In this tutorial, you’ll learn the dangers of phishing and see how easy it is to create a fake phishing website that can steal the login credentials from social media accounts. To demonstrate the attack I will use a tool called Zphisher.
For those who don’t know Zphisher is an easy-to-use phishing tool developed to demonstrate phishing on different social media websites.
It comprises more than 30+ templates of various websites which you can choose to perform your attack. So let’s go ahead and perform the phishing attack.
Install Zphiser
First, you need to clone Zphisher by using the following command.
git clone https://github.com/htr-tech/zphisher
Now go to the cloned directory and run zphisher.sh
cd zphiser
./zphiser.sh
As shown in the image above, you have over 30 platform templates available on Zphisher ready to launch phishing attacks. For this example, I will use the Instagram template by typing number 2.
Here I will use the first option “Traditional Login Page”.
It will ask you to choose which port forwarding service you want to use. In my case, I will use Cloudflared by typing number 2.
After setting up, the script will present three links. At this point, you need to send the first link to the victim. The link is suspicious, so you can hide it behind some text as a hyperlink or embed the link into a login button.
When the victim clicks on the phishing link, an Instagram login page will be prompted to him.
Let’s say he will enter ‘john@gmail.com’ for the email and ‘letmein888’ for the password, and click Log in.
Once they execute it, I will receive their login information on Zphiser, while the victim will be redirected to the original Instagram login page.
Conclusion
This type of phishing attack can be prevented by first looking at the link, how the URL is formed, and whether is it something official and real or it seems a bit shady.
Also, be very suspicious of any emails you receive, if the email contains a link, don’t click on it. Deceptive links that mimic legitimate URL addresses are common tools con artists use in phishing scams.
While these addresses may look official, they contain some links which are from the attacker's website. Instead of clicking on the link, type in the web address to access the website.
Note: Please know that all the information is used to expand knowledge and not for causing malicious or damaging attacks.
Tags: cybersecurity training, network security courses, ethical hacking tutorials, web penetration testing, linux security training, online cybersecurity classes, wireless network security, learn ethical hacking online, linux for cybersecurity professionals.