· 8 years ago · Dec 13, 2017, 11:38 AM
1sbi bank
2
3haveibeenpwned.com
4
5Phishing
6========
7
8Phishing is a fraudulent attempt, usually made through email, phone calls, SMS etc seeking your personal and confidential information.
9
10Phishing page looks similar to genuine page, but its work is something different.
11
12
13How such pages are created:;
14
15facebook.com
16
17Step 1: Open Genuine login page
18
19Step 2: Right Click -> save as ->
20
21C:\Xampp\htdocs\fb\
22
23index.html
24
25Step 3: open index.html with Notepad
26
27Step 4: Search (crtl+f) -> action=
28
29
30Step 5: action="https://www.********"
31
32Step 6: action="post.php"
33
34Step 7: Save file
35
36Step 8: Place post.php file in same folder (C:\Xampp\htdocs\fb\)
37
38Browser:
39
40127.0.0.1/fb/index.html
41
42localhost/fb/index.html
43
44PrivateIP/fb/index.html <--- Open Phishing page in same network on diff. machine
45
46privateip -> cmd -. ipconfig/ifconfig
47
48
49Detection: Phishing page will always have differnt url | domain name. This can never be same as of origional one.
50
51Social Engineering
52===================
53
54Hacking without Tools
55
56Spear Phishing
57==============
58
59security@facebook.com
60
61Hi Aniket
62
63Your account is logged in from Russia (45.76.8.90)
64If u want to stop it, click on link below
65
66www.facebook.com/security
67
68-
69Facebook Team
70
71
72IDN Homograph Attack
73====================
74
75
76google.com
77lucideus.com
78palvinder.com
79
80godaddy.com
81
82
83english - abcd
84hindi - kk
85punjabi -
86sanskrit
87haryanvi
88bhojpuri
89
90
91russian langugae -> cylliric script -
92
93This language is having almost every character similar to english, (Only by look)
94But there meaning is something different
95
96
97Fake Mailer
98============
99
100
101aniket@gmail.com
102
103emkei.cz <---
104
105
106Mail Box ->
107@Gmail.com -> emkei.cz
108
109@ymail.com
110
111@lpu.ac.in
112
113
114Email Tracing
115=============
116
117Header Analysis <---
118
119Email send -> Source IP
120
121Open a mail -> Show option -> Show Header | Show Origional
122
123recieved from : ip
124
125
126
127
128
129
130
131
132
133
134gmail.com