Practitioner Level

Phishing Emails and GeoIP Lookup

30 minutes

6 Learning Objectives

In this hands-on lab, we will create and send a phishing email. The goal is to get the target to click on the link in the email, revealing information about themselves, such as their IP address, browser, and operating system. We will then use the IP address to geolocate the target.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives:

Install and Start the Apache Web Server

Install the Apache web server.
```
yum install httpd
```
Start the Apache web server.
```
systemctl start httpd
```
Verify that the server is running.
```
systemctl status httpd
```

Find the Target’s IP Address

Run the following command:
```
curl ifconfig.me
```

Create a Resource in the Root Directory of the Server

Change to the default root directory of the server.
```
cd /var/www/html/
```
Create a new resource.
```
touch &lt;RESOURCE_NAME&gt;
```

Edit the resource file.

echo "Thank you for the free information" > &lt;RESOURCE_NAME&gt;

Verify that the file is not empty.
```
cat &lt;RESOURCE_NAME&gt;
```

Create and Send a Phishing Email

Use your email client to create and send a phishing email.
Include an image attachment that links to the resource we created in the previous task.

Monitor the Server for Incoming Client Connections

Run the following command:
```
tail -f /var/log/httpd/access_log
```

Perform a GeoIP Lookup

Run the following command:
```
geoiplookup &lt;IP_ADDRESS&gt;
```
Consult the manual pages for more information about the GeoIP lookup tool.
```
man geoiplookup
```

Additional Resources

NOTE: The cloud-user account has sudo privileges.

Install a web server.
Start the web server.
Download an image of your choice with wget.
Place the image into the root folder of the web server.
Make sure that the image is publicly accessible.
Open your email client and send yourself the image as an email attachment.
Start monitoring the web server access logs.
Open the email you sent yourself and click on the image.
When you open the image, you will see your browser, IP, and operating system information appear in the logs.
Use the IP address to perform a GeoIP lookup.
You can also type the IP address into your browser address bar, and it should lead you to the login page of your home router.

What are Hands-on Labs

Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.

Welcome Back!

Psst…this one if you’ve been moved to ACG!

Get Started

Who’s going to be learning?

Myself My Organization

Phishing Emails and GeoIP Lookup

About this Hands-on Lab

Learning Objectives

Additional Resources

What are Hands-on Labs

Newsletter