phishingemails4gkxh-tryhackme

Learn how to defend against phishing emails.

Link to the room https://tryhackme.com/room/phishingemails4gkxh

Task2: Sender Policy Framework (SPF)

Dmarcian, a platform dedicated to helping organizations protect email domains from phishing, defines the Sender Policy Framework (SPF(opens in new tab)) as follows:

“Sender Policy Framework (SPF) is used to authenticate the sender of an email. With an SPF record in place, Internet Service Providers can verify that a mail server is authorized to send email for a specific domain. An SPF record is a DNS TXT record containing a list of the IP addresses that are allowed to send email on behalf of your domain.”

Let’s take a look at a workflow diagram for SPF

So, in essence, when an email is sent, the receiving mail server checks the domain’s SPF record to verify whether the sending server is authorized to send messages on behalf of that domain. The delivery of the email (intended action) is based on the result of the SPF record verification.

Verification ResultIntended ActionPass, Neutral, NoneAccept (Allow and process the email)SoftFail, PermErrorFlag (Mark as suspicious but allow)Fail, TempErrorReject (Immediately discard the email)

SPF Records

Let’s take a look at a sample SPF record and break down its format. Further information on SPF Record Syntax can be found here(opens in new tab).

v=spf1 ip4:127.0.0.1 include:_spf.google.com -all

• v=spf1 Signifies the start of the SPF record
• ip4:127.0.0.1 Specifies which IP can send mail (IPv4 in this case)
• include:_spf.google.com Specifies which domain can send mail
• -all Non-authorized emails will be rejected

Tools

The SPF Surveyor(opens in new tab) tool from dmarcian enables us to gain a visual look at DNS records. It also helps ensure the record uses the correct syntax.

Let’s take a look at TryHackMe’s SPF record as an example.

You may notice that no IP addresses are visibly present in the main record, but three domains are listed. In this case, all IP addresses authorized by the domains will be recognized as legitimate senders.

• _spf.google.com
• email.chargebee.com
• 7168674.spf05.hubspotemail.net

Google Admin Toolbox Messageheader(opens in new tab) allows you to analyze delivery details using an email’s full header. It shows various record results, including SPF. Check out the example below, which shows the SPF record as softfail with IP Unknown!. A SoftFail means the sending mail server is not listed as an authorized sender, but the receiving server will still accept the email and flag it as suspicious. In this case, the sending IP address could not be verified.

Question 1:Based on TryHackMe’s SPF record above, how many domains are authorized to send email on its behalf?

Answer 1: 3

Question 2: What is the intended action of an email that returns a SoftFail verification result?

Answer 2: Flag

Task 3: DomainKeys Identified Mail (DKIM)

DomainKeys Identified Mail (DKIM(opens in new tab)) is defined as follows:

“DKIM stands for DomainKeys Identified Mail and is used for the authentication of an email that’s being sent. Like SPF, DKIM is an open standard for email authentication that is used for DMARC alignment. A DKIM record exists in the DNS, but it is more complex than SPF. DKIM’s advantage is that it can survive forwarding, which makes it superior to SPF and a foundation for securing your email.”

Having a look at the workflow diagram for DKIM

Let’s break it down. When an email is sent, the sending mail server uses a private key to add a digital signature to the email. The receiving server retrieves the public key from the domain’s DKIM record to verify that the message truly came from the domain. If the signature matches, the email is authentic; otherwise, it may be flagged or rejected.

DKIM Records

Here is a sample DKIM record, along with its components.

v=DKIM1; k=rsa; p=<public_key>

• v=DKIM1 Specifies the version of DKIM being used (optional)
• k=rsa The key type. The RSA encryption algorithm is standard
• p= This is the public key that will be matched to the private key to verify the DKIM signature

Note: DKIM record formats vary and may include other tags depending on the mail provider or implementation.

Dmarcian has some great resources(opens in new tab) if you wish to learn further about DKIM. You can also check out their DKIM Record Checker(opens in new tab) and Validator(opens in new tab).

Sample Spam Email Header

The image below is a snippet of an email header that was marked as spam with a DKIM result of permerror, indicating a permanent failure in DKIM verification. This could be the result of an invalid signature, a missing or incorrect DNS record, a forwarding server making a modification, or a misconfiguration in DKIM setup.

Question 1: Based on the sample header above, what is the reason for the permerror?

Answer 1: no key for signature

Task 4: Domain-Based Message Authentication, Reporting, and Conformance (DMARC)

Domain-Based Message Authentication, Reporting, and Conformance (DMARC(opens in new tab)) is defined as follows:

“DMARC, an open source standard, uses a concept called alignment to tie the result of two other open source standards, SPF (a published list of servers that are authorized to send email on behalf of a domain) and DKIM (a tamper-evident domain seal associated with a piece of email), to the content of an email.”

This means that DMARC ensures the sender’s domain matches the domains verified by SPF and DKIM. If the alignment fails, DMARC instructs the recipient server on how to handle the email based on a policy specified in the record.

DMARC Records

Here is a breakdown of a DMARC record and its components.

v=DMARC1; p=quarantine; rua=mailto:postmaster@website.com

• v=DMARC1: The version of DMARC (required)
• p=quarantine The DMARC policy (quarantine = move to the spam folder)
• rua=mailto:postmaster@website.com An optional tag. In this case, aggregate reports will be sent to the email specified

Here is some further reading(opens in new tab) about DMARC records if you’re interested in learning more.

Domain Checker

Another great tool(opens in new tab) by dmarcian that inspects DMARC, SPF, and DKIM records to identify any issues. Let’s try it out on microsoft.com.

