WEBVTT

00:00:00.720 --> 00:00:02.890
In this demonstration, we will look at one of the

00:00:02.900 --> 00:00:06.300
third‑party modules of the Social‑Engineering Toolkit and

00:00:06.300 --> 00:00:08.250
perform a Google Analytics attack.

00:00:08.740 --> 00:00:12.210
The Social‑Engineering Toolkit supports some third‑party modules.

00:00:12.690 --> 00:00:14.350
Currently there are three that are available.

00:00:14.980 --> 00:00:18.300
The first two relate to a remote administration tool, and the

00:00:18.300 --> 00:00:21.050
third one relates to a Google Analytics attack.

00:00:22.000 --> 00:00:25.550
We will perform a Google Analytics attack on one of my websites.

00:00:26.340 --> 00:00:30.200
I will select the attack, and I have two options. I can either choose

00:00:30.200 --> 00:00:34.930
the automatic mode or manual mode. With the automatic mode, all I need

00:00:34.930 --> 00:00:39.110
to do is provide the URL and the Social‑Engineering Toolkit will take

00:00:39.110 --> 00:00:43.150
care of the rest. But let's go ahead and use the manual mode so we can

00:00:43.150 --> 00:00:44.450
see what it actually does.

00:00:45.390 --> 00:00:50.630
I will type in manual, and now I need to provide the tracking ID,

00:00:50.640 --> 00:00:56.000
which is provided on the website when the website is linked to Google Analytics.

00:00:56.640 --> 00:00:59.660
Now that I've provided my tracking ID, I need to provide

00:00:59.670 --> 00:01:03.740
my targeted host website. Next, I need to provide the page

00:01:03.740 --> 00:01:04.900
that I'm looking to target.

00:01:05.570 --> 00:01:07.790
Since I'm going to be targeting the home page, I'm not

00:01:07.790 --> 00:01:09.650
going to define a page in the step.

00:01:10.390 --> 00:01:12.350
I can also go ahead and define the page title,

00:01:12.790 --> 00:01:16.930
but I'm going to leave this blank. And now I need to provide the referral page,

00:01:16.940 --> 00:01:18.150
which I'm looking to spoof.

00:01:18.940 --> 00:01:19.690
In this step,

00:01:19.760 --> 00:01:22.610
you would provide your fake malicious site where you are

00:01:22.610 --> 00:01:25.570
looking to perform any type of website attack or any type

00:01:25.570 --> 00:01:27.050
of social engineering attack.

00:01:27.640 --> 00:01:31.310
So I'm going to provide fakesite.com, and now the payload is ready.

00:01:31.560 --> 00:01:34.190
I can print the payload to see what it looks like,

00:01:34.740 --> 00:01:36.690
and then I have the ability to send a payload.

00:01:37.110 --> 00:01:38.420
Once the payload is sent,

00:01:38.670 --> 00:01:42.640
the Social‑Engineering Toolkit presents me with the payload URL. It also

00:01:42.640 --> 00:01:45.330
gives me the ability to send the payload in a loop,

00:01:45.340 --> 00:01:46.260
which I'm going to do.

00:01:47.030 --> 00:01:51.740
I'm going to choose the time of 1 second in between each send, and then once

00:01:51.740 --> 00:01:55.830
I'm ready to send, I'll hit Enter. And now the Social‑Engineering Toolkit will

00:01:55.830 --> 00:02:00.140
go ahead and send this attack every 1 second. Let's jump now to the Google

00:02:00.140 --> 00:02:02.490
Analytics Admin page and see what happens.

00:02:03.140 --> 00:02:06.070
And now when I take a look at my Google Analytics page,

00:02:06.230 --> 00:02:10.360
I can see that my top referral shows the fakesite.com,

00:02:10.419 --> 00:02:13.450
which we have created in the Google Analytics attack.

00:02:14.080 --> 00:02:17.090
Now an unsuspecting user might wonder what the site

00:02:17.090 --> 00:02:19.300
really is and navigate to the site.

00:02:19.740 --> 00:02:20.540
At that point,

00:02:20.580 --> 00:02:23.900
depending on what payload you have configured on the fake site, that can be

00:02:23.900 --> 00:02:27.500
delivered to your victim and ultimately they can be exploited.