RuhrSec 2017: 'Teach a Man to Phish and You Feed Him for a Lifetime', Armin Buescher

Phishing might seem like a simple attack vector relying on gullible users to happily give up their credentials. When digging deeper into the topic however, one will find many interesting aspects of phishing that have not been widely reported.

This talk will dive into the analysis of so-called phishing kits: archives of server-side (mostly PHP) code that can be used to quickly turn a compromised or launched server into a phishing ground for the selected target. Leveraging the phishing detection capabilities of our team, we crawled known compromised servers and were able to download over five thousand phishing kits over the last couple of months.

Being able to analyze the server-side source code of phishing pages at large scale yields insights into the workings of phishing campaigns and opens new possibilities to the motivated security researcher:
- Finding and abusing bugs in the kits
- Evading evasion
- Automating the creation of robust detection
- Geographically tracking the phishers