Now, that we've talked about social engineering
and how you can use it in pen testing and some use cases,
some examples in real life that you could emulate,
I'm going to walk you through a lab
where you can actually do some phishing,
do some social engineering.
You might do this during a penetration test.
And I want you to be able to know how you might use it
if you are in that situation.
So let's get started.
I keep my head out of the way.
So what we have here is we have the Gophish tool.
It's written in Go, and we have a local web server.
So our victim, their email address
is victim@demo.ine.local.
And what we'll do, we'll have that open.
We start up the Gophish server.
And if we look at this, we can see
that the admin servers at localhost 127.0.0.1 port
quad 3s--
3333.
Fortunately for you, I've set this up.
Now that it's running, the home page for Firefox here goes
to quad 3's.
Hit Advanced.
Accept the risk and continue because it does not
come with SSL certificates.
If it ever gets stuck, click into this window
and hit Control C--
just one of those things.
Password is in the instructions.
And it takes you to the dashboard.
And what you have here is a whole setup
that makes this reusable.
You could reuse the same campaign
with different customers.
You could have individual campaigns.
A lot of this is going to depend on you going out and setting up
good domains to use.
And make sure that what you're doing is in scope
and is part of what your pen test is supposed to cover.
So we talked about that in the last lesson.
Why you would do pen test?
Why it's necessary?
Or why you would do phishing in a pen test?
Why it's necessary?
This is more how you might do it.
So at Gophish, set up a profile, and we'll just call this red.
And we're emulating an email from INE.
So we want it to come from the support email
or look like it's coming from the support email.
Our host is going to be localhost on port 25.
That's where SMTP server is.
The account that we'll use to send it is red@demo.ine.local.
You would need to set up some sort of email account
to send from.
And then also the password is going to be in the instructions
here.
We will ignore certificate errors.
We need to check and test if this works.
So we will send a test email to Vic Tim, victim@demo.ine.local.
And they are the intern there.
And Over here, we see that we got that email.
So we successfully sent things from that account.
And it says it's from info, support@demo.ine.local.
If you click on it, it even still says
it, which is pretty neat, huh?
So now that we have--
this is sending profile setup.
We need a landing page.
Fortunately for you, I have set up also local on 8080--
a version of the landing page if you were to get a password
reset from INE.
And this page doesn't actually do anything.
It doesn't have any of the operability,
so any new requests are just going
to send you right back here.
It doesn't know what to do with it, but we can use that.
So you would want to set up some sort of landing page.
Get a domain.
Get an IP address where you can send things,
or if you're using a website that actually does exist,
you can use that.
So INE password reset.
You can use the actual INE password reset page.
That's how I got mine.
Don't use this unless you're authorized to use it.
So we looked at that page.
This is an example of what it looks like.
That's what we want.
And we would like to capture the submitted data if we can,
and we would do that.
After they hit our page, let's send them back to you
localhost 8080.
This is set up locally because it just works way.
And you can't reach in it, so I couldn't use a real live page.
So an email template right here on your desktop.
We have this email template.
It is a dot txt version of a dot eml.
If you were to go out to the internet,
look at one of your emails and save the actual email.
It saves as an dot eml file, and it looks a lot like this.
It looks like some HTML when you really
get into it, with tables, and bodies, and all sorts of stuff.
So we will steal all of this from the original email,
replace certain things like the user instead of my email
address.
And I need that.
We're going to use all this code, so copy.
Let's go into here--
a new template.
I need password reset, import email and copy that whole thing
in there.
We want that change link.
And now, it looks like an email you might actually
get from INE.
And we want this Add Tracking Image.
What it does is it includes a 1 pixel image on there that
actually calls back to our Gophish server
and gives us information.
I'll show you how that works in a minute.
And then one of the last things--
Users and Groups.
And I've set up some targets for you and put them in the CSV.
We've got Alice Inchains, Bob Barker, John Wayne,
and Vic Tim, our CEO, CFO, CMO, and intern
at this target company.
