WEBVTT 00:00:02.130 --> 00:00:02.880 In this demo, 00:00:02.880 --> 00:00:05.550 we're going to explore phishing techniques to unlock ways 00:00:05.550 --> 00:00:07.350 to gain initial access through phishing. 00:00:08.140 --> 00:00:11.820 First, we'll enumerate our victim company to identify potential targets. 00:00:12.620 --> 00:00:16.630 Then we will dive deeper into the domain to identify limitations and how 00:00:16.630 --> 00:00:19.260 we plan to target the victim with a phishing attack. 00:00:19.940 --> 00:00:22.970 We will also run through an alternative phishing attack scenario 00:00:22.970 --> 00:00:25.970 using the MITRE tactic spearphishing via a service. 00:00:27.240 --> 00:00:29.820 We're going to start off on our Kali attack system, 00:00:29.830 --> 00:00:32.880 which is a prebuilt VM provided by Offensive Security 00:00:32.890 --> 00:00:35.550 available on their virtual image download page. 00:00:36.040 --> 00:00:38.790 This VM will come with King Phisher preinstalled on it. 00:00:39.110 --> 00:00:41.540 And to ensure clarity in our demo scenarios, 00:00:41.670 --> 00:00:44.050 I recommend you using this VM in your lab. 00:00:44.840 --> 00:00:47.500 If you prefer to install King Phisher manually, 00:00:47.730 --> 00:00:51.160 you can perform the install on either Kali or other supported 00:00:51.160 --> 00:00:54.710 Linux distros of choice by using the terminal instructions 00:00:54.920 --> 00:00:57.000 found on the King Phisher GitHub page, 00:00:57.050 --> 00:01:01.060 which I'll include a link to in the resource section at the end of the course. 00:01:02.040 --> 00:01:05.760 With our attack system ready, let's go ahead and identify our victim. 00:01:07.240 --> 00:01:09.900 We're going to be targeting the Globomantics corporation. 00:01:09.900 --> 00:01:12.230 To accomplish initial access, 00:01:12.230 --> 00:01:15.270 let's open up our web browser from the terminal by typing 00:01:15.280 --> 00:01:18.470 firefox and navigate to the Globomantics website, 00:01:18.500 --> 00:01:20.550 which is globomantics.lan. 00:01:21.140 --> 00:01:23.520 We can use the public information provided on the 00:01:23.520 --> 00:01:27.180 Globomantics website to help us enumerate our target and 00:01:27.180 --> 00:01:29.360 identify potential victims to attack. 00:01:30.440 --> 00:01:33.830 The information found on the Globomantics company website will also 00:01:33.830 --> 00:01:37.400 serve as a great repository of information that will help us craft a 00:01:37.400 --> 00:01:39.670 convincing attack using King Phisher. 00:01:39.670 --> 00:01:42.110 To help identify a victim to target, 00:01:42.110 --> 00:01:45.310 let's navigate to the Our story website section. 00:01:45.310 --> 00:01:46.820 Scrolling down the page, 00:01:46.820 --> 00:01:50.550 we see that Globomantics is detailing information about their CEO. 00:01:51.040 --> 00:01:53.260 This will make a great target for a phishing attack. 00:01:53.710 --> 00:01:56.970 Now let's navigate to our social media platform of choice to 00:01:56.970 --> 00:01:58.950 gather further information on our victim. 00:01:59.640 --> 00:02:03.570 Here we see on the social media platform that the CEO is providing some of 00:02:03.570 --> 00:02:06.870 his personal data associated with Globomantics publicly. 00:02:07.440 --> 00:02:10.710 We see that we are able to collect his Globomantics email address, 00:02:10.720 --> 00:02:13.170 which we can use for our King Phisher attack. 00:02:14.240 --> 00:02:16.330 While we're on the social media platform, 00:02:16.480 --> 00:02:18.590 let's take the opportunity to perform a quick 00:02:18.590 --> 00:02:20.270 phishing attack against our victim. 00:02:20.640 --> 00:02:24.180 In addition to using social media platforms to help enumerate victims, 00:02:24.190 --> 00:02:28.050 we can use the platform to send messages to facilitate a phishing attack. 00:02:28.840 --> 00:02:29.900 Like King Phisher, 00:02:29.990 --> 00:02:32.390 social media platforms offer us a unique way to 00:02:32.390 --> 00:02:34.300 target victims with a phishing attack. 00:02:34.300 --> 00:02:38.240 While we can use King Phisher to send phishing messages mapping to MITRE 00:02:38.240 --> 00:02:41.870 tactics spearfishing via link or spearfishing via an attachment, 00:02:42.180 --> 00:02:44.780 social media can be used to phish victims mapping to the 00:02:44.780 --> 00:02:47.210 MITRE tactic spearfishing via a service. 00:02:47.210 --> 00:02:49.960 We see here on our social media platform, 00:02:49.970 --> 00:02:52.510 we have the ability to post a message to our victim. 00:02:53.040 --> 00:02:54.830 Let's type a message to the CEO, 00:02:54.830 --> 00:02:58.290 enticing him to click on a malicious link that we purport is 00:02:58.290 --> 00:03:00.360 related to a potential job opportunity. 00:03:01.440 --> 00:03:04.370 While phishing the victim using this method has some advantages, 00:03:04.840 --> 00:03:07.690 including typically a less strict security policy on data 00:03:07.690 --> 00:03:11.440 transmitted to the user base of the media platform than that of an 00:03:11.440 --> 00:03:13.790 enterprise such as the Globomantics email domain, 00:03:13.890 --> 00:03:17.430 which we will need to take into account with our King Phisher attack, 00:03:17.430 --> 00:03:18.940 using social media, 00:03:18.940 --> 00:03:21.900 we do run into limitations on how successful we can 00:03:21.900 --> 00:03:24.260 report on and customize our attack. 