WEBVTT 00:00:01.140 --> 00:00:01.910 In this demo, 00:00:01.920 --> 00:00:04.260 we're going to use Gophish to prepare for a phishing 00:00:04.260 --> 00:00:07.500 campaign using a malicious link that navigates to our own 00:00:07.500 --> 00:00:09.650 page and captures entered credentials. 00:00:10.140 --> 00:00:13.650 We'll start by using Gophish to create the phishing email and then 00:00:13.650 --> 00:00:16.149 configure a landing page for your malicious link. 00:00:16.810 --> 00:00:19.170 These steps are needed to successfully execute a 00:00:19.170 --> 00:00:21.440 malicious link campaign using Gophish. 00:00:22.240 --> 00:00:25.650 If you're ready to get started, let's head over to the Gophish admin page. 00:00:27.210 --> 00:00:30.450 We will start by configuring a sending profile for our emails. 00:00:31.840 --> 00:00:34.550 We can access this page clicking the Sending Profiles link. 00:00:35.240 --> 00:00:36.650 Then, we'll go to New Profile. 00:00:37.820 --> 00:00:41.100 The sending profile determines how the email looks to the recipient, 00:00:41.740 --> 00:00:45.980 with the sending address being in the From field of the email. The 00:00:45.980 --> 00:00:49.500 Morning Catch VM has two accounts, Boyd Jenius, 00:00:49.510 --> 00:00:53.150 the system administrator, and Richard Bourne, the CEO. 00:00:53.730 --> 00:00:54.110 Normally, 00:00:54.110 --> 00:00:56.890 you would use information gathering and open‑source intelligence, 00:00:56.900 --> 00:00:59.350 or OSINT techniques, to find this information. 00:01:00.240 --> 00:01:02.000 Since we already have the email addresses, 00:01:02.450 --> 00:01:05.990 we'll just enter them from here. For this campaign, we'll be targeting 00:01:05.990 --> 00:01:09.550 the CEO and send the email impersonating the IT staff. 00:01:10.280 --> 00:01:13.770 So our sending address will be Boyd Jenius. Before 00:01:13.770 --> 00:01:17.050 we enter any more information, we'll start with the sending profile name. 00:01:17.800 --> 00:01:22.910 We'll call this one Morning Catch IT Staff. Our sending address, 00:01:22.910 --> 00:01:27.170 what'll show up in the From field, will be Boyd Jenius with an 00:01:27.170 --> 00:01:31.650 email address of bjenius@morningcatch.ph. 00:01:32.640 --> 00:01:35.730 We also need to configure the server address that we'll send email 00:01:35.730 --> 00:01:40.000 to. An easy way to find this in your environment without logging into 00:01:40.000 --> 00:01:48.070 the server is to use nmap and scan for an open port 25 for SMTP. And 00:01:48.070 --> 00:01:49.300 there's our Morning Catch VM. 00:01:49.460 --> 00:01:53.950 In my case, the IP address is 192.168.178.64. 00:01:54.840 --> 00:01:59.850 So, we need to put that address in the Host field, followed by port 25. 00:02:00.940 --> 00:02:03.350 We won't need a username and password for this profile. 00:02:03.990 --> 00:02:07.290 We can leave Ignore Certificate Errors checked, and we 00:02:07.290 --> 00:02:10.530 won't require any custom headers. So we can safely say 00:02:10.530 --> 00:02:13.550 this profile, and it's all set. 00:02:14.770 --> 00:02:17.770 The next step we have to take is to add some users and groups. 00:02:18.730 --> 00:02:21.950 We can do this by navigating to this page and selecting New Group. 00:02:23.110 --> 00:02:25.550 We'll call this group Morning Catch Executives. 00:02:26.810 --> 00:02:28.750 We have two options for adding the users. 00:02:29.640 --> 00:02:32.080 One is to add them individually. 00:02:32.640 --> 00:02:36.350 The other is to do a bulk import using a CSV file. 00:02:37.600 --> 00:02:39.240 Now since we only have one user, 00:02:39.640 --> 00:02:43.770 it's actually more work for us to create a CSV file and then bulk import it. 00:02:44.410 --> 00:02:47.180 But I want to go through this exercise just to show you how it's done. 00:02:48.440 --> 00:02:50.850 So, we'll start by creating that CSV file. 00:02:51.340 --> 00:02:55.790 I've called this file executives.csv. We first need the appropriate headings, 00:02:56.240 --> 00:02:58.350 which are First Name, Last Name, 00:02:58.610 --> 00:03:05.580 Position, and Email. And this information is Richard, Bourne, CEO, 00:03:05.720 --> 00:03:10.110 and his email is rbourne@morningcatch.ph. 00:03:11.280 --> 00:03:17.860 Now we just save that file and exit, and we're ready to import it. So we'll 00:03:17.860 --> 00:03:23.970 go to Bulk Import Users, scroll down and select the executives.csv file and 00:03:23.970 --> 00:03:29.070 click Open, and we have our user imported, Richard Bourne, 00:03:29.070 --> 00:03:33.250 rbourne@morningcatch.ph, and a position of CEO. 00:03:33.940 --> 00:03:38.950 So now we can save those changes, and our Morning Catch Executives group is set. 00:03:39.940 --> 00:03:42.250 Now we have to configure a landing page. 00:03:42.640 --> 00:03:46.480 The landing page is what we're going to have our link direct the user to. 00:03:47.180 --> 00:03:49.450 This is where we'll try to capture credentials. 