Visit these sites and see how much information is available about yourself: All you need is your target’s name to start reconnaissance. If you use social media, then there is a lot more information to collect. Voting registries, court records, county and property records, phone books, online review sites are just some examples. This is true even if you do not use social media. There is a ton of information on the web pertaining to most of us. Watch this 3 min video (if you do not have audio, it is OK): Spear-Phishing is a social engineering technique where a spammer uses intimate details about your life, your contacts, and/or recent activities to tailor a very specific phishing attack. Open Source INTelligence Gathering Spear-PhishingĬrafting URLs is just one part of the deception used by spammers. For example, by chance, you may hover over an image area with legitimate links when checking the status bar, but then click a different (malicious link) area to visit the linked website. Spammers trick victims by embedding images with a mix of malicious and legitimate links using this technique.

Notice the change in links in the status bar. Try hovering your mouse over the image starting from the far right, slowly moving towards the left. Different regions of the image are mapped to different URLs. Dev tools (Inspect Element) should also help. A browser does this automatically and renders a humanly readable webpage. The `HTML` column in the ASCII table explains how obfuscation on this page works. # This is a useful resource for ASCII to hex, decimal conversions Links #1-3 are explained below for an IP address that maps to ĪSCII Encoding for Hex Encoding (Starts with % sign) Browsers know how to interpret IP addresses in these formats. It just so happens that 32-bit IP addresses can be expressed in Octal, Decimal and Hex formats. For example, maps to the 137.48.1.233 IP address. Typically, they are expressed as 4 sets of decimal numbers from 0-255. IPv4 addresses are 32-bit binary numbers. Most humanly readable domain names map to IPv4 addresses. Now click on the URLs to reveal their true destinations. Have you seen links like this before? Examine the page source (right click the blank area and click view source). The developer tools built into the browser also help us see right through the obfuscated data. Now it should look similar to the phishing page from before: In the Elements tab unravel the HTML code that is computed by the browser to render a human readable page. Then right click on a blank area and select Inspect or Inspect Element. But if we put our minds to it, we can defeat the bad guys. Just viewing the source files for obfuscated pages provides no useful information.

Navigate away from such pages or delete emails that have gone to such lengths to conceal their “trickeries”. Spammers use such obfuscation to avoid detection and analysis. It has been obfuscated using an external javascript file. It is similar to the page in the URL Analysis Lesson in form and function but now examine its page source. In this sense, it means to make code that is intentionally hard to read, usually to prevent the code of an atttack from being easily read. Obfuscation means the act of making something obscure, unclear, or unintelligible. Open Source INTelligence (OSINT) gatheringĪcknowledgements Obfuscation of Web Content.This lesson looks at how malicious information can be hidden in URLs or other data fields. Both ways can prevent people from being able to see the information. It can be hiding the content of a letter, or it can be applied to hiding how the letter is delivered. Information Hiding: Information hiding is any attempt to prevent people from being able to see information. If one layer is defeated the next layer should still be defending. Layering: Cybersecurity uses multiple layers of defense when protecting information or resources.

Phishing - Advanced URL Analysis - Obfuscation, Clickjacking and OSINT Gathering Cybersecurity First Principles

Email address obfuscation generator