0

In the company I work for, we have many clients and the vast majority of them have hosting with us and we make their web apps. One client, though, just applied for cyber security. Our CEH (certified ethical hacker) asked me to make an exact replica of the client's login site to test phishing on their cloud service. All legal by contract.

I asked this same question in the wrong community where Giacomo1968 steered me in the right direction. So to be clear: The reason for the following is we had to prove to our client that their cloud login site can be replicated and published to a very similar domain, which is used for stealing login data.

I made the replica (down to a pixel), and backend that stores username and password (plaintext) to a database and sends an email to our CEH with the phished data.

So far, so good, but during the development process (last hour or two) a refreshed and reloaded both original and replicated pages several times.

Then when I was already finished, I refreshed the original site one last time (for no reason at all), and Google Chrome sent out a known alert:

Chrome-ChangePassword

This got me worried that Google might tag our company IP as malicious, resulting in many problems for our other clients who have their websites reachable at our IP address.

I have HTML markup linked with some CSS and JS and in the JS I use Fetch API to call a PHP script which in turn stores username-password combination to database along with NOW() and then send an email with PHPMailer.

Should the phishing site have some tags or something which tell Google it's a cyber-security test or perhaps I'm going about the wrong way entirely. Or, hopefully not, there is just no chance and one should never put such code on server. If so, how do you test this locally if intended users can't browse there?

5
  • My only suggestion with this question: I don’t know if asking about Google specific tags will be something anyone here can answer. I highly doubt it but who knows. But I would maybe clarify what the core question is: Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted? Nov 30, 2020 at 19:41
  • Another approach is to offload the problem to a phishing test provider; there are several companies that do this for you.
    – gowenfawr
    Nov 30, 2020 at 20:02
  • Your title does not match the question in your post. What you seem to want to know is how to get Google to disregard the phishing site. That's a very specific question. I would think that registering with Google Analytics and classifying and omitting the sire from analysis would be the way to go.
    – schroeder
    Nov 30, 2020 at 20:18
  • Is alcad.si your production site? Why are you concluding that the reason for this pop up is because of the fake site you created?
    – schroeder
    Nov 30, 2020 at 20:19
  • As a side note, are you aware that pre-made tools exist to copy a site and add a credential collector? This process is now commoditised.
    – schroeder
    Nov 30, 2020 at 20:22

1 Answer 1

3

Lock the site to your target IP range and display a benign placeholder ("coming soon" or "it works" or even a 404 error) to any client outside that IP range. (This is the easiest way for real world phishing to prevent listing by crawlers and it is a pain to those of us that are trying to keep the world safe.)

This will not, however, prevent listing from phishing detectors that can draw conclusions without crawling your site (e.g. by the look of the URL or DNS metrics).

3
  • What if the client blocked their IP address (maybe VPN)? Nov 15, 2021 at 17:47
  • 1
    @ParkingMaster – I don't understand your question. If the client blocks the phishing test's server, then obviously they won't be able to reach it when they click on the phish-test's link. If the client responds to the test by blocking the hosting IP, that shouldn't be a problem (tests should be conducted on dedicated burnable servers).
    – Adam Katz
    Nov 15, 2021 at 17:51
  • I found this to be the best easy solution. We don't have any other servers apart from those that serve our clients' sites, so no burnable server is an option. Also our IP is never going to be blocked by our client, so that's not an issue. Thank you @AdamKatz .
    – s3c
    Nov 16, 2021 at 13:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .