Evilblog

Cybercriminals have done a lot of damage to organization through Social Engineer Attack from FireEye to Cisco & recently Uber they all were hacked because of social engineering. This reminds me of my own internal pentesting in one of my organization which I did in 2021, I used social engineering technique to deliver and execute my payload. I was asked to check if I can gain access to any of our employee's computer using any method I can think of.  In this blog, I will simulate the same attack and will try to show how I gained initial access by using a social engineering technique.   Attack Phase 1: Information gathering As it was from internal network i decided to compromise one employee. Here the person is a network engineer. Before attacking the target i started the attack with information gathering. The first thing I started with checking all open port in my network range. To do this I used masscan, so i used command masscan -p445  192.168.7.1/24 --rate=1000  ...

This time I have decided not to phish the user’s password instead I will pwn his device. I will generate persistent spyware which will log target’s keystrokes, screenshots and webcam snapshots (if the user has a webcam) STEP1: Gathering information This step is about to gather information about my target, as my target does not has any computers knowledge coming from arts medium (from his Facebook profile) it is easy to phish him, but first I am going to gather information about what OS is he using, what version of the operating system he is running. So to do this I created an IP tracer that will gather his user-agent info, his current location(if he gives access), what device is he using. When he opens the link I got all the information I required to prepare my attack and saved everything on the log file. Below is a snapshot of his device details.   Now I know he is using windows 10 operating system so I can prepare my spyware keeping this information...

Its been a while since I posted my last post. So I decided to do a quick writeup on social engineering attack. I will show how easy it is to phish someone using a Good social engineering attack. I will try to make this post noob-friendly to proof that how easy it is for anyone with good social engineering skills but with little to zero technical knowledge can phish a user. Even though I am not an expert at soc engineering I was able to take down some accounts.  Attack scenario This time I decide to attack random people, this was to see how difficult or easy to phish some random people. Preparing the Attack First I need to make a fake Facebook profile and it’s better to not use those type of profile which could be easily reverse search like some celebrity photo etc, so I used “ thispersondoesnotexist.com ” which generate fake person pic using AI techniques every time you refresh the page, so it would be good the choice for making this type of f...