Need advise for our company experiment. We are planning to observe the security awareness among our staff. I have an idea but lacking of knowledge on how to do it. I want to create spoofed email and send one .doc file inside the email. That .doc file will return the IP address if our staff click to open the file. From this we can see in our company how many users are not aware with security threat and we will educate them later on. Because we are using firewall, can it be done from external IP as well? Your help and idea are really appreciated.

  • 1
    "Because we are using a firewall, can it be done from a external IP".. could you explain this sentence more please? I fail to see the relationship between the two – pm1391 Apr 19 '18 at 4:12
  • Sorry, if the IP addresses of our staff within the same network as mine (in firewall) it is easier to do exploit using kali linux locally. What if users open their laptop outside our company (coffee shop etc.) Can their public IP still find my host inside my company. Sorry for the bad explanation. Maybe you help help me draft ideas without above IP address thingy. – user3557434 Apr 19 '18 at 5:42
  • a pdf or html file is better; then all you need to do is deep-link an <img src="some external url"> and read the server logs to get IPs. – dandavis Apr 19 '18 at 6:04
  • I would not use any files at all in the phishing email. There are open source tools out there that can help you. Usually you would generate a uuid, attach it to a link and send it to each user. When the user clicks the email, it loads on your server and you know they opened/clicked your email. – pm1391 Apr 19 '18 at 11:43
  • Can you be specific on which tools(open source) that can I use? – user3557434 Apr 20 '18 at 4:24

It sounds like what you're attempting to do is a phishing campaign on your company network. While you have a good idea with the .doc file, the implementation would be way too messy. You could do this with Macros, but there will be a ton of pop ups asking the user to enable macros and confirm that its dangerous etc. Ultimately, I think most of the employees would get scared off by it. You could dig a little deeper and use msfvenom to embed malware in a file, but now you're physically exploiting the machine of every user in the company who clicks on it which is also a bad idea. If you have any company resources that require login with company credentials, I would recommend sending out a verbatim copy of an email that would be generated by that service requesting action by the user by clicking on a link (make sure the link is not from the company url otherwise they will trust it and defeats the purpose of making them look before clicking). Have the URL redirect to a web server (could probably do this internally with DNS without buying the domain) displaying a copy of a login page they are familiar with, and then redirect to a "You've been caught" page. Based on the login info, you can determine who was caught.

In the interest of security, I recommend NOT logging any of the passwords on the web server and including a snippet in the "You've been caught" page instructing them to change their password immediately. Best practice would be to ensure the web form doesn't even send the password or replaces it with random text before sending over the network.

To address your firewall question, I would advise not doing any part of this outside the company network if at all possible. That would increase the chances of information being intercepted by malicious actors. In the event any of this traffic does go out network, that will depend on the ACLs but most HTTP traffic is not very restricted.

Most importantly, make sure to hold a meeting after the fishing campaign so that you can explain to the employees what happened, how to look out for it, and what to do if it happens again.

Edit 1:

If you are concerned about deceiving users that are using their machine out of network, I would recommend using a registered domain name with TLS directed to a webserver owned by your company and hosted on the company domain. By default, the ACLs will probably not allow for HTTP traffic to just any machine from the internet. If the webserver is in a datacenter, it could be more likely. You will have to work with the NetOps, team or whoever is in charge of the network ACLs to confirm this.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.