# Phishing with Ngrok | Full Explanation! **URL:** \ **Category:** Tutorials & Methods\ **Tags:** tips-tricks\ **Created:** [May 26, 2020, 3:46am UTC](https://onehack.st/t/phishing-with-ngrok-full-explanation/88320 "2020-05-26T03:46:14Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\ **Post date:** [May 26, 2020, 3:46am UTC](https://onehack.st/t/phishing-with-ngrok-full-explanation/88320/1 "2020-05-26T03:46:15Z")
[Ngrok](https://www.ngrok.com/) is an amazing application for securely tunneling you local port/service from a public url. # How to pronounce Ngrok? **en-grok** # How it works? It connects to the ngrok cloud service which accepts traffic on a public address and relays that traffic through to the ngrok process running on your machine and then on to the local address you specified. # Pros You don’t need to configure port forwarding on your routers or waste time setting up dynamic DNS solutions like No-IP. You can protect the access by providing creds like password & share only with the desired person/client. You can tunnel almost every TCP connection \*\*\*\*\* Ngrok does not log or store any data transmitted through your tunneled connections. _I belive there are many advantages of using ngrok, but I found above pros fascinating._ # Cons It actually generates a public url randomly & if you want a custom url then you need to buy basic/pro version for custom domain or whitelabel domain. I can’t think of any other cons. Example: [https://d03f2b92.ngrok.io](https://d03f2b92.ngrok.io/) # How Ngrok plays a vital role in phishing? As we all know phishing is a way or method to steal creds like password or credit cards details. By default Ngrok securely tunnels your communication using **SSL/TLS**. Novice user usually trust **HTTPS** more than their life, using Ngrok we can abuse it. See the below example. ![](https://miro.medium.com/max/1504/1*N5QQveMzxSRlvIp6tEmvEw.png) Phishing Page As you can see the above phishing page of **Facebook,** it’s using **HTTPS**. For a novice user, it’s a secure site, to them secure means legitimate site. The moment they input username & password it will be delivered to attackers machine in clear text. See the below example ![](https://miro.medium.com/max/1516/1*VPTVKkbv-D5iXkch3XnITA.png) Captured Credentials # Demo Let’s quickly do a demonstration on Phishing using Ngrok. To perform this either you can use [setoolkit](https://github.com/trustedsec/social-engineer-toolkit) a.k.a Social Engineering Toolkit, developed by Dave kennedy @[hackingdave](https://twitter.com/hackingdave). Host your phishing pages locally using Apache & php. If you don’t want to do complicated stuff then you’d try this amazing automated tool called [SocialPhish](https://github.com/UndeadSec/SocialFish), developed by @[A1S0N\_](https://twitter.com/A1S0N_) (Alisson Moretto). SocialPhish is cross-platform, you can install this on macOS or Linux. Just hit the git page of SocialPhish & look for requirements. On Kali Linux it runs smoothly, I suggest you to try it on Kali. I tried it on macOS as well as Kali. [ ## Phishing Demo #### [asciinema.org](http://asciinema.org) ]([https://asciinema.org/a/hIT2i7NppEKboBj09lUV8EVXg](https://asciinema.org/a/hIT2i7NppEKboBj09lUV8EVXg)) Even tho if you try to anayle the URL using [VirusTotal](http://www.virustotal.com/), only Spamhaus detected this URL as Phishing. ![](https://miro.medium.com/max/1145/1*S-HygT7d4WwTZFn1pnhPXA.png) VirusTotal Result I’ve tried with other phishing analyzers, everytime I got negative result. If you have any other analyzing websites then let me know. # Then, how to detect? 1. Check for web address, make sure it’s that website only which you are willing to visit. 2. Do not click, I repeat, DO NOT CLICK ON LINKS, without analyzing. If you click, then check address bar. 3. Use [VirusTotal](http://www.virustotal.com/) or [IsItPhishing](http://www.isitphishing.org/) websites to analyze url. 4. Check for SSL/TLS certificate 5. If you think it’s phish page, then give false information first & wait for it. Hopefully it accepts your false information & redirects to original website\*. If you find any new ways to detect phish pages, then drop a comment here. If you have any suggestion or anything just drop here. > \*_ **Try it on your own risk.** _ > > _ **Disclaimer: TO BE USED FOR EDUCATIONAL PURPOSES ONLY** _ _`Source: Medium`_ ---
**Author:** ![Anime\_is\_LIFE](https://onehack.st/user_avatar/onehack.st/anime_is_life/32/17893_2.png) [@Anime\_is\_LIFE](https://onehack.st/u/Anime_is_LIFE)\ **Post date:** [May 26, 2020, 3:59pm UTC](https://onehack.st/t/phishing-with-ngrok-full-explanation/88320/2 "2020-05-26T15:59:41Z")
i think ngrok is not working with kali linux 2020 did u face this issue too? ---
**Author:** ![darekingdom](https://onehack.st/user_avatar/onehack.st/darekingdom/32/36081_2.png) [@darekingdom](https://onehack.st/u/darekingdom)\ **Post date:** [May 26, 2020, 5:44pm UTC](https://onehack.st/t/phishing-with-ngrok-full-explanation/88320/3 "2020-05-26T17:44:37Z")
Looks cool. I was just using ngrok for tunneling my local application to test on my mobile . I found this new way and looks fun. Should try soon.