What is Phishing | Learn Phishing Using Kali Linux | Phishing Attack Explained | Edureka Rewind 1

Key Takeaways

hi everyone this is Omar from edura and today I'll be speaking about fishing attacks in the previous video I spoke about SQL injection attacks where I explained to you what SQL injection is how it works and also showed you a demo telling how you can use SQL injection attacks to hack a web application so in this session I'll be talking about what fishing is how fishing works and uh I'll be showing you a demo on how to use fishing to hack a Target and also at the end of the session I'll be telling you how you can be safe from fishing attacks so first let us understand what a fishing attack is now talking about what fishing actually is on a day-today base everyone that use internet use a web application you can be using a web application through your apps on your smartphone or some applications on your desktop desktop or you might be using a web browser now consider the case where you're using a web browser and you have to shop something online now you search for your product and you come across different websites and you like the product on two different websites so one of these websites is a very famous very popular very trustworthy e-commerce website and there is another website which is selling your product for the same price and uh or maybe for a more discounted price but but it is not popular you've never heard of that e-commerce website before now you choose to pay for your product online and for that you might have to enter your credit card or your debit card details now the question is which website would you trust more with your personal details with your sensitive details that is your credit card details obviously you would be less hesitant while you're entering the credit card details onto the e-commerce website that is trustworthy and you would be more hesitant you would be worried while entering these details onto the website that you are hearing the name for the first time this is because you don't trust the new website the other website the popular website you've heard of the name before you've used it before and you have a trust factor with that website so this psychology is what hackers take advantage of in fishing attacks so hackers take advantage of this trust factor and they fake themselves as a trustworthy entity to steal your sensitive data or your personal data so fishing is a attack of gathering sensitive information of a Target such as username password email ID or other sensitive information maybe your bank details your credit card your debit card details by disguising the themselves as a trustworthy entity so as I told you previously if you're entering any sensitive information maybe your card details onto a trustworthy website you wouldn't be hesitant so in fishing attacks a hacker disguise es himself as a trustworthy entity then he makes you he tricks you into entering your sensitive information into that fake web application so this is fishing now let us see how fishing works like I told you fishing is a web- based application and this is mainly used to steal credentials so we need a web application that is using a web server now every web application is connected to a web server when you're using a web application what happens is there is some data the packet the information that is being sent from your web application to the web server and from the web server back to your web application now this is how the communication between the web application and the web server happens now what happens in fishing attack is the hacker disguises himself as this web server so you think that you are communicating with the genuine with the actual web server but in reality you're just communicating with the fake web server or the fake web application that the hacker has built and when you enter sensitive information onto this web server or this web application the hacker steals your credentials so this is how fishing works now let's see what are the steps for a fishing attack so the first thing a hacker must do is create a fake website because like I told you fishing is an attack where a hacker disguises himself as a trustworthy entity so first he has to create a fake website a fake of a genuine website and to trick the victim to enter the credentials the next step is to send this fake website to the victim now suppose a victim is trying to access Facebook for example if he goes to the web application by himself uh maybe he' enter the URL of the website or he would search for that website on a search engine and then uh use the link to go to that website now when he does that he goes to the actual the genuine website and not to the fake website so the second step is is that the hacker has to send this fake website to the victim where the victim enters the credentials the third step that happens is the victim thinks that this fake website is a trustworthy website and enters credentials and finally the hacker gets the credentials so this is how fishing works now let's see how you can use fishing to steal credentials of a victim there are different ways of using fishing and fishing is basically stealing credentials by disguising yourself as a tust for the entity now how you use fishing depends on your victim so there are different ways you can use fishing in I'll be talking about two ways the first one is using already existing tools there are different tools that are already available some of these tools are already pre-installed in certain penetration testing operating system and most of them almost every one of them are present online on the internet and most of them are available on GitHub for you to download and use so the first thing I'll be telling you the the first way is using tools so for this demo I'll be using SE toolkit which stands for social engineering toolkit and there are different tools like wean social fish that I'm not going to be showing because it's basically the same thing you're trying to do and when you're using a tool there are two things you can do the