Nowadays, phishing attacks are increasingly sophisticated. Equipping yourself with knowledge to protect yourself and your organization is extremely necessary. Today, I will guide you how to participate in the course and receive a certificate Certified Phishing Prevention Specialist (CPPS) from the Academy Hack and Fix worth 20 USD but completely free thanks to a special discount code.

Introduction to the CPPS course

This course is designed to help you understand phishing attacks and how to avoid them. The main content you will learn includes:

• Definition of Phishing: Understand how attacks work in practice
• Typical examples: Analyze attacks via SMS, Email and social networks
• Prevention skills: The best security measures for individuals and organizations
• Suitable object: Students, beginners, IT professionals, DBAs or anyone who regularly uses the Internet and Email

How to register and apply 100% discount Coupon

Currently, the Certified Phishing Prevention Specialist certificate costs $20. To receive the course for $0, follow these steps:

Step 1: Visit our website Hack and Fix Academy, choose a course Certified Phishing Prevention Specialist (CPPS)

Step 2: Register an account by filling in your details or quickly log in via your Google account.

Step 3: At the checkout page, you will see the base price of 20 USD. Please enter the following Coupon code in the discount box:

Discount code: PHISHING100

Step 4: Click “Apply”, the price will be reduced 0 USD. Then, click “Place Order” to complete registration

Step 5: On the next page, fill in your personal information such as full name, email, and city address. Be sure to fill in the correct name so that the certificate shows your correct name. Then press Place order

Step 6: On the next page, press the button View

Step 7: Click Start Course to start learning

Study and certification exam process

After successful registration, you can start your certification journey immediately:

Study: You need to go through the entire curriculum that the academy provides, mastering the steps to prevent fraud.

Exam format: After completing the lesson content, you will participate in a multiple-choice test included 15 questions

Get certificate: If you pass the exam, you will receive an official digital certificate in your name (as shown in the video) to add to your portfolio or LinkedIn, giving you an advantage when applying for a job in the cybersecurity industry.

So I have guided you to take the Certified Phishing Prevention Specialist course and take the exam for free. Try to score 85% on the exam to receive this certificate.

If you don’t know the answer, you can refer to the answer here:

1.It requires users to verify their identity using an additional factor beyond passwords
2.
The sender’s email address

The generic greeting

The urgent language in the message

The suspicious link URL

3. All of the above

4. Hover over the link to check the actual URL

5.Ignore the message and contact your bank using a verified number

6. All of the above

7. The sender’s email address is suspiciously misspelled

8. To train employees to recognize and avoid phishing attempts

9. Conduct follow-up training sessions focused on identifying phishing red flags

10. A sender address that is slightly misspelled

11. Using the same password across multiple accounts

12. A highly targeted attack personalized for an individual or organization

13. Report the email to your IT or cybersecurity team

14. Confirm the caller’s details with the IRS using an official channel

15. Spam filters

If the certificate has the wrong name, go in Settings to change your name.

PyPhisher is an ultimate phishing tool in python. Includes popular sites like Facebook, Twitter, Instagram, Github, Reddit, Gmail and many more.

Disclaimer:

This tool is developed for educational purposes. It demonstrates how the scam works. If you want to gain unauthorized access to someone’s social media, you do so at your own risk. You are solely responsible and you must bear any damages or violations of law by this tool. The author is not responsible if you misuse PyPhisher for malicious purposes.

How to install PyPhisher

Install main dependencies (git and python):

• On Debian
  • sudo apt install git python -y
• On the Arch
  • sudo pacman -S git python --noconfirm
• On Fedora
  • sudo yum install git python -y
• On Termux
  • pkg install git python -y

Download the PyPhiser archive:

• git clone https://github.com/KasRoudra/PyPhisher

Access the just downloaded folder:

Run PyPhiser:

Or you can also directly with the command:

wget https://raw.githubusercontent.com/KasRoudra/PyPhisher/main/pyphisher.py && python3 pyphisher.py

Options:

Cách sử dụng: pyphisher.py [-h] [-p PORT] [-o OPTION]
                    [--update | --no-update]

Tuỳ chọn:
  -h, --help            hiển thị thông báo trợ giúp và thoát
  -p PORT, --port PORT  Cổng máy chủ của PyPhisher [ Mặc định : 8080 ]
  -o OPTION, --option OPTION
                        Chỉ mục mẫu của PyPhisher [ Mặc định : null ]
  --update, --no-update
                        Kiểm tra cập nhật (Mặc định : True)

PyPhiser Features

• Cross-platform (Supports most linux distributions)
• 65 website templates
• Dual tunnel (Ngrok and Cloudflared)
• Easy to use
• Possible error diagnostics
• Create url mask
• Customization of url
• Portable File (Can be run from any directory)
• Get IP Address and many other details along with login credentials

Request

• Python(3)
• PHP
• Curl
• Unzip
• Wget
• Capacity 100MB

If the above packages are not present, then all required packages will be installed on the first run.

