Credential harvesting
In this post the term of credential harvesting will be explained and demonstrated through the example using some of the most widespread social engineering and penetration testing tools. In the first part of this post readers will be introduced to importance and dangers of credential harvesting. In the second part penetration testing tools and their possibilities will be explained and awareness of their big abuse potential should be increased. In the third part you should become familiarized with a powerful tool named SIT (Social engineering toolkit). In the final part website cloning process using Social engineering toolkit will be explained in several easy steps and simulation of phishing attack will be executed.
Introduction to credential harvesting
The most common goal of phishing is tricking victims into providing their passwords or credentials without even being aware of it before it�s too late to save their account or confidential data. The term credential harvesting also called account harvesting refers to the attacking technique or activities of grabbing legitimate user ID and even passwords to gain access to target systems for illegal or malicious purposes. There are several world famous Internet services like Facebook, Youtube, Ebay or Gmail that make the most of our virtual lives and hijacking those accounts could have a negative impact on person�s real life and benefit greatly to an attacker who steals their data. More than 600000 Facebook profiles are hacked every day, which means that someones Facebook account is compromised every 140 miliseconds.
Penetration testing tools
Many penetration testing tools are used to educate people about social engineering techniques, problems and possibilities and to check every system�s security weaknesses. Although programmers who develop that type of software usually disclaim of all illegal activities that could occur as a result of their usage, like on this website, those tools are often used by computer criminals for social hacking and performing frauds. Becoming familiar with those possibilities could protect some people from being victims of those activities. The easiest way to steal someone�s credentials is making an exact copy of some legitimate website. A user of the genuine website like Facebook, Gmail or Youtube almost can not see any difference between those two websites, unless they spot a different url which doesn�t belong to a genuine web location. For all those reasons it is imperative to educate your users or employees about Social Engineering attacks and how to defend against them. This kind of practice needs to be introduced in all world companies that use Internet technology in their business. A good example of penetration testing tool is Metasploit http://www.rapid7.com/products/metasploit/which can be used to simulate real-world attacks and find your weak points before a malicious attacker does. In addition, it can simulate phishing campaigns while improving security awareness by redirecting users to training after they take a dangerous action.
Social engineering toolkit (SET)
The Social-Engineering Toolkit (SET) is a python-driven suite of custom tools which solely focuses on attacking the human element of penetration testing. Its main purpose is to augment and simulate social-engineering attacks and allow the tester to effectively test how a targeted attack may succeed using completed templates and preprogrammed procedures that can be customised and combined in many ways in order to perform credential harvesting.
Cloning a website
The process of cloning a website is described here.
In SET (Social engineering toolkit) menu select �Social Engineering Attacks�, choose �Website Attack Vectors� option and finally �Credential Harvester Attack Method�.
As shown on figure one, you will have the option to use a web template that will create a generic website for you to use, you can import a webpage to use, or clone an existing website. After you choose to clone a site, you will have a choice between Java Required, Gmail, Google, Facebook and Twitter website. In this example Web templates option will be used with Gmail service to obtain Gmail password of a random target. SET comes with templates for several popular programs. Once you select one of the templates, you will be given a short message about username and password form fields. Press �return� and Social engineering toolkit will create a fake website using the template that you chose, and prepare to harvest any credentials that a potential victim would enter on the fake website. When the victim accesses his machine and surfs to the Social Engineering Toolkit created webpage he will see an identical interface of a Gmail application and login without being aware of a consequence (Figure 2).
Figure 2: Fake Gmail interface
Once it enters its user name and password on that fake site, its credentials are harvested and collected on the SET BackTrack system, e.g. when user Security+Joe whose password is P@$$WORd! enters his credentials this log will be displayed. As you can see on Figure 3, "POSSIBLE USERNAME FIELD FOUND: Email=Security+Joe" and "POSSIBLE PASSWORD FIELD FOUND: P@$$WORd" outputs are displayed, enabling you to find out the credentials of a certain user who logged in.
Figure 3: Phishing result log
Once an attacker pressed Control-C harvesting will be stopped and the report file will be stored in the SET file directory under Reports. Two reports are created, one in html and one in XML as a final result of an attack. Figure 4 shows the html report where a term of social engineering is shown and report statistics are given, telling you how many users visited your website and how many of them fell for the attack and for every of those victims different parameters including username and password are displayed. This proccess proves how powerful tool SET is and how much can it benefit to our knowledge of social engineering dangers.
download file now