Learn Social Engineering

Step 1 – preparing the attack

In this attack we needed the following:

• A domain for sending the email: Normally, when we want to send an email, posing as an organization, we will first investigate if we can use their true email domain. That can typically be done by either finding a misconfigured email server accepting relay or compromising an email logon. In this scenario, the service provider was excluded from the scope, so instead we had to register a DNS domain that was similar to the service provider.

• A website to host the inventory tool: In this case, we used a simple web page hosted in Azure and published in the domain we registered. We also designed a simple web page to host the inventory tool. The page was given the same graphical ...