The most common security incidents result from account compromises due to credential theft. Credential harvesting is a technique employed by an attacker to compromise the user credentials. There are various ways to steal credentials from the victim; in this section, we will discuss one of them: phishing.

Phishing is a technique where an attacker constructs a website designed to look and feel like a legitimate website in an attempt to trick a user into providing their credentials or other sensitive information. Typically, an attacker will host this fake web page on a web server that they control and will send the link to victims through e-mail, social networking, or other communication tools. The attack is successful if the user follows the link and submits their credentials, where they are captured by the attacker in turn. This attack, when combined with MITM, can yield a higher rate of success since the attacker is in control of other services, such as DNS, which the user might first check if they are wary of clicking on an unsolicited link. In this section, we will host a site designed to look like the https://facebook.com page on the attacker machine and redirect all wireless clients to this page in order to harvest user credentials. We will use SET (Social Engineering Toolkit) to perform this attack.

In this attack exercise, we will leverage our evil twin access point again in order to provide us with visibility on the victim's traffic. Next, we set up Ettercap to falsify the DNS reply and divert the user visiting https://facebook.com to our local machine, where we are hosting a fake Facebook page. Once the user visits our phishing page, instead of the page they intended to visit, they will be prompted for login credentials. SET will provide us with the ability to mirror the target website and log the credentials entered from the redirected clients.