Zphisher – Kali Linux 2021 – Phishing Tools for Social Media

Written by Rob Parker

Written by Rob Parker

Rob เป็นแฮ็กเกอร์ที่มีจริยธรรมที่ผ่านการรับรอง (CEH v11) จาก EC-Council และเจ้าหน้าที่คุ้มครองข้อมูล EIPA ที่ผ่านการรับรองซึ่งเชี่ยวชาญด้านความปลอดภัยและการแฮ็ก อย่างมีจริยธรรม เขาเคยทำงานในส่วนต่างๆ รอบโลกในบทบาทด้านความปลอดภัยต่างๆ และใส่ใจที่จะช่วยเหลือผู้อื่นในการแฮ็กข้อมูลอย่างมีจริยธรรม

โพสต์การแฮ็กอย่างมีจริยธรรมของ Steam Labs ออกแบบมาเพื่อให้ความรู้ แนะนำ และสาธิตเครื่องมือแฮ็กเพื่อการทดสอบการเจาะระบบเท่านั้น เราจะไม่รับผิดชอบต่อผู้ที่ใช้ทักษะเหล่านี้ในการโจมตีที่ผิดกฎหมายหรือมุ่งร้าย

In this tutorial I will explain how hackers use Zphisher on Kali Linux as alternative tool to Shellphish and Blackeye and demonstrate how to set it up and use it for educational purposes when setting up phishing scams.

What is Social Engineering and who are the attackers main target?

Social engineering is an art of manipulating people in order to gain crucial information that can be utilized for performing malicious action. In social engineering instead of targeting on the weakness of network or a machine we target the weakness of people.

  • Receptionist and Help-Desk Personnel: Attacker can extract phone number and email id from them.
  • Technical Support Executives: Attacker can pretend to be senior manager, a customer or a vendor to gain information from them.
  • System Administrator: They are the one who maintains the systems of all the employees
  • User and Clients: Attacker can pretend as technical support and can gain information from them
  • Senior Executive: They can target HR, Finance CxO’s of company to gain critical information

What are the 4 phases of social engineering?

  • Research the Target Company: Before attacking the target organization’s network, an attacker gathers as much information as he/she can in order to infiltrate the system Social engineering is a technique which helps in extracting information. While researching attacker gets indulged in activity like dumpster driving (searching the waste coming out of the organization in order to get some crucial information) browsing company’s website and finding employee details.
  • Select a target: After an attacker has performed enough research on the target company then he selects targets for extracting sensitive information. Most preferably he targets the employee that is frustrated of his job as they are easier to be manipulated.
  • Develop Relationship: Once attacker finds out the target on which he would be performing social engineering he tries to build a relationship with that employee to gain his/her trust.
  • Exploit the Relationship: After an attacker is successful in developing a relationship, he exploits the relationship to gain crucial information about organization’s account finance information, etc.

What is credential grabbing?

We will be learning about how to create a malicious link for credentials grabbing. Credential grabbing is one of the most common phishing attack that tricks user in providing there credentials in some fake website or malicious website.

Pre Requisites

Web Browser = Victim System (compromised)

Kali Linux = Attacker (Metasploit Framework)