In the screenshot below, you can see that microsoft.com passed all the checks. Clicking the details will allow you to examine each record and policy more closely. As shown in the record below, all emails that fail the DMARC check will be rejected based on the p=reject policy tag.

Question 1: Which DMARC policy provides the greatest amount of protection by blocking emails that fail the DMARC check?

Anser 1: p=reject

Task 5: Secure/Multipurpose Internet Mail Extensions (S/MIME)

Secure/Multipurpose Internet Mail Extensions (S/MIME(opens in new tab)) is a standard protocol for sending digitally signed and encrypted messages. It is based on public key cryptography, where the private key is never shared and the public key can be distributed openly. The two main components and security features of S/MIME are:

Digital Signature

The sender signs the message with their private key, the recepient verifies the sender’s identity using the sender’s public key. This security feature provides:

• Authentication: Confirms the sender’s identity through their digital certificate
• Non-repudiation: Ensures the sender cannot deny sending the message
• Data Integrity: Detects any changes to the message after it’s signed

Encryption

Get TeamredX’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

The sender encrypts the message using the recipient’s public key, allowing only the recipient to decrypt it with their private key. This security feature provides:

• Confidentiality: Keeps the content private and readable only by the intended recipient

S/MIME Example

• Bob wishes to securely send the email with S/MIME to Mary
• Bob creates a digital certificate to generate the Digital Signature
• Bob “signs” the email message with his private key (Digital Signature)
• Bob openly shares his public key with Mary (Digital Signature)
• Bob also asks the public key of Mary to encrypt the email (Encryption)
• Mary verifies Bob’s message with Bob’s public key (Digital Signature)
• Mary decrypts the received message with her private key (Encryption)
• To send a reply email, Mary performs the same procedure from the start
• Both Bob and Mary will now have each other’s certificates for future correspondence

Check out the graphic below for a visual representation of how public key cryptography works.

Question 1: Which S/MIME component ensures that only the intended recipient can read the contents of an email message?#

Answer 1: Encryption

Task 6: Analyzing SMTP Responses

In this task, you will analyze a PCAP file with SMTP traffic. Some familiarity with traffic analysis using Wireshark will be helpful, as well as knowledge of SMTP Wireshark filters(opens in new tab) and status codes(opens in new tab).

Go ahead and deploy the machine attached to this task. It will appear in the split-screen view when it’s ready. Then, open the traffic.pcap file on the Desktop to begin your examination.

Question 1: Which Wireshark filter can you use to narrow down your results based on SMTP response codes?

Answer 1: smtp.response.code

Question 2: How many packets in the capture contain the SMTP response code 220 Service ready?

Answer 2: 19

Question 3: One SMTP response indicates that an email was blocked by spamhaus.org. What response code did the server return?

Answer 3: 553

Question 4: Based on the packet from the previous question, what is the full Response code: message?

Answer 4: Requested action not taken: mailbox name not allowed (553)

Question 5: Search for response code 552. How many messages were blocked for presenting potential security issues?

Answer 5: 6

Task 7: Inspecting Emails and Attachments

In this task, you’ll move beyond SMTP status codes and responses and begin analyzing SMTP traffic using the same traffic capture from the task above. You will utilize the Internet Message Format (IMF(opens in new tab)) to examine the inner details of emails, such as sender and recipient fields, content type, and attachments.

Question 1: How many SMTP packets are available for analysis?

Answer 1: 512

Question 2: What is the name of the attachment in packet 270?

Answer 2: document.zip

Question 3: According to the message in packet 270, which Host IP address is not responding, making the message undeliverable?

Answer 3: 212.253.25.152

Question 4: By filtering for imf, which email client was used to send the message containing the attachment attachment.scr?

Answer 4: Microsoft Outlook Express 6.00.2600.0000

Question 5: Which type of encoding is used for this potentially malicious attachment?

Answer 5: Base64

Task 8: How Organisation Stop Phishing

Now that you’ve explored how emails are authenticated through mechanisms like SPF, DKIM, and DMARC, and analyzed real SMTP traffic and message contents, let’s explore some modern solutions that enhance email security and reduce phishing risks.

Technical Defenses

Modern email systems employ various technical controls to help detect and block phishing messages before they reach users.

• Email Filtering(opens in new tab): Provides filtering based on IP and domain reputation, allowing for blocking or quarantining of suspicious messages.
• Secure Email Gateways(opens in new tab) (SEGs): Scan messages to detect impersonation attempts, spoofing, and other phishing techniques that other filters might miss.
• Link Rewriting(opens in new tab): Replaces suspicious or unknown URLs with safe, redirected ones, giving the system time to scan and verify the link.
• Sandboxing(opens in new tab): Isolates and tests suspicious links or attachments in a secure, virtual environment to check for malicious behavior.

User-Facing Tools & Training

Even with strong technical defenses in place, some phishing emails will inevitably reach users. Giving users clear visual cues and education is essential.

• Trust & Warning Indicators: Modern email platforms display visual cues to help users understand if a message is safe. A banner may read “External Sender,” “Suspicious Link,” or signify that a message is from a trusted organization or sender.
• Phishing Reporting: Easy, in-email reporting options that let users quickly report suspicious messages.
• User Awareness Training: Train employees on identifying phishing attempts, social engineering tactics, and safe email practices.
• Phishing Simulation Exercises: Run controlled phishing campaigns to test and reinforce employee training.

Question 1: A security team wants to implement a control to detect hidden malware inside email attachments.
They need a way to analyze suspicious files without risking infection on real systems.
Which protective technique would allow them to observe a file’s behavior safely?

Answer 1: Sandboxing

THANK YOU FOR READING !!!