Lab 1: Examine the Dangers of Malware and Phishing

In this lab, you will see how malware can manipulate web pages using the Document Object Model (DOM), and then you will see how easy it is to create a phishing web site:

Task 1 - Connect to Ravello and Use Chrome to Manipulate a Web Page

  1. Use a browser to access http://IP_address with the IP address supplied by your instructor, and log in using the username and password supplied by your instructor.

  2. For WebSafe Training Blueprint click View.

  3. Copy the IP address of the Windows 7 External VM, and then use RDP to access the IP address.

  4. Log into the Windows workstation as external_user / password.

  5. Update the Windows time:

    1. Select the clock and click Change date and time settings…
    2. Select the Internet Time tab, and then click Change settings…
    3. Select time.windows.com, and then click Update now.

  6. Open Chrome and press the F12 key, and then click the Bank bookmark.

  7. Examine the Elements tab.

    image1

    The <html> element is the top-level of the document object model tree. This element contains two child nodes, <head> and <body>, and the <body> node contains two <div class=…> child nodes.

  8. Expand the second <div> node, and then expand its child <div> node.

  9. Mouse-over the second child <div> node and examine the web page.

    This element represents the Demo Bank heading and the text below it.

  10. Expand the second child <div> node, then mouse over the <h2> element and the <p> element and examine the web page.

  11. Expand the <h2> node, then right-click on “ – Secure Online, and then select Edit text.

    image2

  12. Edit the element from – Secure Online to – Very Insecure Online, then press the Enter key.

  13. Examine the change to the web page.

    You’ve just made a simple change to the web page within the browser after it was sent from the web server.

  14. Copy the following text:

     1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
    <form method="POST">
<div class="form-group">
  Username: <input type="text" placeholder="" name="username" class="form-control">
</div>

<div class="form-group">
  Password: <input type="password" placeholder="" name="password" class="form-control">
</div>

<div class="form-group">
  ATM Pin: <input type="text" placeholder="" name="pin" class="form-control">
</div>

<input type="submit" class="btn btn-success" style="float:right" value="Login">
</form>

  15. In the web page, right click inside the Username field and select Inspect.

  16. Right-click the <form method=”POST”> line, and then select Edit as HTML.

    image3

  17. Select and delete all the text between the <form> opening tag and the </form> closing tag, then paste the text that copied to your clipboard earlier, then click outside of the <form> editing area and examine the web page.

  18. Enter the following credentials but do not click Login. Username: your first name Password: P@ssw0rd! PIN: your last name

  19. In the inspection window open the Console tab, and in the console, one at a time type (or copy and paste) each of the following and press Enter:

    document.forms[0].username.value

document.forms[0].password.value

document.forms[0].pin.value

    These values haven’t yet been submitted and are therefore available in cleartext for form grabbing.

  20. In the console, one at a time type (or copy and paste) each of the following and press Enter:

    document.forms[0].username.value = "bob"

document.forms[0].pin.value = "smith"

  21. Examine the web page form.

    Malware can manipulate the parameter values before they are submitted.

  22. Click the Bank bookmark, then click the Demo Tools bookmark, and from the Demo Tools click Start Keylogger, and then click on the Password field.

  23. For Password type P@ssw0rd1 and examine the top of the Demo Tools window.

    image4

    A keylogging program can capture the characters of the user’s password as they’re typed.

Task 2 - Create a Phishing Web Site

  1. Open the Start menu, then right-click on Notepad and select Run as administrator, and then click Yes.

    image5

  2. Go to File > Open, from the file types list select All Files, and then open the hosts file.

  3. At the end of the hosts file list, add a new entry for the following, and then save and close the hosts file.

    10.1.10.16 bank.vlab.f5demos.com

  4. In the banking page click the Bank bookmark.

  5. Right-click inside the page and select Save as.

  6. Navigate to the desktop and open the Phishing directory.

  7. Name the file login.html, ensure that Webpage, Complete is selected and click Save, and then close the banking page.

  8. Open WinSCP.

  9. Change the File protocol to SCP, for Host name type 10.1.1.252, and log in as root / default.

    This is a web server that’s been high jacked by a phishing hacker.

  10. In the left panel for the Windows workstation, navigate to the desktop and open the Phishing directory.

  11. In the right panel for the high-jacked web server, navigate to var/www/dvwa.

  12. Select both login.html and login_files and copy them into the dvwa directory, and then close WinSCP.

  13. Open an incognito window and access http://bank.vlab.f5demos.com/login.html.

    image6

  14. Enter the following credentials and click Login. Username: your first name Password: P@ssw0rd!

    Note

    Your login fails, however you have just submitted your username and password on the hacker’s phishing site.

  15. Close Chrome.

Task 3 - Configure BIG-IQ for Logging

  1. Open Chrome and click the BIGIQ_Mgmt bookmark, and then log into the BIG-IQ system as admin / admin.

  2. On the BIG-IQ Logging > Logging Nodes page click Add Node.

  3. Use the following information, and then click Add.

    Form field Value
    IP Address 10.1.20.248
    User name admin
    Password admin
    Transport Address 10.1.20.248
    Transport Port 9300

    It takes a couple of minutes to discover the logging node.

  4. Once the logging node has been discovered, click bigipqlogging.f5demo.com, and then open the Services page.

  5. For Fraud Protection Service, click Activate.

  6. Once the activation is complete, open a new tab and click the BIGIP_A bookmark, and then log into the BIG-IP system as admin / admin.

  7. Open the Pool List page and ensure that the bigiq_logging_pool displays as online.