https://tryhackme.com/room/phishingemails4gkxh
Created by: tryhackme, ryla, TactfulTurtle
“Phishing remains one of the most common and effective ways for attackers to gain initial access to target systems. To counter this, defenders can deploy a variety of tools and controls designed to protect users from malicious emails.”
Task 2 covers Sender Policy Framework (SPF). Per Dmarcian, “Sender Policy Framework (SPF) is used to authenticate the sender of an email. With an SPF record in place, Internet Service Providers can verify that a mail server is authorized to send email for a specific domain. An SPF record is a DNS TXT record containing a list of the IP addresses that are allowed to send email on behalf of your domain.”
THM links to the syntax table for SPF, https://dmarcian.com/spf-syntax-table/, and also SPF Surveyor: https://dmarcian.com/spf-survey/. With SPF Surveyor, you can gain a visual view of the DNS records. THM also links to Google’s Messageheader again to analyze the email’s full header. This was mentioned in the previous room. https://toolbox.googleapps.com/apps/messageheader/
Task 3 covers DomainKeys Identified Mail (DKIM). Per Dmarcian, “DKIM stands for DomainKeys Identified Mail and is used for the authentication of an email that’s being sent. Like SPF, DKIM is an open standard for email authentication that is used for DMARC alignment. A DKIM record exists in the DNS, but it is more complex than SPF. DKIM’s advantage is that it can survive forwarding, which makes it superior to SPF and a foundation for securing your email.”
THM links to links: https://dmarcian.com/dkim-selectors/, https://dmarcian.com/dkim-inspector/, https://dmarcian.com/dkim-validator/. Below is a snippet of an email header.
Task 4 covers Domain-Based Message Authentication, Reporting, and Conformance. Per Demarcian, “DMARC, an open source standard, uses a concept called alignment to tie the result of two other open source standards, SPF (a published list of servers that are authorized to send email on behalf of a domain) and DKIM (a tamper-evident domain seal associated with a piece of email), to the content of an email.”
With DMARC, the domain is verified by both the previous SPF and DKIM. THM links to two links: https://dmarcian.com/what-is-a-dmarc-record/ and https://dmarcian.com/domain-checker/.
Task 5 covers Secure/Multipurpose Internet Mail Extensions (S/MIME), which is a standard protocol for sending digitally signed and encrypted messages.
In Task 6, Analyzing SMTP Responses, THM wants us to launch the machine and use Wireshark for traffic analysis. To open Wireshark in the VM, search through the Ubuntu search on the top left. Once it’s launched, open the pcap file through File > Open > Desktop
THM links to https://www.wireshark.org/docs/dfref/s/smtp.html to assist us with which filter to use.
For questions regarding spamhouse.org, if you use the filter below, you can search for the string. You will also obtain the answer for “Based on the packet from the previous question, what is the full response code: message?”
To obtain the response code for 552, we go back to using smtp.response.code, but this time for 552.
In Task 7, Inspecting Emails and Attachments, we will be using different filters: https://www.wireshark.org/docs/dfref/i/imf.html. This will be for Internet Message Format(IMF).
Staying on this packet to get the next answer.
For question: “By filtering for IMF, which email client was used to send the message containing the attachment attachmet.src?”. Stay on this packet to get the answer to the encoding question.
That’s it as far as Wireshark packet analyzing. In Task 8, How Orgs Stop Phishing, THM covers other ways beside SPF, DKIM, and DMARC to reduce phishing attacks.
