Хорошая заметка по фишингу: Phishing/Red Team Engagement Infra

  • Автор темы Автор темы ADMIN
  • Дата начала Дата начала
ADMIN

ADMIN

Administrator
ADMIN
Регистрация
18 Окт 1989
Сообщения
1,408
Реакции
93
Баллы
48
☑ ДЕПОЗИТ
0$

Phishing/Red Team Engagement Infra​


Phishing Blogs/Talks​


  • BHIS | How to Build a Phishing Engagement - Coding TTP's :


Red Team/Phishing Infra Automation​




Domain Purchase and Categorization Techniques​




Improve Phishing Email Writing Using Tools​




Delivering Emails in Inbox​


  • Method -1
  • Method - 2 (By Andre Rosario - From BreakDev Red Discord)
    • If you are having issues with delivering emails due to email filtering, consider using Microsoft 365 and Azure IPP to send encrypted emails to your targets!
      • Emails originate from legit Microsoft SMTP servers so they can't block it.
      • Targets who get the encrypted email are the only ones who can open it, if they forward it to their DFIR, they will have to login as that user to even see your message.
      • Easy orchestration in the Microsoft Admin portal of custom domains, create a ton of fake accounts.
      • M365 allows you to set arbitrary display names. So in a targets outlook the email can look like its from [email protected] but it's really from [email protected] (Technical people can easily figure this out though)
      • Emails come from legit Microsoft IPs and domains, so you don't have to worry about domain categorization or lifespan since it's Microsoft.
    • Steps
      1. Make an account with a Microsoft 365 Business Standard (or higher) license. (https://www.microsoft.com/en-us/microsoft-365/enterprise/office365-plans-and-pricing)
      2. Create a generic company name.
      3. Get a Azure Information Protection Premium P1 license to be able to use encryption. (https://support.microsoft.com/en-us...messages-373339cb-bf1a-4509-b296-802a39d801dc)
      4. Import your domain.
      5. Create a user with an email to your custom domain to send the phish and give it the M365 Business and Azure IPP P1 license.
      6. Draft your phishing message in Outlook online and press the encrypt button
      7. ????
      8. Profit
    • Screenshot
      Untitled
  • Random Tips to help getting emails in inbox.
    • Have domain with good reputation , Check domain categorization
    • Have a domain older than 1 year or use expireddomain
    • Have valid DKIM, DMARC, and SPF.
    • Add unsubscribe link in email
    • Send benign emails first (May help with reputation)
    • Have link in email with same domain which is being used to send email.
  • Blogs/Talks/References


Phishing Engagements With Evilginx​



Defense Tactics Against Evilginx​




Securing GoPhish Infra​


These modifications will also work in the latest evilginx + gophish version i.e evilginx3.3
Нажмите для раскрытия...

  • Tips : Use {{.URL}} parameter in phishing template while using with evilginx ( https://github.com/kgretzky/evilginx2/issues/1042#issuecomment-2052073864)
  • Modifications in gophish source code and file structure to Secure the GoPhish Infra
    • Remove X-Gophish instances ( X-Gophish-Contact , X-Gophish-Signature)
    • Remove const ServerName= "gophish" and change it to const ServerName= "IGNORE" in file config/config.go
    • Change the default Admin server port in config.json file.
    • Modify Test Email Message Signatures, To avoid detection during SMTP Testing. Controllers > api > util.go
      Controllers > api > util.go
      models > testdata > email_request.go
      models > testdata > email_request_test.go
      models > testdata > maillog.go
      models > testdata > maillog_test.go
      models > testdata > smtp_test.go

    • Change 404 response
      • Add below custom function in controllers/phish.go file
        func customNotFound(w http.ResponseWriter, r *http.Request) {
        http.Error(w, "Try again!", http.StatusNotFound)
        }

