WEBVTT 00:00:00.940 --> 00:00:05.220 Hello. I'm Matt Glass, and welcome to this course on Initial Access with Gophish. 00:00:06.180 --> 00:00:06.790 In this course, 00:00:06.800 --> 00:00:09.430 I'll show you how to use Gophish to create phishing emails 00:00:09.470 --> 00:00:12.360 designed to convince users to click on malicious links or 00:00:12.360 --> 00:00:14.950 attachments and give you access to their machine. 00:00:15.740 --> 00:00:19.150 But first, let's look at what Gophish is and how it's used. 00:00:19.840 --> 00:00:21.510 Gophish was created by Jordan Wright. 00:00:21.990 --> 00:00:23.480 According to his documentation, 00:00:23.580 --> 00:00:27.660 it's an open‑source phishing toolkit that businesses and penetration testers 00:00:27.870 --> 00:00:30.750 can use to quickly set up and execute phishing campaigns. 00:00:31.640 --> 00:00:34.360 It was designed to work with minimal system configuration 00:00:34.700 --> 00:00:36.950 and includes an easy‑to‑use web interface. 00:00:37.740 --> 00:00:41.200 Gophish was specifically designed for legitimate users to 00:00:41.200 --> 00:00:43.280 test an organization's security awareness. 00:00:43.940 --> 00:00:46.240 It can be downloaded from either their website, 00:00:46.330 --> 00:00:49.300 getgophish.com, or their GitHub page. 00:00:50.040 --> 00:00:53.190 What makes Gophish such a useful tool for phishing is its 00:00:53.190 --> 00:00:56.210 simplicity in both installation and operation. 00:00:56.740 --> 00:01:00.280 On the kill chain, Gophish falls under the exploit phase only. 00:01:01.040 --> 00:01:04.310 It is primarily used to either obtain user credentials or 00:01:04.310 --> 00:01:07.370 trick users into executing and exploit that enables your 00:01:07.370 --> 00:01:08.850 initial access to the system. 00:01:09.440 --> 00:01:11.400 All of these actions are done through phishing 00:01:11.400 --> 00:01:13.550 campaigns you design within the tool. 00:01:14.240 --> 00:01:16.240 The ATT&CK knowledge base, developed by MITRE, 00:01:16.330 --> 00:01:19.470 categorizes adversary tactics and techniques into multiple 00:01:19.470 --> 00:01:21.850 categories to describe the adversary's behavior. 00:01:22.470 --> 00:01:25.230 The tactics are categories that cover different phases of an 00:01:25.230 --> 00:01:28.960 attack and allow defensive teams to model an adversary's actions 00:01:29.130 --> 00:01:31.020 and improve the defense of their networks. 00:01:31.610 --> 00:01:35.580 We will cover one primary tactic with two sub‑tactics in this course. 00:01:35.580 --> 00:01:37.900 The primary tactic is phishing, 00:01:38.200 --> 00:01:41.130 which has two sub‑topics we'll cover, spearphishing 00:01:41.130 --> 00:01:43.150 attachment and spearphishing link. 00:01:44.340 --> 00:01:47.430 Gophish can accomplish this by enabling adversaries to create 00:01:47.430 --> 00:01:50.350 phishing campaigns to trick users into granting access. 00:01:50.940 --> 00:01:53.100 We'll look at two possible phishing scenarios in this 00:01:53.100 --> 00:01:56.630 course. If an attacker wanted to take control of devices on 00:01:56.630 --> 00:01:58.610 Globomantics' network depicted here, 00:01:59.100 --> 00:02:03.000 one option they have is to use Gophish to generate a phishing email containing a 00:02:03.000 --> 00:02:06.350 link to a website they host from the attacking workstation. 00:02:07.090 --> 00:02:09.850 The attacker then sends the malicious link to the target victim, 00:02:10.440 --> 00:02:14.550 which, when accessed, directs the target back to the attacker's page. 00:02:15.700 --> 00:02:18.890 The page either contains a payload that is executed when the page 00:02:18.890 --> 00:02:22.720 loads or captures entered credentials and allows the attacker to 00:02:22.720 --> 00:02:24.550 obtain access to the victim's machine. 00:02:25.140 --> 00:02:25.800 In this case, 00:02:25.800 --> 00:02:29.130 the attacker has taken control of HR's machine and from there can escalate 00:02:29.130 --> 00:02:31.750 permissions or laterally move throughout the rest of the network. 00:02:32.540 --> 00:02:35.320 Another scenario involves an attacker sending a phishing 00:02:35.320 --> 00:02:36.850 email with a malicious attachment. 00:02:37.880 --> 00:02:40.820 The attacker sends the malicious attachment, which when opened 00:02:40.820 --> 00:02:44.060 exploits a vulnerability in the target application and enables 00:02:44.060 --> 00:02:45.450 access to the victim's machine. 00:02:46.540 --> 00:02:48.680 As with the previous scenario, from here the 00:02:48.680 --> 00:02:50.330 attacker can run additional attacks, 00:02:50.730 --> 00:02:53.660 escalate permissions, or latterly moved to other 00:02:53.660 --> 00:02:55.350 devices within the same network.