# Reconnaissance through Phishing in OT Environment
[ T1598.001 ] <(https://attack.mitre.org/techniques/T1598/001/)> 


**T1598.001 - Spearphishing Service** involves attackers impersonating legitimate services to trick targets into revealing sensitive information. In the context of an OT environment, this technique is used to identify key personnel and gather information necessary for planning subsequent attack stages.

---

## Objective

The primary objectives of using phishing in the reconnaissance phase are to:
- Identify individuals responsible for maintaining or operating specific OT systems.
- Collect contact information and system details for use in planning further attacks.
- Exploit social engineering techniques to gain unauthorized access or information.

---
## Tools/Services
### Social-Engineer Toolkit (SET):

**Purpose:** SET is an open-source Python-driven toolkit designed specifically for social engineering attacks, such as phishing, spear-phishing, credential harvesting, and more. It’s widely used by penetration testers to simulate real-world social engineering attacks. SET automates these techniques to make social engineering-based attacks more efficient and effective.

---
## Applying techniques:


### 1. Install the Social-Engineer Toolkit (SET) and Metasploit

If SET is not installed , follow these steps:

```bash
sudo apt-get update
sudo apt-get install git curl wget python3-pip
git clone https://github.com/trustedsec/social-engineer-toolkit.git
pip3 install -r requirements.txt
python3 setup.py install
```
If Metasploit is not installed, follow these steps:
```bash
apt-get update && apt-get install -y git curl wget python3-pip
apt install metasploit-framework
```

### 2. Launch SET

```bash
#Run the Social-Engineer Toolkit:
sudo python3 setoolkit
#Then pick Yes
```
![](https://drive.google.com/uc?export=view&id=1sOZpeQ8Z6xW4v8F7xX8SCsBvm8Gc77LA)

### 3.Choose the Phishing Attack Vector

- From the SET main menu, select 1) Social-Engineering Attacks.
  ![](https://drive.google.com/uc?export=view&id=1mYcEv7r2qlAI6Glxwm5lglyhmV0Aarqi)

- Next, choose 2) Website Attack Vectors.
  ![](https://drive.google.com/uc?export=view&id=1X6EWS6cukPO16XkAgcqOqrnmgiRxMQ2-)
- Then, select 3) Credential Harvester Attack Method.
    ![](https://drive.google.com/uc?export=view&id=1WEX0HrVvyojDJGzw3bEFljpwFrEFIiUc)
  
### 4. Clone a Website for Phishing
- Select 2) Site Cloner to clone an existing legitimate website (such as the company’s login page).
![](https://drive.google.com/uc?export=view&id=1vuNe_S0ry8uKoqfoXTnp1bc-VhtARa8g)
- Enter the IP address of the attacker's machine for the phishing server:
```bash
Enter the IP address for the POST back in Harvester/Tabnabbing: localhost:8082
```

- Enter the URL of the internal OT system login page or company portal you want to clone:
```bash
https://www.github.com/login
```


### 5. Send Phishing Emails
- Use the cloned website URL generated by SET (e.g., localhost:8082) in a phishing email.
- The email should appear to be from a legitimate source (e.g., an IT administrator) and prompt the recipient to log in or update their credentials.


### 6. Capture Information
When the victim clicks the phishing link and attempts to log in, SET will capture the credentials and display them in the terminal.
![](https://drive.google.com/uc?export=view&id=1D2EMAbGILidojuV0KkgKpL5R--NWRKOO)
![](https://drive.google.com/uc?export=view&id=1n869_8-9Jzpx2TXhGHrnXWx6RFJvDmPP)
### 7. Analyze Gathered Information
- Review the captured credentials and data.  
- The attacker may obtain login credentials to OT systems or specific details about personnel responsible for OT system updates.

---

## Next Steps
The gathered information from the Reconnaissance phase will be used to create a malicious USB drive in the Resource Development phase, with the aim of gaining access to the OT environment.

---
## Summary
### Reconnaissance (T1598.001) is successfully conducted using SET by:

- Cloning a legitimate website to deceive the target.
- Sending a phishing email to employees responsible for OT systems.
- Capturing login credentials and personnel details needed to plan further attacks.
