Alongside, OSINT techniques will be presented, to show how much information can be gathered from public sources and how it can be used by adversaries during the attacks.Successful campaigns use custom payloads, delivery methods and templates, so you will also learn techniques to create them on your own.
Red team and blue team members, enterprise administrators, infrastructure architects, security professionals, systems engineers, network administrators, IT professionals, security consultants and other people responsible for implementing network and perimeter security.
To attend this training, you should have an open and creative mind. Basic scripting skills and good knowledge of Windows and Linux platforms is required.
- Gather intel necessary to assess the target;
- Use the most advanced delivery methods of today;
- Create your own payloads and control them;
- Design convincing and realistic templates;
- Evaluate campaign results.
- Phishing is one of the oldest forms of hacking. In this module, we will briefly mention famous cases from the past, explain impact of phishing on the security industry and introduce current threats.
- The OSINT reconnaissance is used by the attacker to gather information about the target before the actual attack starts. Although it’s always critical step in any attack, reconnaissance is especially important in phishing campaigns as they require precise knowledge about company’s internal processes, employees and used technologies.
- 1. Google Hacking
- 2. DNS reconnaissance
- 3. Data mining from Git and social media
- 4. OSINT framework
- 5. Shodan
- Phishing attacks tend to use broad scope of techniques and are targeting companies regardless of the size and industry. The goal of the campaign may be to get into the network, to spread malicious ransomware or to steal company secrets. Due to the unique nature of the phishing campaigns, in this module we will analyze the most devastating attacks from the past and discuss why they were successful.
- 1. Stuxnet
- 2. NotPetya
- 3. Crying kids / Hacking humans
- 4. Caller ID and SMS spoofing
- 5. Usage of Artificial Intelligence in voice and face impersonation
- Once adversary finished the OSINT and targeted the victims, it’s time for the first phase of the attack – payload delivery. During this module we will have a deep look on the techniques used by the adversaries in the wild.
- 1. Email as phishing tool
- 2. Whaling and spear phishing
- 3. Hacking gadgets
- 4. Web based attacks
- 5. Mobile based attacks
- Focus of this module is aimed at various payloads which are commonly used by adversaries. All attacks have different goals and exploit the victim in several different ways.
- 1. Dangerous file types
- 2. Office macros
- 3. Potential impact
- 4. Whitelisting end evasion techniques
- Fundamental part of every phishing campaign is to trick victims into believing that malicious link or file is coming from trusted source. In order to do that, adversaries need to use well designed email or web pages. In this module we will present techniques and frameworks used to achieve exactly that.
- 1. Phishing emails
- 2. Cloning web pages
- 3. Backdooring thick clients
- After successful campaign it’s time to analyze the gathered data and statistics. There are bad and good ways of how to react after the phishing campaign, it’s crucial to present the results without shaming the employees but at the same time found issues must be properly addressed and resolved.
- 1. Evaluating campaign results
- 2. Creating meaningful report
- 3. Mitigating attack vectors
- 4. Educating people
- There is nothing more important than a well guided hand-on experience, therefore in this module you will get familiar with our favorite phishing frameworks and learn to use them to create your own campaign. We will cover multiple real-life scenarios which we’ve seen in the field performed by various adversaries.
- 1. How to perform phishing campaign with Social engineering toolkit and Gophish
- 2. Jumping into the victim’s shoes and seeing analyzing the outcome from their perspective
- Phishing campaign often improves security and teaches users common attack vectors. In this super exciting hands-on (or watch-me) module, we will present how GoPhish or other tools are used to create the entire phishing campaign. We will use everything we have learnt so far to finally create an entire campaign with dedicated framework.
Author’s unique tools, presentation slides with notes.
CPE Point (Continuing professional education)
It will be possible to earn CPE points after completion this course.
Har du faglige spørgsmål, så kontakt:
- Jette Ravn Merkel
- +45 72202695