Phishing for a Living


Have you considered !

  • Avoid the classics

    • Urgent

    • Problem to fix (unpaid invoice, hotel bill, acct. compromise).

      • Making the request too important or urgent raises suspicion and decreases the odds of user compliance since these tactics are hammered in modern Security Awareness training (yes, people will still click, but not as many).

  • Embrace Subtlety and Play Hard to Get

    • Signature format, company fonts, colors, match everything up to build trust levels

      • E-mail HR or someone else from company with a normal question, wait for their reply, then collect above items

  • Emotions without Urgency

    • Normalcy and trust must be intertwined with the emotion you choose to target (RARELY make specific requests in the message body, remember that if they're interested they're going to click). An obvious request is a low-level neurological alert that the sender wants something.

    • Expected Routines are your best friend

    • Always pose as Company, Vendor or Client

      • They're looking for the unexpected, make it expected

      • What kind of internal memos are typical for companies?

      • What events/projects are on the horizon?

      • New (but real) technologies, standards, changes

  • Don't be Lazy - This Means OSINT until the cows come home

    • Company web sites are like credential dumps for social engineers

      • Same goes for their supply chain

  • Use OSINT to Target Departments rather than Individuals

    • Don't always do this if you have good intel on someone, but odds of a click go way up

    • What does HR, Dev, Customer Support, Sales, and hey, even IT Departments, want?

      • Avoid IT if possible, for obvious reasons, and they're typically more savvy.

  • Credential Harvesting is Preferable

    • Filter URL detonation detects at lower rates than file detonation

    • URL filters aren't even used by many companies still, or are just behind (think Microsoft)

      • Send early morning, keep the harvesting page clean for 30 min to an hour, give it time to pass through the company's servers/filters, then add the collecting code afterward). If the filter re-checks the url's after delivery, it could still be pulled from the user's inbox, but at least you're granted more time for the employee to click.

Making it past filters is simply understanding what the machine wants (Older domain, SPF/DMARC, no language patterns typical of phishing, and more). Many spam/filter/firewall companies publish their pattern detection, or find open source like spam assassin since many of them use it anyway.

Many would qualify this as a spearphish, but we need to move away from the idea that a little homework is highly sophisticated. Real SpearPhishing is months of work, more subtlety, and even more patience.

Obviously it's easier to get past a filter if you have a real, compromised vendor/client account. But we're phishing (pentesting) for good, not evil.

Introductory level concepts here, not covering the technical aspects.

Hope this helps all my fellow Phisherman. Good luck making the world a better and safer place.

May I add that camDown helps stop hackers from getting access to the webcam that I use for my work. Now I can get even more gigs as a freelancer and advertise that I have top security with my home computer and your smart friends would say the same!