Cara gampang Buat Phising di Kali Linux

Summary

In this tutorial, Lfi Ahmad from Linduxacking ID demonstrates the use of the Social Engineering Toolkit (SET) in Kali Linux for ethical hacking. The video explains various attack methods, including phishing, social engineering, and website attacks. Ahmad walks through a live example where a phishing attack is executed by creating a fake Twitter login page. When a victim enters their credentials, they are captured by the attacker, emphasizing the risks of phishing. The tutorial serves as a reminder to be cautious of suspicious websites and highlights the importance of secure online behavior.

Takeaways

• 😀 The speaker is introducing a toolkit for social engineering, phishing, and related activities.
• 😀 The toolkit is useful for testing vulnerabilities, such as during penetration testing.
• 😀 One of the attack methods demonstrated is a website attack vector using social engineering.
• 😀 The speaker explores using a default attack method for social engineering.
• 😀 A specific example of testing involves entering a target IP address into a browser.
• 😀 The attack method discussed here involves redirecting the target to a fake website resembling Twitter.
• 😀 The fake website collects sensitive data like usernames and passwords when entered by the user.
• 😀 The demonstration includes entering a test username and password to show how the phishing attack works.
• 😀 The importance of being cautious about phishing attempts and untrusted websites is emphasized.
• 😀 The toolkit offers various customizable options, but the demonstration uses default settings for simplicity.

Q & A

What is the main focus of the toolkit described in the video?

The toolkit is primarily designed for performing social engineering attacks, such as phishing, and other activities related to penetration testing.

What is the purpose of the 'Social Engineering Toolkit' mentioned in the video?

The 'Social Engineering Toolkit' is used to carry out attacks like phishing by simulating fake websites or email prompts to capture sensitive information such as usernames and passwords.

What attack methods are available in the Social Engineering Toolkit?

The toolkit offers various attack vectors, including phishing attacks, website attack vectors, and media generators, among others.

How does the toolkit simulate a phishing attack in the video?

The toolkit is used to create a fake Twitter login page. When the victim enters their credentials, the attacker captures the information, which is shown in the demonstration.

What happens when the victim enters their credentials on the simulated Twitter page?

When the victim enters their username and password on the fake Twitter login page, the credentials are captured and displayed on the attacker's system, showing the username 'Luti' and the password 'asade'.

What IP address is used in the demonstration, and what is its significance?

The IP address 192.168.70.30 is used in the demonstration to access the fake login page. It represents the local IP address of the machine hosting the simulated phishing attack.

How is the toolkit customized in the demonstration?

In the video, the attacker uses the default settings for the phishing attack, though it is mentioned that the attack can be customized further, such as selecting different attack methods or targeting different websites.

What is the key takeaway about phishing websites from the video?

The video emphasizes the importance of being cautious when interacting with websites that may not be trustworthy, as phishing sites can be used to steal sensitive information.

Why should users be cautious about phishing attacks?

Users should be cautious because phishing attacks can easily trick them into entering sensitive information, such as passwords, on fake websites that look legitimate, potentially leading to identity theft or unauthorized access to accounts.

What ethical considerations should be taken into account when using tools like the Social Engineering Toolkit?

Tools like the Social Engineering Toolkit should only be used in ethical penetration testing scenarios with proper permissions. Unauthorized use for hacking or phishing is illegal and can lead to serious consequences.