first thing is using pre- available templates so most of these fishing tools come with pre- available templates and you just have to use these templates to create a fake web application so what if you want to fake a web application or creating a fishing page of a web application that is not pre-installed in that case you can go for the second option that is cloning a website so in this method what you do is you enter the URL of the web application that you want to fake and then the tool creates a clone of that web application so first let us see how you can use SE toolkit tool that is social engineering toolkit tool to clone a website using pre- available templ templates so to enter this tool I'll be typing SE toolkit I'll be getting a lot of different options that I can choose from I'll be using the first option that is social engineering attacks because that's what facing comes under so I'll choose option one I'll hit enter and there are different websites I'll be choosing option two that is website attack vectors and then I'll be choosing option three that is credential Harvester attack method because we are trying to seal the credentials of the victim now I've got different options like I told you you can use pre- available web templates or you can use site cloners so first I'll be telling you how you can create a fake fishing web page using pre available template so I'll choose option one the first thing you have to do is enter the IP address that the results of the fishing has to be returned to because when you create a fake web application and the victim enters credentials those credentials has to be sent back to you so that you can use them so you have to enter your IP address to find out your IP address you can open the terminal then type if config and you can see different interfaces and because I'm using a local machine for this demo I'll be using ethernet0 and the IP address for this is 192.168.1.1 181 so I'll copy this and as you can see that this tool is by default taking the same IP address I can just go ahead and hit enter and suppose you want to change the IP address suppose you have different interfaces and you want to use a different interface in that case you can use the IP address of the other interface uh for this demo I'll be keeping the IP address same and I'll just go ahead and hit enter now there are three options there is Java required there is Google and Twitter and for this demo I'll be creating a fishing page for Google so I'll choose option two that is Google Now the tool will run it will create a web application a fishing web application and I'll just hit Ender uh now the fishing web application is ready so I'll just open the browser and because I'm running this on my local server I'll just hit Local Host and enter well you can see that uh there is a Google login page that is asking for an email ID and a password and as you can see in the URL that it is not the actual Google page Because the actual Google login page would have a different URL now what you have to observe is what is shown on the terminal because whatever the victim enters those details can be seen on the terminal now what you have to do after creating a fake fishing page you have to send this page to your victim and when you send this page to your victim and the victim enters some details maybe ABC xyz.com and some random password and then he hit hit the enter button you can see on the terminal that the tool the fishing tool shows the email ID and the password that is entered by the victim so this is how you can use pre- available templates to create a fishing page now what if you want to create a fishing page of a web application that is not available as a web template in that case there is another option that you can use that is the site cloner so let's see how you can use site cloner to create a fishing page well for this demo I'll be creating a fishing page of edureka community and the URL for that is ua. c/c community I'll hit the enter button urea Community is basically a forum where people can ask questions the doubts regarding various Technologies and there are other community members that answer to your questions so there are different options here latest is most viewed is ask a question it's also integrated with a Blog and what we are actually interested in this part that is the login and sign up because we want to seal the credentials so this is what we are interested in and I want to clone this site to create a fishing page so I'll just copy the URL of this page now coming back to the terminal I'll enter the fishing tool again that is SE toolkit and I'll choose option one here I'll be choosing option two that is website attack vectors and similar to the previous way I'll be using credential Harvester attack method that is option three and here instead of using uh option one that is web templates I'll be using a site cloner that is option two and similar to the previous time it asks for the IP address I'll hit enter Because this is the IP address I want to use and now you have to enter the URL for the web application that you want to clone and because I copied the web application of Ed urea Community I'll just paste it here and I'll hit enter now this tool will take a little bit of time to clone the website and well it is ready now let's see how the fishing website looks I'll open a new tab I'll just close the other Tab and because I'm running this on a local server I'll hit Local Host well this is the fake website this is the fake edureka Community website now you can see that the interface looks exactly the same all the options here are available all the questions all the details there are different categories here and also the login button now if you have a victim that uses edureka Community regularly then you can create a fake website a fishing website of edureka community and then send this fishing website to him so what happens is when he hits the login button he has to enter the email ID and password and when he enters the email ID and password for example I'll be entering this email