Teach a Man to Phish and You Feed Him for a Lifetime
summary
A crawler harvests over 6,400 unique phishing kit ZIPs from ~13,000 URLs (about 9 GB uncompressed), covering roughly 130 targeted brands. Most kits exfiltrate credentials by mail (99% mail credentials), and common evasions include polymorphic URLs, htaccess/robots rules and AES page blobs. Kits contain real vulnerabilities — writable upload endpoints that accept web shells, local/remote file inclusion, SQLi and command execution — plus backdoors and live login checks that validate harvested credentials.
AI-written summary · about
chapters (31)
- 0:00Intro
- 0:45About me
- 1:06Side note
- 1:43How it works
- 3:00Example
- 4:04Phishing kits
- 4:37Trend ippity
- 5:11I was totally accidental
- 5:46Script description
- 6:50File bundles
- 8:06VirusTotal
- 9:08Inversed Intelligence
- 10:12Crawler
- 12:16Data
- 13:15Clustering
- 14:21Histogram
- 14:50Analysis
- 15:06PHP Code
- 18:07Evasion
- 20:28Content Obfuscation
- 21:50Robotic Feed
- 22:49Polymorphic URLs
- 24:21Content Obfuscate
- 26:02Statistics
- 27:37Conclusion
- 29:47Final Manipulation
- 31:13File Inclusion
- 32:38Crosssite scripting
- 33:39HTTP response splitting
- 35:39Backdoors
- 36:43True Logins
related talks
40mMy Phishing Kit Burnbook
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
54mDark Fairytales From A Phisherman
27mCatching the Phisherman
49mBeyond Takeover: Attacker’s in. Now what?
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
01h 01mSomething Something Cyber
40mNavigating the Shadows: A Comprehensive Exploration of Popular and Malicious Tools on the Dark Web