Null meetup phishing decoded 24-08

Transcript

1. August 24, 2024 Null Pune 10:00 AM - 1:00 PM PHISHING DECODED Everything about phishing
2. About Myself Threat Researcher @BforeAI Aadesh Shinde Other areas: Incident response & Soc
3. FLOW Phishing Domains What exactly? Lets Hunt! Protect, Detect, Mitigate TI? Schedule
4. Keep it simple & it’ll be easy
5. Phishing Based on Delivery (Email phishing, smishing, vishing ) Target/Victim (Spear P., Whaling) Secondary method (Pharming, pop-up)
6. IP Domain URL Basics
7. TLD? Generic .com, .org, .net CC .in, .ca, .uk Sponsered .edu, .gov
8. Structure
9. Records?
10. Domain Status Clienthold - Registrar Serverhold - Registry Inactive
11. What exactly it is?
14. Identify src: https://huskyscripts.blog/hunting-phishing-urls-101/
15. Phishing Kit
16. Campaign ourteam-supportmeta.com
17. Let’s Hunt! CT logs 1. Certificate Transparency (CT) logs are public databases of every HTTPS certificate issued by publicly-trusted Certificate Authorities
18. More specific search
19. Pivoting File based Hash Based URL scan
20. Phishing Kit github.com/0xDanielLopez/phishing_kits
21. More specific https://phish.report/docs/iok-rule-reference iok.dev
22. Let’s find something now hbsales.onrender.com - the template used for pages
23. But what about Defense Install beacon assets src: https://phish.report/blog/a-startups-guide-to-phishing-and-brand-protection
24. JS Beacons All you need is an endpoint which will raise an alert, and a small snippet to make a request to that endpoint: if (document.domain != "login.brand.com") { var l = location.href; var r = document.referrer; var m = new Image(); m.src = "https://brand.com/your-alerting-endpoint?l="+ encodeURI(l) + "&r=" + encodeURI(r); } https://docs.canarytokens.org/guide/cloned-web-token.html
25. css beacons
26. css beacons .some-innocuous-element { background-image: url("https://brand.com/your-alerts-endpoint.png") }
27. Entropy strings Attacker knows beacons..!
28. Version control references For example, the Monzo website embeds the git commit hash using a small JavaScript snippet: var GIT_COMMIT = '444d069468754a26ff2b59495dd71b199a5d6941'; var GIT_BRANCH = 'master';
29. Subresource Integrity hashes As an example, here's how a website might use Subresource Integrity for its CSS: <link href="/assets/css/stylesheet.min.css" integrity="sha256- +vw3Nb9LyQVDfQI46GQGsC4LuwraLFAN7UNGyt0Nzag=" as="style">
30. Let’s make a strategy for your company Is my brand going to be impersonated? If yes then Understand how your brand will be impersonated
31. Install beacon assets Embed high-entropy strings Don't be generic Harden your pages against cloning
32. Detect & Mitigate? Hoster Registrar Registry VT security platforms & vendors
33. Questions
34. Thank you! LET’S CONNECT AADESH SHINDE