ID and some Rand random password and I'll hit the login button now let's see on the terminal what details we get now as you can see that there's a message that tells possible username found possible password found and you can see that the username and the password that I entered on the fishing page is available to me on this site so this is how you can use fishing tools to steal credentials of your victim now the question is when you create a fishing page using these tools and you send these fishing pages to your victim the URL is something different there is local host or there is an IP address and suppose you want to steal credentials of Gmail and you send one IP address and your victim opens it he sees there's a Gmail login page so do you think he would actually enter his information because it would be fishy because if he has to login into Gmail he would just enter the URL by himself or go to Gmail login page by himself he he would obviously think why he has to enter his credentials on the web application the website that you sent so if you're just using fishing tools and just sending the IP address in most cases you will fail because the victim will know that something's fishy in that case what you have to do is use the second way for fishing so the second way for fishing is creating a custom fishing website now to do this you have to study your victim you have to understand your victim you have to understand what pages he usually visits What fields what things he is usually interested in and then depending on his interest you have to create a fishing website now let me show you how you can use fishing by creating a custom fishing page now coming back to the Ki Linux operating system I have created a fishing page uh that I will show you and I have created a fishing page that gives you some offer this special offer and when I was creating this fishing page I had this one friend in mind that uh usually keeps looking for offers to buy food because he's a foodie he usually orders online and every day he goes onto different websites and checks for coupons available or promo codes available so this friend uh was what I had in mind and I created this fishing page that's tells special offer offer valid on swiy zato Uber Eats food Panda basically different food ordering services and I've also written that uh you can get 80% off on your food delivery and to do this you have to log in with your Gmail account so you have to login with your Gmail account to Avail this offer and also under the get promo code I have created a login button and just to make it a little leged because usually promo codes have expiry dates and uh yeah so if I send this thing it would look legit and because there's a expiry date he would log in with GP now I've also connected this web application to a database where I've designed this web application in such a way that when the user logs in to Gmail using his email ID and password then that email ID and password is sent and stored onto my database so if I send this fishing page to my friend obviously because he needs promo code he would go and hit the login button and I've redirected this to a fake Gmail login page he would enter his email ID and password because he wants the promo code for food and uh he would enter his email ID and password and hit the login button and then I'm just displaying something telling coupon details will be sent to your email address and he'll be checking for the coupon details for the promo code on his email ID but what happens in the background is his credentials are sent to my database and stored in it so let me just check what details I've got on my database so I'll be logging into my database first and uh for this I'm using the database called test so I'll just select that database let me see what tables are available here there are two tables and there's this table called fishing details where I'm storing the data in so I'll just print out I'll just display all the rows from this table so select star from fishing details this is the query to print all the rows of the database table now let me hit enter well you can see that there are two rows this was a previously entered username and password and this is the username and password that we just entered so this is how you can create a custom fishing page depending on the interest of your victim and then steal credentials of your victim now that you've seen how to use fishing to Steel credentials now what if someone is trying to execute a fishing attack on you how can you be safe from fishing method so you've seen how fishing Works you've seen that the main part of fishing is the URL so the first important point that you have to keep in mind uh to be safe from fishing attacks is never enter sensitive information on a web application that you don't trust because if it's a genuine web application if it's Gmail if it's Facebook and you're typing the URL and then going to the web application then you know it is a trustworthy web application but if there is some random web application that you've never heard of before that you don't trust and that web application is asking for sens of information especially your bank details because most of the time fishing is used to get Bank credentials and also email ID and password so always be careful not to enter sensitive information on web applications that you don't trust the second thing is always look at the URL of the web application suppose you want to log into Facebook then the URL would be www.f.com this is the homepage of Facebook suppose you have another URL some other URL and a Facebook page is displayed that is asking you for your login credentials then you have to understand that there is something fishy this might not be the genuine Facebook page in that case always be careful to look at the URL when you're entering sensitive information well that's all for this session if you've liked this video like and share and stay tuned for more videos on hacking where I'll be explaining different methods different concepts of hacking until next time then bye-bye