Advanced Phishing: Cloning Fully Functo Sites

[ltx_Lazzarus]

When we're doin' a phishin' attack on a website, the usual go is to clone the interface, makin' the victim think they're on the real site. Normally, this fake site doesn't have any functionality, so the victim might twig that somethin' dodgy is goin' on.

Today I'll tell ya about a ripper tool that aims to fix this problem. How it works is simple: we map the subdomains we wanna impersonate, so we need the victim to visit the site with the spoofed DNS. The tool will change the DNS and connect to the real site, so the original functionality is kept.

REQUIREMENTS:
We need node.js v6 or higher, so in this case, we'll use ArchLinux. First up, we install npm, the node package manager:

Code: Select all

sudo pacman -Syu npm

We clone the repo:

Code: Select all

git clone https://github.com/compewter/CopyCat

Now, we go into the directory and install the dependencies:

Code: Select all

npm install

And that's it, just need to fire up the server. Before that, we adjust the settings in the .env file. In this file, we map the subdomains and set the port the service will listen on. In the example, let's say we're impersonating google. com, it would look like:

Code: Select all

https://us-west-1.google.com -> https://google.com
https://us-west-2.google.com -> https://google.com
https://us-west-3.google.com -> https://www.google.com
https://us-west-4.google.com -> https://www.google.com

ONCE WE'VE EDITED AND MAPPED THE SUBDOMAINS, WE START THE SERVICE WITH:

Code: Select all

sudo node server.js

Let's edit our /etc/hosts to test it properly, adding something like:

Code: Select all

127.0.0.1 us-west-1.google.com
127.0.0.1 us-west-2.google.com
127.0.0.1 us-west-3.google.com
127.0.0.1 us-west-4.google.com

Now we open a browser and go to https:// us-west-4.google. com. We can see in the terminal all the steps we're taking.