In the previous videos we learned how to create a Trojan buy back during normal files such as images
documents songs and so on so that when executed the user sees the normal file but at the same time our
eval code gets executed in the background so the challenge now is how to deliver this Trojan to the
target the first delivery method that we're going to talk about and my personal favorite is the mail
delivery.
Now this delivery method just like any other delivery methods relies on the information that you gathered
so far so information gathering is very very important.
When it comes to this this delivery method is really handy because you can use it in so many scenarios
you can use it to deliver all the back doors and the evil files that we see so far.
You can use it to pretend to be a friend and contact your friend and tell him to download something
you can use it to pretend to be a Web site that the target Web site interacts with and pretend to be
the argument of the other Web site and ask the target to do something.
You can pretend to be a member of the support team that the target website uses and then ask them to
change their passwords for example for the web server that they're using you can use it to pretend to
be a company that your target interacts with and tell them that there is a new update of your software
that they already use and then get them to download and install a backdoor.
So the possibilities are limitless really when it comes to mail delivery.
In this lecture I'm gonna show you an example of targeting a person that's called Z and I have the information
that we gathered already in our information gathering lecture and after we gathered everything we managed
to see that Zaid has a number of friends in here and the same friends we managed to see their emails
here and we managed to get Z's email which is a that a security dot org now Zaid could be just a normal
person does you want to hack.
He could be a friend of a person that you want to hack but you want to hack state first and then hack
to that person.
He could be the admin of a website or he could be an employee of a company.
It really doesn't matter what we're looking at in this lecture is how can a person that's called Zaid.
And then from there you can leverage that person to hack into other systems or into other networks or
into a different company.
Now from the information that we gathered we seen Zaid has these friends and these are the emails of
his friends.
So what we're going to do is we're going to pretend to be one of these guys.
So I'm not ask at high security dot org and it's this person in here.
His name is Mohammad NASCAR so we're going to pretend to be that person.
We're gonna send an email to Zaid and the email is gonna look as if it's coming from this person and
then we're going to ask Zaid to download a file let's see how this works.
And this is gonna be a more realistic delivery method that you can actually use in real life.
Now there are a number of ways to do this.
The easiest is just to go on Google and look for spoof emails online.
You'll see a lot of Web sites that will allow you to do this.
The only problem with these Web sites is the e-mail that you're going to send will end up in this Palm
directory of the target person.
So it will not be delivered into their inbox which is not great.
The main reason for this is because these Web sites are public and a lot of people use them for spamming
mail servers so such as Google Hotmail and Yahoo have blacklisted these servers and any email that comes
from the servers that these Web sites use will be marked as spam.
Therefore in order to bypass this you can either use your own server if you already have a Web hosting
plan or you can sign up for a free web hosting plan and use that to send your fake emails or an even
better solution is to sign up for an S. MPP or a mail server.
Now again there are a number of Web sites that offer this a lot of them are paid but with the paid Web
sites you'll actually get really really good results because they are used by actual marketers and by
actual companies to send emails.
So spam is never sent through the servers.
If you look through Google for a free as empty server or a free mail server you will find some Web sites.
And an example of this is this one right here and this is also a really really good Web site because
it is a paid Web site but they offer a free plan which we can use to send our fake emails again.
This Web site is designed for e-mail marketing and for actual companies to communicate with their customers.
So when you send e-mails through the servers of this Web site they will not be marked as spam because
it's very rarely used for spam so we're going to sign up with this Web site.
We're just going to pick a user name and I just going to set it to G H and W CKD the same user name
I use for my email then I'm going to input my email and I'm gonna set a password and create the account.
Now I'm gonna go to the email that I used when I signed up and you'll see that we got a welcome message.
I'm going to open it and I'm going to confirm my email address to activate my account.
Now it's asking me for more questions so it's asking for my first name last name company name phone
number company website and so on.
You don't have to fill this very accurately.
I'm just going to use any information for it.
Just make sure you put a correct phone number because they will send a verification code to this phone
number agree to the terms and submit the form now it's asking us for the verification code I have it
here on my phone number.
So it's 8 1 0 5 3 9 and finally it's asking us to select the plan.
Like I said the free one is fine unless you want to send a lot of emails on the same day.
And that's it we're good to go.
So in the next lecture I will show you how to use the s empty P servers offered by this Web site in
order to send fake emails.