Pierluigi Paganini November 21, 2016

The security expert Michele Orru from FortConsult has released an automated phishing toolkit dubbed ‘PhishLulz’ for penetration testing activities.

The security expert Michele Orru from FortConsult, aka @antisnatchor, has released an automated phishing toolkit dubbed ‘PhishLulz’ for penetration testing activities. The PhishLulz tool was presented at the Kiwicon hacking event held Wellington New Zealand last week.

PhishLulz is a tool written in Ruby,  it leverages Amazon EC2 cloud instances for its phishing campaigns. The toolkit provides a GUI from the PhishingFrenzy kit and combines it with the Browser Exploitation Framework Project (BeEF).

The tool also includes a self-signed certificate authority and new phishing templates that could be used by penetration testers fro their analysis, Orry also announced as a future improvement the automatic domain registration capability that in the current version is limited to registrar NameCheap.

The toolkit allows an attacker to easily compose efficient phishing campaigns, it is quite easy to compose malicious messages that appear as legitimate. The tools will promptly alert the attacker when a victim takes the bait. The BeEF allows the PhishLulz is also able to and send exploits and gather user target configuration information such as the operating system, browser versions, and running applications.

The tool includes MailBoxBug and also works with Office365 accounts to send out phishing messages.

Orru presented the results of the tests conducted an unnamed Australian Government agency, PhishLulz has deceived 40 percent of its staff who revealed corporate VPN credentials.

“With five minutes to run the PhishLulz VM, five minutes to start modify the template and upload the certificates you need, you’re ready to go.”

Orru provided interesting insights on phishing campaigns, for example, attackers will have an hour to exploit the dozen or so logins they receive before the victims will notice the attack and revoke them.

Another info shared by the expert during the presentation is related to the best times to launch phishing campaigns, the emails sent in the morning or just after the lunch have a greater likelihood to trick victims into providing sensitive data.

The experts highlighted that employees often fail to distinguish dots from dashes in the URLs.

[adrotate banner=”9″]

Pierluigi Paganini

(Security Affairs – PhishLulz,  Phishing)