0

For research purposes, I'm conducting an ethical phishing attack in my institution. I have permission from the institution for the same. I've created the phishing site and the email content, and I'll be recording who and how many users visited the phishing site. I intend to send links to a phishing website in the email like this.

Where do I host this site and how do I send this email?

I've seen some free hosting sites. Do email providers give low reputation to such free hosting sites?

Also, for sending the email, should I choose popular email service providers like gmail, hotmail or should I use disposable email? What will increase the chances of the email reaching the users?

  • 2
    This really isn't a security question. This is purely up to your resources and what you want to accomplish. Why not send it from an email account within your institution? Why not host the site from within, too? – schroeder Oct 18 '17 at 10:41
  • @Schroeder I doubt that this would be an authentic test. When I get a mail from someone@myinsitution.example saying to log into http://myinsitution.example/application using my username and password for https://myinstitution.example/otherapplication, then I would see no reason to doubt that. – Philipp Oct 18 '17 at 11:38
  • 1
    @Philipp except if it comes from the wrong account and goes to an illegitimate site. Account takeovers can result in legit email accounts being used to stage this type of phishing. As I say, it all depends on what you want to accomplish. It also matters if this is internal emails. – schroeder Oct 18 '17 at 11:39
  • @Schroeder I wasn't so much talking about the email address (I know these can be spoofed) but rather about the target URL of the phishing site. When it's hosted by my own institution, then I wouldn't assume it's phishing. – Philipp Oct 18 '17 at 11:41
  • 2
    @schroeder - I found with normal users it made no difference but with technical users they would notice the IP and be more hesitant. Although we also found technical users more likely to click a link knowing it was phishing due to curiosity / assuming clicking the link alone wasn't a risk until a further action was performed. I've also seen at another company that used phish.me developers noticed they used a header with their name in and set up filters to automatically report them... – Hector Oct 18 '17 at 11:48
3

This question is, in part, “How do I get my phishing emails past spam detection?” Answering that isn't really in our best interest and you shouldn't spend too much time on it. Instead, get your sending server whitelisted locally so your test is not run through any spam filters.

The easiest solution is to use a well-known testing agency like Cofense PhishMe, Wombat, or KnowBe4, and they'll do the heavy lifting and walk you through the rest. This may not be ideal if you have a really small budget and/or if this is part of a student project.

A good in-house phishing test must

Have permission:

  • Approval from an executive or director, not just IT or Engineering
  • Relevant infosec and netops teams should sign off on this test

Use external servers:

  • Send the test from an external IP address range
  • Bypass anti-spam scanning by whitelisting the test's sending IP(s)

Identify itself as a phishing test in its headers:

  • Add an X-PHISHTEST header with your contact info for escalations
  • Leaving this indicator allows security groups to safely ignore reports
    ⚠ The X-PHISHTEST header triggers a “phishing attack” verdict in some spam detection solutions and prevents the “free pass” for reported phishing reports from meddling with real attack detection. Note the need for whitelisting above.

Have a good landing site:

  • Consider a vanity domain like <institution>-support.com
  • Embed each user address in the link's query string
  • Log users' clicks and the IPs they clicked from for your report
  • Tell users that they fell for your trap and educate them
  • Link or host content similar to the APWG's Stop.Think.Connect.
  • Reveal the test at the document root or without a query string
    so security researchers can understand your intent

Bad phishing tests

  • Will get into trouble with testers' management
  • Can get larger accounts suspended
  • Might get caught as spam and therefore fail to reach the targets
  • Risk annoying yet not educating the user base
  • Will confuse anti-spam filters when trained as phishing

Answers to your specific questions

Where do I host this site and how do I send this email?

So long as you follow the above rules about a good test and a good landing site, you shouldn't run into problems. As noted above, it is a good idea to alert your network operators (this includes your web hosting company) before you conduct this test.

I've seen some free hosting sites. Do email providers give low reputation to such free hosting sites?

You're probably referring to spam detection systems, which are nowadays extraordinarily complex, pulling in as much metadata as possible and combining it all with lots of secret sauce and machine learning. You really want to bypass spam detection with whitelisting. Client-side anti-spam is rarely powerful enough to discriminate in the manner you're worrying about.

Also, for sending the email, should I choose popular email service providers like gmail, hotmail or should I use disposable email? What will increase the chances of the email reaching the users?

Again, you need to bypass anti-spam, at which point much of this doesn't matter. A cheap vanity domain like <institution>-support.com likely comes with the ability to send within your provider's hosted environment.

I consider GMail and Hotmail to be disposable. Many penetration tests register accounts like <institution>-support@gmail.com and use good friendly from names like <institution> Support (which is the only thing mobile email clients display).

2

First of all there are several services which provide phishing testing - PhishMe for example. Your post suggests a low level of technical ability which implies you should maybe consider using one of these instead of rolling your own.

Link-wise I'd again try and use a realistic-looking domain. If you have internal DNS then you can point users at this without actually having to pay to register the name. If you inject an ID into the link you can map who clicked it back to the end user (nonexistanteventscompany.com/event/ab3fd4?invitee=[user@company.com]).

Hosting-wise this could run internally on pretty much any machine that you can DNS the address to - just a basic web server that records the ID from the link in a database (could probably just be a Python script).

  • and I challenge your advice about getting a 'realistic' domain - the stats are that it just doesn't matter - I own phishys.com and use it as a control in my phishing research, and it gets as many hits as 'realistic looking' domains - internal phishing is successful even if you only use IPs in the link – schroeder Oct 18 '17 at 11:47
  • Updated the answer. With relation to domains i'd argue phishys doesn't look suspicious enough - a domain that short/readable is too expensive for mass-phishers to touch since they get burnt so quickly. Its also not intuitive to read "phish" from it. I've certainly seen differences - although tend to be in environments with a majority of tech literate users. – Hector Oct 18 '17 at 11:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.