Original subtitles

In this section I will focus more about the tools that can be used in social engineering.

It's not really an attack S. But it will show you that you should not trust anything.

Email can be spoofed as M.S. can be spoof Mumbai or a cellular number can be spoofed.

So my point is people trust e-mailed blindly they receive an e-mail coming from their manager.

They will execute whatever is inside.

They will never think that men can be spoofed or fake.

Same concept apply for.

You receive an m s s m s from your bank.

You think it cannot be fixed.

It can be fixed mobile number it can be checked so it's not really an attack S. S. It's more into the

tools that is used into the attic.

So if a malicious hacker utilize such tools it would be very easy for him to convince anyone to do anything

that you want him to do.

So if I sent an email coming from your friend or from your manager.

If you don't have enough background or you are not aware enough you may be spoofed by this email and

you will trust that the email is coming from this sender.

So the first then I want to show you it's the spoofed website or the fake I'm sorry the spoofed email

or the fake email.

If you search on Google for fake email you will see this specific website.

This is a quite interesting website.

It's FREE.

It's very effective.

Most probably it will go to your inbox if you don't have a proper mail setting it may go to the junk

but it may go to the inbox you can test it.

You can fake an email showing it's coming from anyone to anyone and you can attach whatever you want

you can send it in a text or as an etch TMLC it will shows like you know the message coming from Linked-In

or from Twitters or this kind of thing.

So using such a tool it's very very convenient and the noise they are keeping such website up and running

because actually this is very dangerous.

So let's try them here.

I'm going to send the mail.

That choice coming from John Smith's and I'm going to put an email or let's make it a let's make a mess

and Zamir will be coming from John Smith's ABC dot com you can put anything you want.

I can type this mess

she Smyth's

at Princeton as and dot com and we're going to send this e-mail to myself.

I'm going to send it to different email.

So let's try it was the emails that I'm using on my this thing MacBain and started at 3 AM talk of

at g m x dot com.

You the next.

And that's why any such book as you made.

Let me put any trust in me.

OK.

So the point is that can I if an email or not.

Let's see.

And I'm Robert

and let's send it now he's saying this e-mail has been successfully sent.

Let's see is this is a case.

I'm going to get to my mobile phone.

Now this can be used on mobile or of a computer or whatever.

And let's see.

Are we going to get anything going.

Let me refresh it again.

It's coming from John Smiths which it's not an existing person.

And as you can see it showing that it came from John Smiths and this is his email to my e-mail.

So imagine what can be done using this tool that you can like convince someone that an e-mail he received

coming from his manager or his wife or his girlfriend or whatever was the case and you try to convince

him what it was with or it may show it's coming from Microsoft or it's coming from their bank.

But I have to tell you this is completely illegal.

And in some country it's a federal crime.

So it's not something to play with if you are doing a proper penetration testing in any organization

and you see you need to check if people have enough awareness that if they received a suspicious e-mails

they will verify.

You can use these tools.

Now only one witness we have such tools.

It's a one way process.

I mean you can send an e-mail showing that it's it's coming from someone.

But what if the victim replied back the reply will be going to the right person.

That's why when people use such tools they will never ask.

They will never ask you to reply back.

They will usually ask you to do something and says a minute please click on the link please download

the attachment but they will never rip asked to reply back sending them your credential or any kind

of information.

So if you receive an email and you are says you are suspecting that this is a fake email you can try

to reply back asking that you send me this email.

This would be going to the website and same concept apply for any spoof technique.

If you received a fake Ngubane fake phone call from a fake number.

You can try to disconnect and call them back and so on.

So this is one of the tool that if you use such tool is a technique that we explain in the previous

lecture it would give you an

extremely good results.

But one more time this should be done in a proper frame.

If you are doing good penetration testing with right I prefer.