We were doing some fishing training.
We sent you an email that looked just like Facebook, but unfortunately, you clicked through a bad
Web address.
Let me show you how to spot those.
And you show them the same kind of things that we just went through.
Malicious attackers will take these usernames and passwords and immediately try them not just at Facebook,
but at Flintstone dotcom or at Gmail dotcom.
That's one reason you should never use the same username and password for multiple Web sites, especially
for your email.
Log in, if someone has your e-mail log in, then they can reset all of your other passwords because
they typically just send an email with a link to your email address.
And so if Barney Flintstone dotcom is using Betty as his password, both at Facebook and Gmail, then
someone can go to Gmail, login using Barney and Flintstone Dotcom.
And Betty is the password and reset Barney's Facebook account reset.
His username and password to his bank accounts, there are lots of dangerous things that are possible
with this attack.
That's why you need to understand phishing.
It's why it's so important.
It's not just your Facebook account out there that's at risk.
It's every account that you have that uses the same login information.
So let's see what the social engineers toolkit does with as a report.
If I hit control, see to finish.
So you've run your phishing test.
On average, you'll see about 23 percent of employees click through and maybe even log in to a fake
phishing email like this.
And then you've got some people that you can go follow up with, do a little extra training, make sure
you make phishing part of your annual or quarterly or monthly.
Information security training regimen, your employees, your family needs to know about this, but
I will hit control, see to generate the report and stop running the fishing harvester.
And it says it created a report.
The file was exported to route set reports.
And so let's see what that looks like.
First of all, you can just copy this address and paste it directly into a browser.
On your call, Linux, Xbox.
And it's going to tell you that the social engineering toolkit ran this well, let's scroll down and
see what some of the user names and information might have been.
You can do a search for email and pass, I'll make this larger.
We can see the first victim was Fred Flintstone dotcom and his password was this space is space a bad
password?
Space is get turned into Plus's.
We scroll down a little bit more and we'll find Wilma or Fred Flintstone dotcom.
He changed his password to Wilma.
Scroll down a bit more and we'll find that Wilma Flintstone dotcom uses a password of Fred.
If you want to get this even faster or you have to do is control F and control F will find so passe
equals.
And that will let you jump from one to the next to the next.
And we can see all the email addresses and passwords.
We've got a total of four of those out of this quick phishing attempt.
All of those were me.
Again, do not use this to get someone else's username and password.
You are stealing those pieces of ID from that user only use this to train your family, your friends,
your co-workers and your employees so that they can spot phishing emails before they happen in the workplace.
The other way you can look at these passwords is just to go to this address in your file system so I
can either use the terminal, start a new terminal window, getting out of social engineering toolkit
and surf to that location in a new window by saying KD space and then paste that long address minus
the HTML at the end.
And then I can more.
And just to add tab, because it's a long time stamp and choose the dot html tab.
And I can more through that document just by hitting the space bar.
And I'm coming down to.
My first username and password, Fred Flintstone, Fred Flintstone Dotcom with his first password.
This is a bad password.
Go down a little further.
And I'll find another password, another username, you can also just open up your file explorer, so
I go to files and I can come to home and I'll change my properties here.
I'm going to show those hidden files because that dot set set is a social engineer tool kit folder.
And then under their reports and then I can find my HTML file and if I double click on that, it'll
open it up.
And that's how I can get in on my report as well.
Let's do a quick review and then we'll see how to stop fishing in your organization as a final bonus.
Listen.