Trending: TeCh ZoNe

Sunday, March 25, 2012

Desktop phishing in action | how to perform desktop phishing?


hello guYz first learn DESKTOP PHISHING concept from:

What is Hosts File ?

The hosts file is a text file containing domain names and IP address associated with them.
Location of hosts file in windows: C:\Windows\System32\drivers\etc\, Whenever we visit any website, say

 , an query is sent to Domain Name Server(DNS) to look up for the IP address associated with that website/domain. But before doing this the hosts file on

our local computer is checked for the IP address associated to the domain name.

Suppose we make an entry in hosts file as shown. When we visit ,

we would be taken to this

No query for resolving IP address associated with would

be sent to DNS.

What is the attack ?

I hope you have got an idea that how modification of this hosts file on victim's computer can be misused.
We need to modify victim's hosts file by adding the genuine domain name and IP address of our
fake website /phishing page. Whenever victim would visit the genuine website , he would be directed to our fake login page
and domain name in the URL box would remain genuine as typed by victim. Hence domain name is spoofed.

step1: Since the webshosting sites like, etc where we usually upload our phishing page do not provide a IP that points to your website like An IP address points to a webserver and not a website. So we need to host the phishing page on our computer using a webserver software like wamp or xampp.

  Copy your phishing page and paste it in the WWW directory in wamp, the default path is       "C:\Wamp\WWW"
  Run Wamp server on your pc  Right click the wamp icon in the system tray and select Start all services, Visit your public IP address and you must see your phishing page

step 2: Modify Hosts file.
If you dont have physical access to victim's computer. Then copy your hosts file and paste anywhere.
Edit it with any text editor and associate your public IP address with domain you wish as show.

Like in this case , when victim would visit , he would be take to website hosted on IP ''.
Replace it with your public IP.

step 3: Compress hosts file such that when victim opens it, it automatically gets copied to default
location C:\Windows\system32\drivers\etc and victim's hosts file get replaced by our modified hosts file.


Thn you can bind this file with any exe using a binder or directly give it to victim. He is supposed to click it. your work is over 

limitation of attack:

1.Since our pubilc IP address is most probably dynamic that it gets changed everytime we disconnect and
connect. To overcome this we need to purchase 
static IP from our ISP.

2. The browser may warn the victim that 
Digital Certificate of the website is not genuine.

All Rights Reserved TeCh ZoNe | Blogger Template by Bloggermint
back to top