WEBVTT 00:00:01.040 --> 00:00:03.150 Are you looking to gain initial access over an 00:00:03.150 --> 00:00:05.190 adversary leveraging phishing tactics? 00:00:05.200 --> 00:00:08.570 Hello, and welcome to Initial Access with King Phisher. 00:00:09.150 --> 00:00:11.050 I'm Jeff Stein, and in this course, 00:00:11.050 --> 00:00:14.000 I will take you through how you can use King Phisher to execute a 00:00:14.000 --> 00:00:17.050 phishing attack in a red team environment against a target. 00:00:17.640 --> 00:00:20.900 We will walk through enumeration techniques to help assist you in 00:00:20.900 --> 00:00:24.330 creating a convincing phishing campaign to increase the likelihood 00:00:24.570 --> 00:00:26.560 that your target will engage with your attack. 00:00:26.850 --> 00:00:27.550 Additionally, 00:00:27.650 --> 00:00:30.470 I will walk you through how you can further your initial access 00:00:30.470 --> 00:00:34.050 objectives using the King Phisher feature set to enable the 00:00:34.050 --> 00:00:35.990 harvesting of credentials from your victim. 00:00:36.160 --> 00:00:40.350 Before we get started, let's jump into a quick overview of what King Phisher is. 00:00:40.640 --> 00:00:43.770 King Phisher is a tool used for building complex phishing 00:00:43.770 --> 00:00:47.090 attack scenarios, as well as coordinating and monitoring 00:00:47.090 --> 00:00:48.860 successful phishing campaigns. 00:00:49.550 --> 00:00:52.180 It originally was created by the SecureState team, 00:00:52.390 --> 00:00:55.330 and I want to thank them for their work in developing the software. 00:00:55.730 --> 00:00:57.360 It has many different features, 00:00:57.410 --> 00:01:00.220 but overall has been developed for the ethical purpose of 00:01:00.220 --> 00:01:03.140 testing and promoting user awareness through simulating 00:01:03.140 --> 00:01:04.680 real‑world phishing attacks. 00:01:05.340 --> 00:01:08.260 Over time, the feature set of the tool has expanded, 00:01:08.510 --> 00:01:11.970 enabling different types of phishing attacks and reporting options. 00:01:12.320 --> 00:01:15.850 King Phisher is an open source tool available on GitHub and 00:01:15.850 --> 00:01:18.290 also comes preinstalled on Kali Linux. 00:01:18.940 --> 00:01:21.500 In addition to the core functionality of the tool, 00:01:21.510 --> 00:01:25.660 one of the great aspects of the project is the GitHub repository that 00:01:25.660 --> 00:01:29.330 houses prebuilt content templates to use with King Phisher, 00:01:29.340 --> 00:01:32.970 which assists in increasing the legitimacy of your phishing messages. 00:01:33.340 --> 00:01:34.150 Also, 00:01:34.180 --> 00:01:37.400 the King Phisher server is capable of creating and hosting 00:01:37.400 --> 00:01:40.620 landing pages to complement your phishing attacks for 00:01:40.620 --> 00:01:42.710 harvesting credentials from your targets. 00:01:43.140 --> 00:01:46.300 Now that we have a good idea of how we will utilize King Phisher, 00:01:46.610 --> 00:01:49.350 let's take a look at where the tool falls on the kill chain. 00:01:50.040 --> 00:01:52.100 If you are familiar with the cyber kill chain, 00:01:52.210 --> 00:01:55.610 you will see that the features of King Phisher can be used in between the 00:01:55.610 --> 00:01:59.760 recon and exploit phases to gain initial access of a target. 00:02:00.750 --> 00:02:04.230 If we map the techniques we will learn during this course to the 00:02:04.230 --> 00:02:07.540 MITRE ATT&CK framework, we will be covering one of the attack 00:02:07.540 --> 00:02:10.039 framework categories in initial access, 00:02:10.360 --> 00:02:14.300 including valid accounts and phishing with coverage of the 00:02:14.300 --> 00:02:18.480 spearphishing link and spearfishing via service subtechniques. 00:02:18.940 --> 00:02:22.870 Now let's quickly review how our attack scenario will look with King Phisher. 00:02:23.440 --> 00:02:26.470 We will start by targeting the email domain of our target. 00:02:27.330 --> 00:02:30.630 In our scenario, this will be the mail system of Globomantics, 00:02:30.780 --> 00:02:34.410 an evil corporation which we will target for initial access. 00:02:34.840 --> 00:02:38.290 We will target the mail domain by sending a well‑crafted email 00:02:38.520 --> 00:02:42.520 destined for the Globomantics CEO, convincing him to provide 00:02:42.520 --> 00:02:44.200 us with his domain credentials.