In the previous lecture we seen how to use an as MPP server in order to send emails that look like they're
sent from any email address we want.
I also mentioned in the previous lecture that there is another way of doing this and that is using a
web hosting.
Now there are a lot of free web hosting services that you can use to achieve this but just like I said
for SMP servers you will get results with the paid services because there are less people using them
and therefore they are less likely to be flagged as spam by email providers such as G.M..
But right here I actually have a free web hosting provider that works well and still delivers the email
in the inbox so it will still not mark you as spam.
Now if you look on Google you'll find a lot of free web hosting providers and a lot of cheap ones.
And like I said you might actually get better results with the paid ones.
But we're going to go with a free one for this lecture and you'll see it's going to work perfectly.
So we're going to click on the get started here and we're going to go for the free plan.
So it's zero point zero per month
now.
You can set up the setup a simple just like setting up for anything else email password and sign up
or if you already logged into your G.M. or Facebook you can just click on log in with Gmail for example.
I'm already logged into my email so that's what I'm doing.
And I'm going to click my email account that I'm already logged in with
I'm perfect.
Now we are ready to go.
So we're going to click on that create some magic.
And this is just a wizard to take us through the process.
I'm just gonna do other and skip this and now it's asking me for the name of the website that I want
to create.
So you can call this anything you want.
Will be the only people that will use this Web site.
So I'm just gonna call my own John Wick and we're going to submit OK.
Now we created our Web site so the next step is to upload the HP file that will actually allow us to
send fake emails.
So we're going to click on upload files to the Web site and we're going to click on publication here.
This is the location that loads by default when you access the website.
Therefore we want to upload the HP file that will allow us to send the emails in here so we can use
it to send the fake emails.
So I'm going to click on the upload button in here I'm going to click on select files and I'm going
to select the file that I want to upload.
It's already in my downloads and it's it's called Send BHP.
I will include this file and the resources of this lecture.
So right now all we have to do is just click on open and upload Now keep in mind if you're using a different
web hosting provider whether it's free or paid the interface might look slightly different than what
you see in here.
But the main idea is the same.
You want to just go to the Web route to the location that gets loaded when you access the Web site and
upload the send that BHP file that I've included in the resources of this lecture.
And once you do you need to browse it.
You need to open this file in your web browser.
So I'm going to right click in here and I'm going to click on View so using this is very simple.
All you have to do is set the e-mail that you want to send this e-mail to.
And just to switch it up I'm going to send this to my other e-mail which is Zaid at Z Security dot org
next.
We're going to set the from email.
This is the e-mail that this e-mail will appear like it's coming from.
So again just to change things around.
We're going to set the from e-mail this time to Adrian at the Security dot org.
Now again when you're setting the from e-mail make sure that you set it to an e-mail that actually exists
and make sure that your target actually receives e-mails from this email and communicates with them.
This will ensure that the e-mail will land in the inbox and it will also increase the chances of your
target of opening the e-mail and interacting with it.
Adrian works with me in the same company we frequently exchange e-mails.
Therefore this is a really good from e-mail to spoof the next field is the name field.
This is similar to the from header that we set manually in the previous lecture.
So let me go to my inbox to show you where this name shows up right here.
I have an actual e-mail that I got from Adrian.
And this part right here is the name.
So whatever you said in here will be displayed in that part if you don't set that up.
It will automatically be set to the e-mail and it will appear like this one which is not identical to
the real one that I can get from him.
So we're going to set this to Adrian's name.
We're going to set the subject and let's just set the subject of this to test and we're just going to
set the body to this is another e-mail spoofing test.
Now I don't really need to send a backdoor in this.
The whole point of this lecture is to show you another method of spoofing e-mails.
So now that we're done with everything and going to click on submit to send the e-mail.
And as you can see it's seen e-mails sent.
So that means the e-mail got sent and delivered.
So let's go to the inbox.
Let's see if it looks identical to the real one.
And let's see if it actually get delivered into our inbox.
So right here I have my inbox.
And as you can see here the bottom line is an actual e-mail that I got from Adrian.
This is a real e-mail from Adrian.
You can see the name here correct.
Similar to the name here.
If I stay hovering on the real e-mail as you can see I'll get a card that shows his name his email and
his phone number.
And if I hover over the spoofed one again I get the exact same card because it's pulling this from my
contacts so it's automatically populating this if I go on the real e-mail right here.
Again you can see this is a real e-mail by him.
You see the name you see the profile and you see the from is from Adrian Boyd.
Now let's go to the spoofed one again.
You have the picture.
You have the name.
And if you look in here you have the correct e-mail.
Adrian put at that security dot org.
The only part that might look a little bit suspicious is the fact that it's saying we.
This but a lot of people are not going to pay attention to this.
And this is only displayed in Gmail so we tested with life.
This doesn't even show up on it.
And even with G.M. we have the correct profile picture.
We have the correct name.
We have the correct email if you look in here and we even have the correct phone number.
So this is just another method to show you how to spoof e-mails in case the previous method didn't work
or if you just didn't like it.
You can try this one again like I said you can use any web hosting provider.
You do not have to use this one that I used.
You can try the free ones you can try the paid ones.
And like I said you will get better results with the paid ones.
The steps are pretty much the same.
The only difference might be the sign up process and the process of uploading the file to the Web site.
But the idea is the same.
You sign up with a web hosting provider.
You upload the sender BHP file you browse the DOT BHP file from your web browser and you use it to send
the email.