How to use PyPhiser

I tested above WSL2 Ubuntu. Additionally, you can also test on a real Linux machine or use Termux on your phone.

Step 1: Install and run PyPhiser as I instructed above.

Step 2: Select the sample website you want to phish. I will choose number 1.

Step 3: After selecting, the tool will provide you with 4 fake website urls. You just need to give 1 of these 4 urls for the victim to click on.

Step 4: If you want to customize the url, press y. The first requirement is to enter the domain you want, I entered facebook.com. The second request is to enter the keyword you want to appear in the url, I enter login. And the tool will provide the url as below.

The website the victim visits will have the same interface as real Facebook. But if you pay close attention, the url will not be the same as real Facebook.

When I log in to the fake Facebook page, it will redirect me to the real Facebook password reset page.

And here is the result. This tool not only records the account and password that the victim enters, but it also provides the victim’s IP and some other information. But please note that the coordinate location will not be accurate.

Abusing the way Office 365 Outlook allows file attachments on the Cloud to disguise malicious code as a harmless file. In this article, we will explore how to abuse the Cloud file attachment feature Office 365 to make the executable (or any other file type) appear as a harmless attachment.

File attachment method

Office 365 allows you to upload attachments in one of two ways:

• Direct Attachments – Traditional way of uploading files. Severe restrictions on allowed file types.
• Cloud Attachments – Attach files available on the Cloud (OneDrive/SharePoint). File types are not restricted.

The image below shows how attachments appear to target users. The difference between these 2 types of attachments is the icon and link of the Cloud attachment below

We have seen the difference between the two methods above, now we will use the technique of attaching malicious files to the Cloud.

Condition

There are a few things you should do before proceeding:

1. Set up the domain and HTTP server. Since Cloud attachments show a partial association, you should create a subdomain like onedrive.microsoft. * To make attachments look less suspicious.

2. Store files on the server

3. Set up HTTP to redirect a path ending with a harmless extension (.txt, .pdf, .docx, etc.) to your malicious executable. This is extremely important because as we will see Office 365 chooses the icon of the attachment based on the file extension of the link. In my case, I will set up a redirect from /test/testfile.pdf to /evil.exe.

Attach malicious files

Compose an email to the victim, click the attachment icon > Browse Cloud Locations.

Next, choose any random file to attach. This file can be anything.

Make sure you select the ‘Share as a OneDrive link’ option. This is the option to attach files as cloud attachments.

Immediately intercept requests and modify location URLs. Set it as a harmless extension URL that redirects to a malicious file, in this case /test/testfile.pdf.

When the email is sent to the victim, all they see is a PDF attachment and they will have no reason to assume it’s malicious. But when the attachment is clicked, the malicious file is downloaded.

Conclude

This is a really useful technique when trying to gain initial access. An added benefit of using this technique is that the link is not scanned and thus increases the likelihood of the email reaching the victim’s inbox.

In addition, you can also attach the Virus contract to the Word file here.

Phishing tools are becoming more popular and dangerous than ever. Among these tools, Evilginx2 is one of the phishing tools developed to defraud users and collect their logins, passwords, including cookies and other personal information. .

With the development of technology and the ubiquity of using online services, it has become even more difficult to prevent these attacks. And Evilginx2 is one of the latest phishing tools to be born and is becoming a growing threat to network security. In this article, we will learn about Evilginx2, how it works and what measures we can take to protect ourselves from these phishing attacks!

Note: This article is for educational purposes only. Please do not perform cyberattacks. Any acts related to illegal, Anonyviet will not bear all such acts!

What is Evilginx2 Phising Tool?

Evilginx2 is a phishing attack tool developed by the author Gretzky. It allows attackers to create fake websites designed to defraud users and collect their logins, passwords, and other personal information. The tool is designed to attack highly secure online services, such as Gmail, Facebook, and online banking sites. Evilginx2 uses IP address navigation and creates fake websites exactly like the original ones.

How Evilginx2 Tool Works

Once the hacker has configured the phishing site, and sent the user this fake access website, Evilginx2 will intercept the network traffic and display a fake web page similar to the login page of the original web. The user will provide their login information on the fake page and Evilginx 2 will log this information.

The tool then redirects the user to the official login page of the original web, minimizing the possibility of detection. Not only that, it also uses sophisticated techniques to spoof the login sites, including the technique of creating a clone of the original website, using fake SSL certificates to create a secure connection. with fake websites and use browser deception techniques to block security warnings. Not only that, Evilginx2 uses techniques to fool two-factor authentication (2FA) means of online websites and applications.