00:03:49.840 --> 00:03:50.670 In this scenario, 00:03:50.680 --> 00:03:53.230 we're going to try to capture Richard Bourne's credentials 00:03:53.330 --> 00:03:55.210 in a false website that we're hosting. 00:03:56.140 --> 00:03:59.050 We need to make it look close to what he's used to seeing. 00:03:59.640 --> 00:04:04.930 Luckily for us, under the landing pages and New Page button, 00:04:05.300 --> 00:04:09.850 you'll see this option to import a site from an already existing one. 00:04:11.140 --> 00:04:11.670 Now, 00:04:11.920 --> 00:04:15.400 companies often support the use of webmail services to enable their 00:04:15.400 --> 00:04:18.820 remote workers to log in from their personal computers and read 00:04:18.820 --> 00:04:22.380 company emails while they're outside of work. We can check for 00:04:22.380 --> 00:04:24.550 potential webmail services in a few ways. 00:04:25.080 --> 00:04:25.750 In this case, 00:04:25.760 --> 00:04:28.450 we're going to use nmap to run a scan of the email server 00:04:28.790 --> 00:04:31.850 and see if ports 80 or 443 are open. 00:04:32.380 --> 00:04:36.530 I'm going to add a script to this to enumerate HTTP directories if those 00:04:36.530 --> 00:04:43.190 ports are found open. And that scan has returned an open port 80, and we 00:04:43.190 --> 00:04:45.730 can see the HTTP directories were enumerated, 00:04:45.740 --> 00:04:47.430 including this mail directory, 00:04:47.940 --> 00:04:52.460 which probably contains our webmail login page. To confirm that, 00:04:52.470 --> 00:04:57.970 let's go ahead and open that website using our web browser. And we have a 00:04:57.970 --> 00:05:01.150 webmail login page for Morning Catch's corporate email. 00:05:02.040 --> 00:05:05.690 Let's go ahead and import that site into Gophish as it seems ideal to 00:05:05.690 --> 00:05:10.850 capture Richard Bourne's credentials. So go to Import Site and type 00:05:10.850 --> 00:05:16.460 that same address. And we have our login, 00:05:16.470 --> 00:05:18.100 but we're missing a few images. 00:05:19.240 --> 00:05:21.980 Let's see if we can't at least copy that image of the fish over. 00:05:28.640 --> 00:05:31.310 Great, although it doesn't support the same styling, 00:05:31.700 --> 00:05:33.410 it does look a little bit more legitimate, 00:05:33.420 --> 00:05:34.950 at least using their same logo. 00:05:35.540 --> 00:05:37.750 You'll see in a minute when we create our email that we're 00:05:37.750 --> 00:05:40.350 going to try to explain to Richard Bourne why it might 00:05:40.350 --> 00:05:41.550 look a little bit different. 00:05:42.140 --> 00:05:42.730 But for now, 00:05:42.740 --> 00:05:46.500 we'll go ahead and call this page Webmail, and then we 00:05:46.500 --> 00:05:48.350 have a few last buttons to click. 00:05:48.820 --> 00:05:50.750 One is to capture submitted data, 00:05:51.640 --> 00:05:53.940 and we're going to go ahead and capture passwords. 00:05:53.950 --> 00:05:56.150 Now take a look at this warning before you select 00:05:56.150 --> 00:06:01.430 this in a real‑world environment, passwords are stored not encrypted by Gophish. 00:06:01.660 --> 00:06:04.410 So if you're not authorized to capture unencrypted passwords, 00:06:04.420 --> 00:06:08.880 do not select this option. Now, a hacker is not going to care about that. 00:06:08.890 --> 00:06:10.060 So for our purposes, 00:06:10.070 --> 00:06:13.170 we're going to see how this works and show you how you can capture 00:06:13.180 --> 00:06:16.150 clear text usernames and passwords using these methods. 00:06:16.780 --> 00:06:20.030 Now we have another option here to redirect the user to 00:06:20.030 --> 00:06:22.160 a particular page. And in this case, 00:06:22.170 --> 00:06:25.550 we're going to redirect them back to that webmail page. 00:06:27.930 --> 00:06:30.240 Now once the user fills out the information that we 00:06:30.240 --> 00:06:32.020 want and we capture their credentials, 00:06:32.130 --> 00:06:34.550 they'll be redirected back to the same login page. 00:06:36.900 --> 00:06:38.850 Okay, our landing page is set up. 00:06:39.940 --> 00:06:42.910 So now we have our sending profile, target addresses, and 00:06:42.910 --> 00:06:44.910 landing page ready for that campaign. 00:06:45.640 --> 00:06:48.600 The last step we need to take is to create the email template, 00:06:49.340 --> 00:06:52.000 and we'll continue on from that point in the next demo.