際際滷

際際滷Share a Scribd company logo

Phishing and being phished!

n|u - The Open Security Community
n|u - The Open Security Community

The document discusses how the author was targeted by a phishing attempt from their bank asking them to update their security information. Out of curiosity, the author inspected the phishing website source code. They found that the website was an exact copy of the real bank website. Upon further investigation, they discovered that the phishing form submitted users' information to a Gmail address, showing it was a scam to steal people's account details. The author was able to deceive the phishers by inspecting the source code to uncover how the scam operated and where the stolen information was really being sent.

1 of 4
Phishing and being phished! By webDEViL Early morning I was checking my mail as usual. I get a message from my bank that I need to update because of some new security measures. Well since the mail landed in my inbox and not my spam folder I had to check it out. For fun!
I click on Personal (and do remember that I am not going to put in any information in any form). Ok, cool! the site is the same, since the code is a pure copy and paste from the original site. Now, some would fall for this, giving all their info and getting screwed. I wanted to understand how and probably who is doing this. So I use one of my super powers, source code revealing skills. Let us take a look at what is behind this.
Initially when we opened the file, the attachment, we are moved to Then after clicking on personal; comes the form. Lets see where the data is going, lets search for action in the html source code. So post.php is being used to submit the data and you are then shown showRegret() ;) What is there in post.php? Ah, your info is being mailed to a gmail address. Oh lord! I would have thought this was more complicated, but hell. But then I realize that are some more things $to, what is that? I decide to have a look at java.js
A bit of obfuscation for the $to parameter. Well just add a print command to see what that really is, Print $send = rippychippy@gmail.com Cool, another email address to which the information is being sent. Was the phisher owned, I think so! Anyways, dont fall for such stuff. ;)

More Related Content

Phishing and being phished!

  • 1. Phishing and being phished! By webDEViL Early morning I was checking my mail as usual. I get a message from my bank that I need to update because of some new security measures. Well since the mail landed in my inbox and not my spam folder I had to check it out. For fun!
  • 2. I click on Personal (and do remember that I am not going to put in any information in any form). Ok, cool! the site is the same, since the code is a pure copy and paste from the original site. Now, some would fall for this, giving all their info and getting screwed. I wanted to understand how and probably who is doing this. So I use one of my super powers, source code revealing skills. Let us take a look at what is behind this.
  • 3. Initially when we opened the file, the attachment, we are moved to Then after clicking on personal; comes the form. Lets see where the data is going, lets search for action in the html source code. So post.php is being used to submit the data and you are then shown showRegret() ;) What is there in post.php? Ah, your info is being mailed to a gmail address. Oh lord! I would have thought this was more complicated, but hell. But then I realize that are some more things $to, what is that? I decide to have a look at java.js
  • 4. A bit of obfuscation for the $to parameter. Well just add a print command to see what that really is, Print $send = rippychippy@gmail.com Cool, another email address to which the information is being sent. Was the phisher owned, I think so! Anyways, dont fall for such stuff. ;)