0

[Edited title according to comments]

In the company I work for we have many clients and vast majority of them have hosting with us and we made their web apps. One client though just applied for cyber security. Our CEH (certified ethical hacker) asked me to make an exact replica of client's login site to test phishing on their cloud service. All legal by contract.

I asked this same question in the wrong community where Giacomo1968 steered me in the right direction. So to be clear: The reason for the following is we had to prove to our client that their cloud login site can be replicated and published to a very similar domain, which is used for stealing login data.

I made the replica ( down to a pixel ^^ ), and backend that stores username and password (plaintext) to database and sends an email to our CEH with the phished data.

So far, so good, but during the development process (last hour or two) a refreshed and reloaded both original and replicated pages several times.

Then when I was already finished, I refreshed the original site one last time (for no reason at all), and Google Chrome sent out a known alert:

Chrome-ChangePassword

This got me worried that Google might tag our company IP as malicious, resulting in many problems for our other clients who have their websites reachable at our IP address.

I have HTML markup linked with some CSS and JS and in the JS I use Fetch API to call a PHP script which in turn stores username-password combination to database along with NOW() and then send an email with PHPMailer.

Should the phishing site have some tags or something which tell Google it's a cyber-security test or perhaps I'm going about the wrong way entirely. Or, hopefully not, there is just no chance and one should never put such code on server. If so, how do you test this locally if intended users can't browse there?

5
  • My only suggestion with this question: I don’t know if asking about Google specific tags will be something anyone here can answer. I highly doubt it but who knows. But I would maybe clarify what the core question is: Is it possible to setup a phishing “honeypot” for proof-of-concept purposes without getting the host/IP blacklisted? – Giacomo1968 Nov 30 '20 at 19:41
  • Another approach is to offload the problem to a phishing test provider; there are several companies that do this for you. – gowenfawr Nov 30 '20 at 20:02
  • Your title does not match the question in your post. What you seem to want to know is how to get Google to disregard the phishing site. That's a very specific question. I would think that registering with Google Analytics and classifying and omitting the sire from analysis would be the way to go. – schroeder Nov 30 '20 at 20:18
  • Is alcad.si your production site? Why are you concluding that the reason for this pop up is because of the fake site you created? – schroeder Nov 30 '20 at 20:19
  • As a side note, are you aware that pre-made tools exist to copy a site and add a credential collector? This process is now commoditised. – schroeder Nov 30 '20 at 20:22
1

Lock the site to your target IP range and display a benign placeholder ("coming soon" or "it works" or even a 404 error) to any client outside that IP range. (This is the easiest way for real world phishing to prevent listing by crawlers and it is a pain to those of us that are trying to keep the world safe.)

This will not, however, prevent listing from phishing detectors that can draw conclusions without crawling your site (e.g. by the look of the URL or DNS metrics).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.