      • Now replace all instances of http.NotFound(w, r) to customNotFound(w, r)
    • Remove robots.txt hardcoded response and modify it in file controllers/phish.go
      • Modify the respective code in phish.go file to below one.
        //Modified Response
        // RobotsHandler prevents search engines, etc. from indexing phishing materials
        func (ps *PhishingServer) RobotsHandler(w http.ResponseWriter, r *http.Request) {
        fmt.Fprintln(w, "User-agent: *\\nDisallow: /*/*\\nDisallow: /.git/*")
        }
    • Modify the “rid” GET Parameter in requests
      • Make sure to modify all the instances of "rid" to something else.
      • These are also present in evilginx3.3 source code , So make sure to modify there as well.
    • For advance preventions, You can modify the static folder as well and rename it to something else, also rename the files inside it to avoid path based detection. Just do not forget to modify the relevance source code as well.
      • Like images name , example : pixel.png , modify it to something else.
    • Change the Certificate Properties in util/util.go file
      template := x509.Certificate{
      SerialNumber: serialNumber,
      Subject: pkix.Name{
      //Organization: []string{"Gophish"},
      Organization: []string{"Microsoft Corporation"},
      },

    • Use Nginx to proxy traffic through it to avoid any Golang Server Fingerprint
      • service nginx start
      • You need to change the gophish config.json to change the ports for http from 80 to 8080 and https from default to 60002, as shown below
        {
        "admin_server": {
        "listen_url": "127.0.0.1:60002",
        "use_tls": true,
        "cert_path": "gophish_admin.crt",
        "key_path": "gophish_admin.key",
        "trusted_origins": []
        },
        "phish_server": {
        "listen_url": "127.0.0.1:8080",
        "use_tls": false,
        "cert_path": "example.crt",
        "key_path": "example.key"
        },
        "db_name": "sqlite3",
        "db_path": "gophish.db",
        "migrations_prefix": "db/db_",
        "contact_address": "",
        "logging": {
        "filename": "",
        "level": ""
        }
        }

      • Below configuration will block all requests with user agent containing “Bot” or “bot”
        # /etc/nginx/nginx.conf

        events {
        # Define event processing parameters here
        worker_connections 1024; # Adjust according to your requirements
        }

        http {

        upstream backend {
        server localhost:8080;
        }
        # HTTP server
        server {
        listen 80 default_server;


        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
        return 403;
        }

        location / {
        proxy_pass <http://backend>;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        }
        }

        upstream backend_https {
        server localhost:60002;
        }
        # HTTPS server
        server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with "bot" or "Bot" in User-Agent
        if ($http_user_agent ~* (bot|Bot)) {
        return 403;
        }

        location / {
        proxy_pass https://backend_https;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        }
        }
        }


      • To allow specific user agent only, use below config. This will block all requests and only allow requests which has user agent “iamdevil”.
        # /etc/nginx/nginx.conf

        events {
        # Define event processing parameters here
        worker_connections 1024; # Adjust according to your requirements
        }

        http {

        upstream backend {
        server localhost:8080;
        }

        # HTTP server
        server {
        listen 80 default_server;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
        return 403;
        }

        location / {
        proxy_pass <http://backend>;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        }
        }

        upstream backend_https {
        server localhost:60002;
        }

        # HTTPS server
        server {
        listen 60001 ssl default_server;

        ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
        ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;

        # Reject requests with user agent other than "iamdevil"
        if ($http_user_agent != "iamdevil") {
        return 403;
        }

        location / {
        proxy_pass https://backend_https;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        }
        }
        }
    • Modify Gophish Tracking Pixel signature to avoid detection based on signatured tracking pixel.
    • Change the gophish email headers sequence pattern. It may be used to detect the gophish (From BreakDev Red Community).
  • https://edermi.github.io/post/2021/modding_gophish/
  • https://www.sprocketsecurity.com/re...-to-set-up-gophish-to-evade-security-controls
  • https://cyberwarfare.live/wp-content/uploads/2023/08/OPSEC-on-the-High-Seas_-A-Gophish-Adventure.pdf
  • https://www.sprocketsecurity.com/re...-to-set-up-gophish-to-evade-security-controls
  • https://github.com/puzzlepeaches/sneaky_gophish
  • https://cybercx.co.nz/blog/identifying-gophish-servers/
  • https://github.com/gophish/gophish/issues/1553#issuecomment-523969887


Other Techniques​


 
Войдите или зарегистрируйтесь для ответа.
Защита от мошенничества: Использование посредника минимизирует риски столкнуться с «продавцами-однодневками» или недобросовестными заказчиками, которые исчезают после получения предоплаты или результата работы.
Назад
Сверху