PancakesCon 2 - Mishaal Khan - Phishing

### Overview In this PancakesCon 2 presentation, ethical hacker, penetration tester, and social engineer Mishaal Khan pairs two of his favorite practices: conducting professional phishing engagements and drawing digital caricatures. Khan explains that both disciplines require careful observation, iterative trial and error, and an understanding of human perception. While technical configurations are vital to running phishing simulations, the core goal is navigating around technical filters to evaluate and train human defenses.

### Key Topics - **Phishing Attack Lifecycle**: The end-to-end professional workflow starting with open-source intelligence (OSINT), crafting scenario-aligned templates and landing pages, tracking engagement metrics, identifying control gaps, and providing client remediation. - **Technical Infrastructure and Tooling**: Standing up independent mail servers and phishing frameworks on cloud platforms, selecting lookalike domains rather than attempting direct email address spoofing, and monitoring real-time telemetry. - **Evading Human and Technical Defenses**: Strategies for bypassing mail filters, using user-agent spoofing for operational security (OpSec), and formatting display names to deceive quick user glances. - **The Art of Caricature**: Khan’s artistic process using Procreate on an iPad, focusing on capturing the subject's distinct likeness and differences rather than mere exaggeration or realism. - **Ethical Considerations in Social Engineering**: Emphasizing positive influence over manipulative or punitive lures, maintaining professional integrity, and distinguishing ethical engagements from real-world malicious threat actors.

### Technical Details Khan walked through an end-to-end phishing simulation using GoPhish deployed on Google Cloud, paired with a custom self-hosted mail server (such as Mail-in-a-Box) to avoid the automated blocks often associated with commercial relay services like Mailgun. For the demonstration, he used a lookalike domain (`verificating.com`, missing an "i") and created a LinkedIn security alert template warning a fictional target ("Adam") that two-step verification was turned on from an unusual location in Moscow, Russia. Clicking the embedded link directed the target to a fake LinkedIn credential harvesting page hosted on `linkedin.verificating.com`.

During the live demonstration, GoPhish tracked interactions in real time, recording email delivery, opening, link clicking, and credential submission. Khan demonstrated good operational security (OpSec) by employing a user-agent switcher on his Mac to mimic a Windows system running Firefox. Once credentials were submitted, the target was redirected to the legitimate LinkedIn site to minimize suspicion. In the caricature portion, Khan demonstrated sketching social engineer Chris Hadnagy in Procreate, illustrating how he iteratively refined rough head proportions, 3/4 angle views, clothing, and background elements such as dropped malicious USB drives.

### Takeaways - **OSINT Determines Success**: High-quality reconnaissance ensures phishing templates align with legitimate internal organizational practices (e.g., matching actual shipping carriers or corporate systems). - **Bypass the Technical to Test the Human**: Direct email address spoofing is often blocked by filters, so penetration testers use lookalike domains, aged domains, or bracketed display-name tricks. If technical mail filters successfully block tests, whitelisting can allow teams to proceed to testing human resilience. - **Ethics and Influence over Manipulation**: Professional social engineering focuses on educational outcomes. Ethical hackers avoid fear-based or harmful lures (e.g., fake terminations, health emergencies, monetary gifts, or impersonating law enforcement) to prevent organizational distrust. - **Internal vs. External Testing**: Internal automated phishing tests with stock templates are useful for basic baseline checks, but external penetration testers are needed to simulate determined adversaries who customize lures to break through corporate defenses.