OK so now that we signed up with the service and this lecture I'm going to show you how to use the SMP
servers offered by the service in order to send fake emails.
So first of all we're going to go on the transactional and here on the top left and if you scroll down
you'll see that we have all of the information that we need to authenticate with the A.P. servers offered
by this Web site in order to send the fake emails.
So right now we just need to use a program in order to authenticate and then send the fake emails.
So in Cali we're going to use a program called send email.
So I'm gonna type its name first and because this is the first time we're using this program it's always
a good idea to run the program with the dash dash help argument to see how to use it and all of the
available options so scrolling up you can see the main usage is an email.
We're using the dash f argument and then you set the options.
Now before doing this the first thing I want to do is set the user name and password using the dash
excuse you and the dash XP arguments so our command is going to be sent email dash X you to give the
user name and if we go up we have the user name here which is join week 70 gmail dot com.
In my case so I'm gonna copied and pasted here.
Next we need to set the password.
We're gonna use the dash XP to do that.
And again if we scroll up we have the password here.
So copy and paste it there next we'll need to specify the server.
So we're going to use the dash as option and as you can see you first.
Give it the server call on followed by the port.
An example is this so if we go up you can see that our server is this one right here.
So again it controls you to copy it and our port is going to be 5 8 7.
So going down we're going to do Dash is to specify the server we're going to give it the server that
we just copied and I'm going to type call on followed by the port.
And as we've seen before the port is 5 8 7.
So I'm going to type 5 8 7 so so far we haven't composed the e-mail yet.
All we're doing is we're authenticating with the e-mail server.
So this step is very similar to what you do when you go to gmail dot com for example.
The first thing that you get asked for is your username and password and only once you log in you can
start sending emails.
So this is what we're doing right here.
We first log it in with our user name password and server another two are logged in.
We can go ahead and start composing our e-mail.
Now the cool thing about this this is not an ordinary email client.
We can actually set from email and when the e-mail is delivered it's going to appear as if it's sent
from the from e-mail that we pick in here.
Now from our information gathering stage we discovered that our targets email is aimed at a security
dot org and we discovered that this target Zaid is linked to another person named Mohamed asker and
his email is and that asker at a security dot org so when picking this from e-mail you want to make
sure that you pick an existing email something that exists and you want to make sure that you pick an
email that your target usually receives emails from.
This will increase the chances of your target opening the email and it will also ensure that the email
will be delivered in the inbox and not in this Palm.
So I'm going to set my from e-mail to and ask her at a security dot org.
Next we're going to use the dash t option to specify the e-mail that we want to send this email to and
from our information gathering stage.
We know that the email of our target is aimed at a security dot org next we're going to use the Dushku
argument to specify the title of the email.
So I'm just going to say check out this car and then we're going to use the dash an option to specify
the message body.
Now when specifying the title and the message do you want to keep in mind the person you're pretending
to be the target person and the relationship between the two.
If you're pretending to be a boss or a colleague then you might want to keep these more formal.
But in my case I'm pretending to be a friend.
So I'm going to keep my title and the message casual and I'm just going to say Hey man check out this
car I'm thinking of buying it and then we want to give him a link to download the Trojan.
That shows a picture of a car that we created before.
So you can upload your Trojan to any file sharing service.
I chose to upload it to Dropbox and I've already logged into my Dropbox account in here.
If you don't know how to upload stuff to Dropbox you simply click on the upload in here you select the
file and then the file will be uploaded in here.
So I'm not going to show you how to do that.
It's very simple and there is no point of wasting time on it.
I already have the Trojan.
That shows a picture of the image right here.
So I'm just going to click on share to get the link for it and I'm going to click on copy link now let
me show you this trick.
If I just go in a new tab and paste my download link you'll see that the file will not be automatically
downloaded.
I'll first go to Dropbox and then the user will have to click on Download to download it.
But if we modify the URL and just put a one in here instead of zero and now I'm just going to copy it
first and if I hit enter you'll see it will automatically download the file for the user.
And this is exactly what I want.
Therefore I'm just gonna go down now and paste the file in here and that's it.
Now if we hit enter this message will be sent and delivered to the target.
But it's going to say that asker at a security dot org in here while actual messages that come from
this person display the person's name.
As you can see in here they will actually see Mohamed Oscar so I want my fake email to appear exactly
like a real email coming from this person.
Therefore we're going to need to use an advanced option.
So coming back to the terminal window if you look in here you can see we can use the 0 argument to specify
advanced options and the advanced option that we want to use is a message header right here.
So I'm going to copy this.
And in our terminal I'm going to do dash 0 to specify an advanced option and the advanced option that
I want to set is a message header and this message header is going to be the from header and I want
to set this to the name that I wanted to appear in here.
So in my case I wanted to say Mohammad Askar then we're gonna put the from email inside the greater
and smaller signs.
So again the from email in my case is and at asker at a security dot org and that's it we're done.
Now before hit and enter and send in this message I'm going to clear the screen and I just want to walk
you through the command just to make sure that you understand what we're doing.
So first of all we're using a program called send email.
This is the email client that we're using in order to first authenticate with our email server and then
send the email then the command is split into two stages.
The first stage is where we authenticate with the email server.
Like I said this is similar to what you do when you go to Gmail.
First you have to log in and this is what we're doing here.
We're using the dash exit argument to specify the email we're using the dash XP argument to specify
the password and dash as to specify the server.
So if I go up we got all of this information from the server that we signed up for.
So we got it from here.
Now once we log in and authenticate the next stage is to actually send the email to compose the message.
So we're using the from argument to specify the from email we're using the dash t argument to specify
the email we want to send the email to we're using the issue to specify the title dash and to specify
the message body.
And finally we use an advanced option to set the message header and we set the message header to whatever
we want to appear beside the email title.
When the email is delivered in the inbox so we're ready to send this.
I'm going to hit enter and perfect as you can see it's saying email is sent successfully and I'm actually
already listening for income and connections in here in my multi handler.
So let's go to the target.
And as you can see we have a new email it's coming from Mohammad asker so exactly like a legitimate
email coming from this person.
We can see the subject like we said it and we can see the body.
Now if we go inside again we have a thumbnail of this person.
It's showing his name.
It's showing his email.
It's showing his picture.
So it looks legit.
It's looks like a proper message sent from this person.
Now this person is a friend of mine and we tailored the message so that it appears as if it's coming
from a friend.
If I click on the link you'll see the file will automatically start downloading Dropbox is not asking
us if we actually want to download this.
So I'm going to click OK to download it.
It's going to go in my downloads.
So if we open the downloads right click and uncompressed this will have the GTA are with the image with
the proper extension like we've seen before.
And if we double click it will see the picture of the car that my friend is trying to buy.
So everything looks legit so far.
But if we go back to the Kelly machine you'll see that we got a connection from the target and we basically
gained full access to their computer so if we do there you'll see all the directories and basically
we can run any system command.
Now the main thing that you want to keep in mind when it comes to this method is that this method is
generic.
So it works against Windows Linux OS X Android doesn't really matter.
The only thing that you want to make sure is the file that you're sending to the target should work
on their target operating system.
And they actually cover generating back doors and credential harvesters and all this cool stuff for
all operating systems in my social engineering course.
So if you're interested in that then check out the bonus lecture.
The last lecture of this course because it includes links to all of my other courses including the social
engineering course.