Demonstration on Phishing Attack

Phishing Attack:

Phishing is a type of social engineering attack often used to steal user data, including login credentials and credit card numbers. It occurs when an attacker, masquerading as a trusted entity, dupes a victim into opening an email, instant message, or text message. The recipient is then tricked into clicking a malicious link, which can lead to the installation of malware, the freezing of the system as part of a ransomware attack or the revealing of sensitive information.

An attack can have devastating results. For individuals, this includes unauthorized purchases, the stealing of funds, or identify theft.

Moreover, phishing is often used to gain a foothold in corporate or governmental networks as a part of a larger attack, such as an advanced persistent threat (APT) event. In this latter scenario, employees are compromised in order to bypass security perimeters, distribute malware inside a closed environment, or gain privileged access to secured data.

Types of Phishing Attack:

• DECEPTIVE PHISHING
• SPEAR PHISHING
• VISHING
• SMISHING
• PHARMING

Demonstration:

In this demonstration, we will use “setoolkit’ present in Linux. Here, are the steps:

• Using ‘setoolkit’, make a clone website of the required website like Facebook, gmail etc.
• Send the cloned website to the victim, using any other social engineering attack.
• When the user click the link, the cloned interface of original website will open and asked for username and password.
• When the victim enter the details, all the entered detail will automatically shown on your ‘setoolkit’ interface.

Steps:

1. Open the Terminal and type “setoolkit”. This tool is used for phishing attack in various ways.

1. After completing step 1, the window will slide down, and a new option will come out. From given option we must choose one i.e. ‘Social Engineering Attack’.

1. After choosing option 1, again the window will slide down and a new list of option will come out. We must choose website attack vector; we are doing the practical for making vague website.

1. Now the cycle will revolve again, now we must choose Site Cloner from the showing option, as we must clone the website to attack the target.

1. Now, the terminal will take some seconds to initialize the tool for cloning the website. Then, it will ask for the website, the attacker want to clone.

1. Now, give the link to the target which is generated via these above steps. The victim would get to reset his/her password on clicking the link. When the target enter the details, the username and password will automatically came to the terminal open at attacker website.