Blog de Matias Katz Hablamos un poco de seguridad?

Home-made phishing attack

I thought about seeing how far I could get when trying to assemble a phishing site.

First, I chose a provider, in this case Gmail. Then, I downloaded the original login site and did the following adjustments:

1. I cut all communications the site did to Google
2. I changed the user and password information destination
3. I manually added a Favicon from the provider's official icon repository
4. I created a new script that receives the information sent from the login site and shows it on-screen

The finished product turned out to be a Gmail home site, dangerously similar to the original, with a behaviour dangerously different.

In order to really know how easy is to make this part of the attack, I can tell you that it took me approximately half an hour of a very relaxed work.

For this to be a full Phishing attack, the next step would be to deceive the user into entering the address where the site is being hosted, believing he's entering Gmail's real site.

I will clearly NOT ease that task for you, but I will leave you with the login site, that independently is harmless.

I invite you to test the site (by entering fake credentials, obviously).

Next provider, Facebook

Link: http://www.matiaskatz.com/gmail/