So new job gets me new fun toys. Figured i'd try the fancy shmancy tools and do a phish campaign with metasploit pro.
1. Go click on campaigns and star filling stuff out like what you want to call it
2. Set up your web campaign. With the web campaign you can actually host a webpage along with your exploit instead of just getting the typical "please wait" stuff.
3. Fill out your name of the template and the html of what you want it to say
4. By default it will run browser autopwn
5. Lets just pick an exploit to throw at them instead of all of them
6. Once you click save, it should look something like this:
7. After that you can set up the email portion of the phish
8. Fill out the sending server options
9. Then fill out the text for the body of your email
10. After you click save, you'll go to the add email addresses section where you can import a list, or type them in
11. Kinda looks like this when its all filled out. To start click the start campaign button
12. You can see the status of your sent emails and as people click them the percentage will change
13. I guess what the email could look like if you werent trying too hard :-)
14. And the web page serving up the exploit
15. You can now see that a user clicked the link and our percentage has changed
I'll cover hosts and sessions later. Only gripe is the lack of configuration ability in the exploit payload section. I've been told this will be addressed shortly even though a lot of work has been put into smart defaults the ability to change it when necessary would be nice.
-CG
1337day (was: Inj3ct0r, 1337db)
OSVDB Vulnerabilities
Exploit-DB
SecurityFocus Vulnerabilities
Bugtraq
XSSed
Packet Storm Security Headlines
Sophos security news
Penetration Testing
SecuriTeam
BackTrack Linux Forums
Threatpost
SecDocs
carnal0wnage.attackresearch.com
Carnal0wnage
Darknet
The Exploitant
Hack a Day
Wirevolution
