Room link: https://tryhackme.com/room/phishingemails1tryoe
Created by: tryhackme, 1337rcel000g1c, TactfulTurtle
“Spam and Phishing are common social engineering attacks. In social engineering, phishing attack vectors can be a phone call, a text message, or an email. As you should have already guessed, our focus is on email as the attack vector.”
The room initially covers the origins of phishing(started in the 1970s by, you guessed it, Marketer Spam, the @ symbol made famous by Ray Tomlinson as well as a shout-out to ARPANET.
In task 3, Email Delivery, THM breaks down the workings of an email and the differences between SMTP, POP3, and IMAP. Eventually, the room links here for you to obtain the secure ports for these. https://help.dreamhost.com/hc/en-us/articles/214918038-Email-client-configuration-overview
In the next couple of tasks, THM breaks down the header and body of an email and gives an example of raw format and source code. We are also instructed to find the base64 of one of the text files on the virtual machine. I went to cyberchef.org to get that flag. Copy and paste the contents to Cyber Chef and convert it from base64, then download the file. Open the file to get the flag.
In Task 6, Types of Phishing, THM covers the various types of emails along with typical characteristics and covers “defanging” a URL. To defang the URL, you will need to go back to the CyberChef website.
And lastly, they cover BEC (Business Email Compromise). “A BEC is when an adversary gains control of an internal employee’s account and then uses the compromised email account to convince other internal employees to perform unauthorized or fraudulent actions.”. This was a great intro room to phishing, and it was fun getting back to CyberChef.