2FA is a security technique where users must provide an additional factor other than a password to verify their identity, such as an authentication code (OTP) sent via text message or via a mobile application. motion. With Evilginx2, hackers can create a fake website to trick users into providing their 2FA credentials. Once the user provides this information, Evilginx2 will take it and use it to log into the user’s account on the real website. So you can see that it can have extremely serious consequences. And that’s how it works, now Anonyviet demo shows you how its consequences are! Let’s go

Demo of phishing attack with Evilginx2 . tool

Before entering the attack, Anonyviet has prepared a linux vps server, and a free domain name taken from Freenom and this domain is named nhaquamienphi.cf. After obtaining the above, Anonyviet configures the following:

Anonyviet will access the linux vps via ssh, then get the VPS’s IP address

After getting the IP address, I will now configure the domain as follows:

I created 2 nameservers that are ns1.nhanquamienphi.cf and ns2.nhanquamienphi.cf and point ip of vps

Next, Anonyviet pointed the previous 2 nameservers to the domain

That’s it, now proceed to install the Evilginx2 phishing tool with the following commands:

wget https://github.com/kgretzky/evilginx2/releases/download/2.4.0/evilginx-linux-amd64.tar.gz
tar zxvf evilginx-linux-amd64.tar.gz
cd evilginx
chmod 700 ./install.sh
sudo ./install.sh

Once installed, you just need to enter the command sudo evilginx to start the tool and configure the address IP, Domain and redirect url

The syntax of the command is as follows:

-Configure IP address: config ip <YourIP>

-Configure the domain: config domain <YourDomain>

-Configure redirect url: config redirect_url <YourUrl>

Next, we set up a fake website that Evilginx2 supports, in this case we create a phishing web page to log in to the user’s outlook account. The command syntax is as follows:

-Set up the web: phishlets hostname <phishlet> <YourDomain>

-Create link: lures create <phishlet>

–Edit path: lures edit <id> path <path>

–Create redirect link when user successfully login: lures edit <id> redirect_url <YourUrl>

Now, I get the link and start the attack. The syntax is as follows:

–Get phishing link: lures get-url <id>

–Enable web phishing: phishlets enable <phishlet>

Upon successful activation, we have a message about SSL / TLS certificate setup. Now Anonyviet access the link just created and let’s see the results together

Thus, we can see that the login interface is identical to Microsoft’s, even the web effect is the same, but only the domain name is different :>

I will enter Email into phising web then click continue

Cha Cha! Anonyviet tries to enter the wrong password, it also says wrong, make sure you enter the correct password, it will redirect to the url you set up before

So I have successfully logged in, when I click Yes it redirects to the url I set earlier.

And this is the result:

As we can see, not only does it get the user’s password, Evilginx2 also provides Cookie, the victim’s IP address. And I also tried copying the victim’s Cookie and using the Cookie Editor extension on Chrome to log in to the victim’s account without using Email and Password.

How to prevent the Evilginx2 phishing tool

To protect against Evilginx2, websites and online applications should adopt appropriate security measures, such as using stronger two-factor authentication techniques, or using multi-layer security solutions to prevent block impactful attacks.

System administrators also need to keep their security software up to date and watch for signs of attacks to prevent Evilginx2 from entering. Users can also protect themselves from Evilginx2 attacks by using personal security solutions, such as using strong passwords, using stronger authentication applications, and not providing information credentials and authentication for any fake websites.

However, I find the prevention of Evilginx2 is not simple. Hackers are always looking for ways to access users’ personal information and circumvent security measures. Therefore, increasing security and raising awareness about cybersecurity is essential to protect our personal information.

Modern security tools can help users detect Evilginx2 attacks and others, but that’s only part of the solution. To ensure the safety of their personal information and online accounts, users need to make smart decisions about the use and sharing of their personal information.

Conclusion about the Evilginx2 phishing tool

Anonyviet sees the Evilginx2 tool as one of the dangers to users, with its ability to create phishing sites to fool users into providing credentials and logging into accounts. Evilginx2 threatens the security of websites and online applications, as well as users’ personal information. I hope that in the future, increased awareness of cyber security will be essential to protect our personal information. Online websites and applications also need to continuously improve their security to prevent attacks by Evilginx2 and other similar tools. Only when everyone works together to keep our personal information safe can we achieve this goal.

We have learned about the Evilginx2 tool and how it is used to perform phishing attacks, and you have also clearly seen the power and danger of this tool for personal and financial security. our online account. It is essential to put in place security measures for personal information to protect yourself against attacks by Evilginx2 and other tools. However, user awareness and responsibility are also important in reducing the risk of attack!

Goodbye ! Have a nice day!

You can also read more articles Beware of Phishing form clicking some Links but accessing other links