Phishing

What is Phishing?

The attempt of fraud in which the attacker tries to learn sensitive information such as login details or credit card details by impersonating as a reputable entity in telecommunication like email, IM or any other media.
This is an example of social engineering techniques used to deceive users and exploits weaknesses in current web security.
Attackers do so by sending emails or creating web pages that exactly look like legitimate companies. Once the users trust these and enter their personal information attackers will use this information for identity theft.

What phishing email looks like?



What phishing website looks like?















Example of attracting the victim..
  • By sending emails mentioning about special offers/discounts
  • By sending google forums to fill (They will tell you fill this servery by logging into Facebook/gmail )
  • By sending messages/ emails mentioning expiration of account like ebay/paypal etc.

How to identify a phishing email?
  • If an e-mail requests an immediate response or a specific deadline, for an example, in the above example, the requirement to log in and change your account information within 24 hours.
  • If the attacker not specially targeting a person or a company he/she have no idea who you are. So, the email would not contain your account or username in it. In the above example, the e-mail just says "Dear eBay Member", if this was eBay they would mention your username.
  • Most of these will have a URL that is not related to the company's URL but looks like. These emails are getting better at hiding the true URL. In the above example, it seems to point to the official website. But this is only the link text but not the link itself. If you move your mouse over the link you will see the link address and not the link text. No company would link to an IP address.
  • By looking for obvious spelling and grammar mistakes.

How to identify a phishing website?

You can identify phishing website by looking at the URL. So once you go the website through a another link(without typing the URL on the search bar) which is included in a email or message you should care about.

if you are not sure if an e-mail is official....

  • Never follow any links in an email. Instead visit the page by manually typing the address of the company.
  • Never send any personal information through e-mail. Instead visit the company web site and log into the account as you normally would and change your information if it is required.
  • Contact the company through email or live chat asking about your email.
What to do if you have already fallen for a phishing attack?
  • Log into your account from the official company site and change your password immediately.
  • Scan your computer for malware in the case of your computer has been infected by the fake site.

 Do you like to create a phishing website? ;)
Let's try 
Create a Facebook Phishing site

Comments

Post a Comment

Popular posts from this blog

Introduction to Encryption

Image
What is Encryption? Encryption is like sending secret messages between parties; if someone tries to pry without the proper keys, they won't be able to understand the message. In other words, it is the process of locking up information using cryptography (Cryptography is both the practice and the study of hiding information.) Definition:  ‘ The Process of converting plain text into cipher text, something that appears to be random and meaningless ’ is called as the encryption. Process of converting cipher text back into original text is called as decryption . Terminology Original message is called as plain text/clear text.   Encrypted message is called as cipher text/encrypted text.  A Key which is a secret like a password which is used to encrypt and decrypt information.  Ciphers are the specific algorithms which are used to encrypt and decrypt data. A cipher is series of well-defined steps that can be followed as a procedure to encrypt and decrypt m
Read more

RESTful API

Image
RESTful APIs are application programming interfaces (API) that adhere to architectural style of REST architectural pattern and it is used to HTTP requests to GET, PUT, POST and DELETE data. RESTful API has the following features: Those are the guiding constraints which define a RESTful system. Client–server - The client handles the front end the server handles the backend and can both be replaced independently of each other. Stateless - No client data is stored on the server between requests and session state is stored on the client. Cacheable - Clients can cache response (just like browsers caching static elements of a web page) to improve performance. Uniform Interface - The key to the decoupling client from server is having a uniform interface that allows independent evolution of the application without having the application’s services, or models and actions, tightly coupled to the API layer itself. Layered System - REST APIs have different layers of their a
Read more

How to do a Phishing attack on Facebook?

Image
This is a Step by step tutorial to make an undetectable Facebook phishing site. Step 1: Download page source Go to https://www.facebook.com Right click on the blank area -> Click Save As When dialog box appears select ‘Webpage, complete’ as Save as type -> Click Save Step 2: Edit “Facebook - Log In or Sign Up.html” file and rename it. Open ‘Facebook - Log In or Sign Up.html’ file with notepad or Dreamweaver. Remove all the ajax codes. (You can download HTML file which removed all ajax codes form here https://github.com/nimeshikaranasinghe/Facebook-Phisihing.git   ) Search for login action (Press Ctrl + F -> type ‘ action= ’ -> Click Find Next) Replace the highlighted part (as in the following screenshot) with getDetails.php Save the file as index.html Step 3: Create getDetails.php Open a notepad. Type the following code <?php             $username = $_POS
Read more