And you could go through and put all their names in here
and add one at a time.
You download the CSV template and make a bulk import
like I did or just grab targets.
It's on your desktop.
What you definitely need to make this work
is victim@demo.ine.local because you have access
to victim's email.
So targets are all in there, and you could, again,
if you wanted to look at who they are.
Alice Inchains, Bob Barker, and John Wayne.
And now lastly, our Campaign.
The new campaign is going to be INE password
reset for target company.
And a lot of these things are set because there's
only one option.
If you had multiple options, you would pick one.
We're going to put this on--
host it locally.
This is also where you would put the domain, the server
that you've actually utilized.
It could be a cloud server.
It can be your own server, something
that you can tie back to you, that's going to host all this.
I totally misspelled red, so I guess it's erd.
Our group is going to be targets.
And you can schedule this out if you want,
or you can set a final date, and it'll
schedule out between your start and your last.
And are you ready?
Yeah.
Let's launch this thing.
Campaign scheduled, and it went.
And it already spread them out.
Since we gave at the same time, it spread them out
by a few seconds.
You can see first one is that 59.150.
They spaced him out by what?
5,000 of a second.
But they spaced him out.
We have four emails sent, and there's
details of all of the people whose emails they were sent to.
And we are victim, so let's open this email.
And there wasn't an immediate change.
Let's hit Refresh over here.
And hey, it saw that we had opened this email.
Because there is a tiny little image somewhere on here
that called back and said it was opened.
And on the timeline, it shows when it was opened.
And if you scroll down, it says who opened it.
It's really neat.
If I click on Reset Password, it's
going to take me to a localhost 8080.
That's what it says.
I can put in new password and new password.
Hit Submit.
And it didn't do anything because this page isn't real.
But if I check back here and refresh,
it show that I clicked through to the link.
Now, the target page is broken, so it didn't actually
catch the submitted data, which is fine.
But this is how it works.
That's all you got to set up.
I'll tell you, the backend setup does take a couple of days.
Even to make it look like this on a localhost,
it takes a couple of days of setup.
But once you have it set up once,
then you should be good for any--
you should only have to make minor tweaks
with each new campaign.
And if you have a team, it becomes even easier.
You can add users, and we could add in webhooks
so that when people click on things,
not only do you get that they clicked,
but you can manipulate other things on their page.
Again, this is not to be used maliciously.
This is for testing and possibly training on social engineering
and phishing, which is part of your assessment
because it should be.
So our campaign is currently running.
It says it's in progress.
If we were complete, we could say complete.
There is an option for emails reported,
but I had already ended the campaign.
If someone calls in and says that they reported,
then I completed it too early.
My bad.
Then you could have that and have
this to share with your client.
You could export it as a CSV, put it in your report,
all of those good things.
That is the power of a tool at Gophish
for a phishing campaign.
Now, the things that you want to include
is a email that looks real, including
where it's coming from.
You want to connect to them.
It would be reasonable that they would get an INE reset.
I didn't want to use any other company's emails
or go through the trouble of making one
because I'm not that creative.
Same with the landing page, you want
something that's realistic.
You might be in trouble if you use
something that looks too real.
Make sure that you have a good conversation with your lawyers
and with the customer because you don't want to fall prey
to some of the companies out there who
phish their own people and got some mud on their face,
put their foot in their mouth.
So avoid those dangers.
And if you don't know what I'm talking about,
go check out the company that sent out
emails about a bonus that didn't actually exist.
With that, that's the end of this lab.
Hopefully, you've got an idea of how
you could use social engineering as part
of your penetration testing part of your assessment.
You could use this as a way.
And if it was within scope to gather credentials,
that might be an option.
Again, check that it's inside scope, that it's reasonable,
that you're allowed to do that.
But that could be a way in, or this could just
be an addendum, an extra thing that you do as part
of your overall assessment.
And with that, hope you enjoyed social engineering,
and we'll see you in the next course.