WEBVTT 00:00:00.540 --> 00:00:01.710 In this demonstration, 00:00:01.940 --> 00:00:05.120 we will create a credential harvesting attack and look at how we 00:00:05.120 --> 00:00:07.850 can harvest credentials by cloning a website. 00:00:10.230 --> 00:00:11.990 Now, let's perform a website attack. 00:00:12.660 --> 00:00:15.480 This is done from the social engineering attacks category, 00:00:15.480 --> 00:00:18.240 and we will select Website Attack Vectors. 00:00:18.470 --> 00:00:21.310 There are a number of different types of attacks that you can 00:00:21.310 --> 00:00:23.880 create using the Social‑Engineering Toolkit. 00:00:24.170 --> 00:00:28.360 The one that we're going to use is one that's commonly used in the real world, 00:00:28.460 --> 00:00:30.650 and that is the Credential Harvester Attack. 00:00:31.000 --> 00:00:33.550 The aim of the Credential Harvester Attack is really to 00:00:33.550 --> 00:00:37.360 harvest credentials that can be used by a malicious attacker 00:00:37.560 --> 00:00:39.420 for any type of malicious activity. 00:00:39.530 --> 00:00:44.270 The way that this attack works is by making a copy of a legitimate site and 00:00:44.270 --> 00:00:47.890 tricking the user into entering their credentials into the site. 00:00:47.900 --> 00:00:50.440 So we will select Credential Harvester Attack Method, 00:00:50.500 --> 00:00:52.020 and we have a number of options. 00:00:52.180 --> 00:00:55.300 We can use web templates, clone a specific site, 00:00:55.440 --> 00:00:59.320 or we can use a custom import for any site that we have already copied. 00:00:59.490 --> 00:01:01.510 Let's start with the Site Cloner. 00:01:01.590 --> 00:01:01.730 Now, 00:01:01.730 --> 00:01:04.890 what's important to note with the Credential Harvester Attack is 00:01:04.890 --> 00:01:07.890 that it is looking for form fields to rewrite. 00:01:07.950 --> 00:01:11.600 What that means is that the site you are trying to clone should have both 00:01:11.600 --> 00:01:15.300 the login or username section and the password section. 00:01:15.300 --> 00:01:17.040 In this specific attack vector, 00:01:17.510 --> 00:01:20.460 the Social Engineering Toolkit makes use of Harvester. 00:01:20.550 --> 00:01:22.780 So let's get started with creating the attack. 00:01:22.970 --> 00:01:25.630 The first option we have is to define the IP address 00:01:25.640 --> 00:01:27.660 where the data will be posted back to. 00:01:27.670 --> 00:01:30.480 In this case, it's the machine that we are using to attack. 00:01:30.490 --> 00:01:33.970 I'm going to keep the default IP address, and now I have the option 00:01:33.970 --> 00:01:36.250 to define the website that I would like to clone. 00:01:36.400 --> 00:01:40.200 SET supports both HTTP and HTTPS, 00:01:40.310 --> 00:01:43.700 which gives you a wide variety of websites that you can actually clone. 00:01:43.960 --> 00:01:47.350 So I will define the website that I am looking to clone right now, and SET will 00:01:47.350 --> 00:01:51.900 go ahead and start the cloning process. Depending on the site and the size of 00:01:51.900 --> 00:01:54.270 the site, the cloning process can take some time. 00:01:54.530 --> 00:01:56.150 Once the website has been cloned, 00:01:56.200 --> 00:01:58.490 the Credential Harvester will be running on a web 00:01:58.490 --> 00:02:00.390 server on your attacking machine. 00:02:00.450 --> 00:02:03.090 So now, if I navigate to that IP address, 00:02:03.130 --> 00:02:05.440 I would be presented with the cloned website. 00:02:05.500 --> 00:02:07.240 Since we're doing this in the lab environment, 00:02:07.400 --> 00:02:10.800 all I need to do on my target machine is navigate to the IP 00:02:10.800 --> 00:02:13.090 address, and I will be presented with the URL. 00:02:13.210 --> 00:02:14.510 In a real‑world solution, 00:02:14.710 --> 00:02:17.700 you would need to find a way to mask your malicious URL so 00:02:17.700 --> 00:02:20.420 that the user that's not notice that they are browsing to a 00:02:20.420 --> 00:02:22.580 fake URL instead of the real deal. 00:02:22.850 --> 00:02:24.750 There are various ways that you can do this, 00:02:24.820 --> 00:02:27.950 and this can be accomplished by using a few different tools. 00:02:28.210 --> 00:02:32.580 You can use things such as DNS interception or various homograph attacks. 00:02:32.680 --> 00:02:37.450 It can actually make a malicious URL be perceivable as a legitimate URL. 00:02:38.410 --> 00:02:41.290 Let's jump now to the Windows machine and navigate to 00:02:41.290 --> 00:02:43.350 our IP address and see what happens. 00:02:43.820 --> 00:02:46.660 So now that I'm on my Windows machine, I'm going to go ahead and 00:02:46.660 --> 00:02:49.840 navigate to my malicious URL. And in this case, 00:02:49.840 --> 00:02:52.400 since we're doing this on a lab environment, 00:02:52.410 --> 00:02:55.290 I'm going to use the IP address, and now you'll see 00:02:55.290 --> 00:02:57.190 that I'm presented with a login page, 00:02:57.370 --> 00:03:00.350 which looks exactly like the website that we have cloned. 00:03:00.740 --> 00:03:03.160 I will navigate to the website, the real website, 00:03:03.410 --> 00:03:07.940 and you can see that the resemblance is exactly the same. Of course, since 00:03:07.940 --> 00:03:12.280 the site uses HTTPS, since we are using a fake site, 00:03:12.950 --> 00:03:16.670 we would not match the HTTPS certificate, and hence, 00:03:16.890 --> 00:03:21.150 this would be a very good telltale sign that the user is browsing 00:03:21.470 --> 00:03:24.330 to an insecure or a malicious URL; however, 00:03:24.330 --> 00:03:25.200 in most cases, 00:03:25.340 --> 00:03:29.830 users don't actually notice this and still fall victim to this type of attack. 00:03:30.180 --> 00:03:33.840 So now, I'm going to go ahead and enter an email address and password. 00:03:33.930 --> 00:03:37.020 Let's see what happens. As soon as I click on Login, what happens is it 00:03:37.020 --> 00:03:39.760 actually redirects me back to the legitimate site, 00:03:40.230 --> 00:03:43.270 and now I'm going to jump to my Kali Linux machine and see what we 00:03:43.270 --> 00:03:46.700 have captured, and you'll notice in the terminal window, we now have 00:03:46.710 --> 00:03:49.850 both the username and password of that user.