Må vi gemme en cookie?

Vi bruger cookies for at forbedre din oplevelse af vores hjemmeside, målrette indhold samt statistik. Læs mere om cookies

Kurser

Kursusadministration

Brug for hjælp?

  • Gregersensvej 8
  • 2630 Taastrup
Google MapsApple MapsRejseplanen
  • Forskerparken Fyn, Forskerparken 10F
  • 5230 Odense M
Google MapsApple MapsRejseplanen
  • Teknologiparken Kongsvang Allé 29
  • 8000 Aarhus C
Google MapsApple MapsRejseplanen
  • NordsøcentretPostboks 104
  • 9850Hirtshals
Google MapsApple MapsRejseplanen
  • Gammel Ålbovej 1
  • 6092Sønder Stenderup
Google MapsApple MapsRejseplanen

Masterclass: Security Awareness – Recipe for a Successful Phishing Campaign

Bliv fortrolig med succesfulde phishing-kampagner. Lær at opbygge effektive phishing kampagner for at øge kendskabet til cybersikkerhed i virksomheden. Vi bruger tid på at analysere de indsamlede data og statistikker. Du vil skabe og eksekvere egne skræddersyede kampagner, sidst på kurset.

Alongside, OSINT techniques will be presented, to show how much information can be gathered from public sources and how it can be used by adversaries during the attacks.Successful campaigns use custom payloads, delivery methods and templates, so you will also learn techniques to create them on your own.

Participant Profil

Red team and blue team members, enterprise administrators, infrastructure architects, security professionals, systems engineers, network administrators, IT professionals, security consultants and other people responsible for implementing network and perimeter security.

Prerequisites

To attend this training, you should have an open and creative mind. Basic scripting skills and good knowledge of Windows and Linux platforms is required.

Outcome

  • Gather intel necessary to assess the target;
  • Use the most advanced delivery methods of today;
  • Create your own payloads and control them;
  • Design convincing and realistic templates;
  • Evaluate campaign results.

Content

Module 1: Introduction to Phishing
  • Phishing is one of the oldest forms of hacking. In this module, we will briefly mention famous cases from the past, explain impact of phishing on the security industry and introduce current threats.
Module 2: Open-source intelligence (OSINT)
  • The OSINT reconnaissance is used by the attacker to gather information about the target before the actual attack starts. Although it’s always critical step in any attack, reconnaissance is especially important in phishing campaigns as they require precise knowledge about company’s internal processes, employees and used technologies.
  • 1. Google Hacking
  • 2. DNS reconnaissance
  • 3. Data mining from Git and social media
  • 4. OSINT framework
  • 5. Shodan
Module 3: Case studies
  • Phishing attacks tend to use broad scope of techniques and are targeting companies regardless of the size and industry. The goal of the campaign may be to get into the network, to spread malicious ransomware or to steal company secrets. Due to the unique nature of the phishing campaigns, in this module we will analyze the most devastating attacks from the past and discuss why they were successful.
  • 1. Stuxnet
  • 2. NotPetya
  • 3. Crying kids / Hacking humans
  • 4. Caller ID and SMS spoofing
  • 5. Usage of Artificial Intelligence in voice and face impersonation
Module 4: Delivery phase
  • Once adversary finished the OSINT and targeted the victims, it’s time for the first phase of the attack – payload delivery. During this module we will have a deep look on the techniques used by the adversaries in the wild.
  • 1. Email as phishing tool
  • 2. Whaling and spear phishing
  • 3. Hacking gadgets
  • 4. Web based attacks
  • 5. Mobile based attacks
Module 5: Building Malicious Payloads
  • Focus of this module is aimed at various payloads which are commonly used by adversaries. All attacks have different goals and exploit the victim in several different ways.
  • 1. Dangerous file types
  • 2. Office macros
  • 3. Potential impact
  • 4. Whitelisting end evasion techniques
Module 6: Custom attacks
  • Fundamental part of every phishing campaign is to trick victims into believing that malicious link or file is coming from trusted source. In order to do that, adversaries need to use well designed email or web pages. In this module we will present techniques and frameworks used to achieve exactly that.
  • 1. Phishing emails
  • 2. Cloning web pages
  • 3. Backdooring thick clients
Module 7: Measuring and gathering results of the campaign
  • After successful campaign it’s time to analyze the gathered data and statistics. There are bad and good ways of how to react after the phishing campaign, it’s crucial to present the results without shaming the employees but at the same time found issues must be properly addressed and resolved.
  • 1. Evaluating campaign results
  • 2. Creating meaningful report
  • 3. Mitigating attack vectors
  • 4. Educating people
Module 8: Phishing frameworks
  • There is nothing more important than a well guided hand-on experience, therefore in this module you will get familiar with our favorite phishing frameworks and learn to use them to create your own campaign. We will cover multiple real-life scenarios which we’ve seen in the field performed by various adversaries.
  • 1. How to perform phishing campaign with Social engineering toolkit and Gophish
  • 2. Jumping into the victim’s shoes and seeing analyzing the outcome from their perspective
Module 9: Building a Phishing Campaign
  • Phishing campaign often improves security and teaches users common attack vectors. In this super exciting hands-on (or watch-me) module, we will present how GoPhish or other tools are used to create the entire phishing campaign. We will use everything we have learnt so far to finally create an entire campaign with dedicated framework.

Material

Author’s unique tools, presentation slides with notes.

CPE Point (Continuing professional education)

It will be possible to earn CPE points after completion this course.

Instructor

Piasecki
Milosz Piasecki is CQURE’s prodigy Cybersecurity Specialist and aspiring team leader with his main focus being programming, networking and most of all Windows security. Milosz is an enthusiastic, hard-working individual with an interest in social engineering, penetration testing, cryptography and virtualization-based technologies. At CQURE his is also responsible for demos design and creation, building virtual labs and developing scripts. Privately Milosz is interested in social influence mechanisms, enjoys travelling, skiing, motorcycling and archery

or

Mike
Mike Jankowski-Lorek is a solution architect, developer, data scientist and security expert with more than 12-years’ experience in the field. He designs and implements solutions for Databases, Network & Identity Management area, mainly for Microsoft platform for medium to enterprise level organizations. Mike holds multiple certifications, especially security, database and software development related. He is one of core Experts at CQURE – worldwide known cyber security company. He holds PhD degree in Computer Science.

Har du faglige spørgsmål, så kontakt:
Andre kigger også på