Flashcards for:
Understanding Phishing Attacks and Prevention

1. Smishing: Phishing through text messages. 2. Vishing: Phishing through voice calls. Both methods aim to deceive the target into divulging private information.

The Social Engineering Toolkit (SET) is used to craft and send spear phishing emails, making the attack more focused and potentially more effective.

'thisis.it.io' sponsors educational content related to phishing attacks and offers courses and community resources aimed at providing accessible IT education.

Advanced techniques include using malicious files disguised as legitimate documents and employing DNS Poisoning or Pharming to reroute legitimate web requests to malicious sites.

Spear phishing targets specific individuals with a more personalized approach, whereas general phishing targets broader audiences without personalization.

Awareness is crucial because it helps individuals recognize and avoid deceptive tactics used in phishing attacks, reducing the likelihood of falling victim.

Emotional manipulation, such as creating a sense of urgency, is used to lower the target's guard and press them into acting without careful consideration, making them more likely to divulge sensitive information.

1. Create a fake LinkedIn page to harvest credentials. 2. Use social engineering to trick the target into entering their username and password. 3. Set up credential harvesting to listen for credentials entered on the fake site.

Ngrok is used for tunneling, which allows the phishing site to be accessible over the internet, even if the server is behind a firewall or NAT.

Kali Linux is designed as a hacking-focused Linux distribution containing various tools used for penetration testing and phishing attacks, such as the Black Eye tool and the Social Engineering Toolkit.

A phishing email is crafted to appear legitimate and prompts the target to click a link leading to a fake website, where the attacker can capture sensitive login credentials.

Whaling is a type of phishing attack that targets high-profile individuals like CEOs.

DNS Poisoning involves redirecting legitimate web requests to malicious sites; it's used to trick users into unknowingly visiting the attacker’s site.

1. Don’t click links in emails or texts without verifying the source. 2. Use good spam filters. 3. Be aware of phishing risks and emotional manipulation. 4. Educate others about these risks.

Credential harvesting refers to the action of capturing login details such as usernames and passwords entered on a fraudulent webpage created by the attacker.