00:03:25.040 --> 00:03:28.550 Both are limitations which the King Phisher feature set will solve for. 00:03:29.640 --> 00:03:32.850 Now let's close our browser and pivot back to the enumeration of the 00:03:32.850 --> 00:03:36.340 Globomantics domain with the information we have gathered from the company 00:03:36.340 --> 00:03:39.660 website and the victim's public social media profile. 00:03:39.660 --> 00:03:40.920 From the terminal, 00:03:40.920 --> 00:03:44.890 we can enumerate the Globomantics mail domain by querying the DNS records for 00:03:44.890 --> 00:03:48.660 the email domain to see if the company has created an SPF record to control 00:03:48.660 --> 00:03:51.020 who can send mail from the Globomantics domain, 00:03:51.400 --> 00:03:54.730 a tactic we will want to employ in order to increase the likelihood 00:03:54.730 --> 00:03:57.280 that our phishing attack will work against our victim. 00:03:57.280 --> 00:03:58.310 In terminal, 00:03:58.310 --> 00:04:06.050 we type nslookup space ‑type=txt space globomantics.lan and press Enter. 00:04:06.640 --> 00:04:10.660 Here we see that Globomantics does indeed employ the use of an SPF record, 00:04:10.840 --> 00:04:14.100 which is instructing recipient email domains to only except 00:04:14.100 --> 00:04:18.180 globomantics.lan mail from servers registered with the Globomantics 00:04:18.180 --> 00:04:22.470 domain MX record and drop all messages from senders not originating 00:04:22.470 --> 00:04:24.250 from the servers contained in the record. 00:04:25.130 --> 00:04:27.700 This will create a problem for us if we try to spoof the 00:04:27.700 --> 00:04:30.010 globomantics.lan domain in our attack, 00:04:30.010 --> 00:04:32.880 and we'll need to keep this information in mind as we 00:04:32.880 --> 00:04:34.970 craft our phishing attack in King Phisher. 00:04:36.040 --> 00:04:38.950 Now that we have completed our enumeration against our victim, 00:04:39.110 --> 00:04:42.580 let's go and open King Phisher to get started crafting our attack. 00:04:42.580 --> 00:04:43.620 From the terminal, 00:04:43.620 --> 00:04:51.330 we will type /usr/share/king‑phisher/KingPhisher and press Enter. 00:04:52.240 --> 00:04:55.590 Note here that the path we are accessing King Phisher from is the 00:04:55.590 --> 00:04:58.870 default path on Kali Linux with King Phisher preinstalled, 00:04:58.960 --> 00:05:02.150 but will differ from the default location if you've installed King 00:05:02.150 --> 00:05:05.350 Phisher manually on Kali or a different Linux distro. 00:05:06.440 --> 00:05:08.200 As the King Phisher client opens, 00:05:08.210 --> 00:05:10.890 we'll be prompted to enter credentials to access the 00:05:10.890 --> 00:05:12.770 database of the King Phisher server. 00:05:13.440 --> 00:05:16.680 Both client and server are residing on our Kali Linux system. 00:05:16.830 --> 00:05:20.130 However, if you prefer, you can run the client on a separate system, 00:05:20.310 --> 00:05:22.260 including on the Windows operating system. 00:05:23.140 --> 00:05:26.260 We enter our Kali user credentials with a username of kali 00:05:26.840 --> 00:05:29.270 and a password of kali and click Connect. 00:05:29.940 --> 00:05:32.420 We notice here that we have received a connection error 00:05:32.500 --> 00:05:34.390 that the server refused the connection. 00:05:34.940 --> 00:05:38.230 This is most likely because while we have opened the King Phisher client, 00:05:38.470 --> 00:05:40.750 the King Phisher server is not currently running. 00:05:40.750 --> 00:05:43.480 We can validate this by checking on the King Phisher 00:05:43.480 --> 00:05:45.250 service status from the terminal. 00:05:46.110 --> 00:05:49.810 Let's click OK on the client error message and open a new terminal tab 00:05:50.000 --> 00:05:55.760 and enter systemctl space status space king‑phisher and press Enter. 00:05:57.040 --> 00:06:01.620 We can indeed validate that the King Phisher server is inactive. To 00:06:01.620 --> 00:06:07.200 start the service type sudo space systemctl space start space 00:06:07.200 --> 00:06:10.060 king‑phisher and press Return. 00:06:10.920 --> 00:06:13.840 Reviewing the status command again now shows that the 00:06:13.840 --> 00:06:15.850 King Phisher server is now running. 00:06:16.730 --> 00:06:19.490 Now let's retry our Kali credentials in the King Phisher 00:06:19.490 --> 00:06:23.360 client, entering the username of kali and the password of 00:06:23.360 --> 00:06:25.960 kali and click Connect. Success. 00:06:26.840 --> 00:06:29.480 This will end our demo where we enumerated our victim 00:06:29.480 --> 00:06:33.350 both through the company website, DNS records, and social media, 00:06:33.810 --> 00:06:36.610 as well as learned how to use social media platforms to 00:06:36.610 --> 00:06:38.870 perform a spearphishing as a service attack. 00:06:39.840 --> 00:06:43.460 We are now equipped with the information we will need to use King Phisher 00:06:43.470 --> 00:06:46.650 and begin crafting our attack to spearphish our victim.