orig_sub: ''
            domain: 'okta.com'
            search: 'X-Frame-Options: DENY'
            replace: 'Test: test'
            mimes: ['text/html', 'charset=utf-8']
          ```
            - Frame Busting Techniques Generally used
              - https://en.wikipedia.org/wiki/Framekiller
              - https://seclab.stanford.edu/websec/framebusting/framebust.pdf
                - Common Techniques to Detect Presence of iframe
                  ```
                    if (top != self)
                    if (top.location != self.location)
                    if (top.location != location)
                    if (parent.frames.length > 0)
                    if (window != top)
                    if (window.top !== window.self)
                    if (window.self != window.top)
                    if (parent && parent != window)
                    if (parent && parent.frames && parent.frames.length>0)
                    if((self.parent&&!(self.parent===self))&&(self.parent.frames.length!=0))
                  ```
                - Websites may use following method once iframe detected to perform redirection
                   ```
                   top.location.replace(self.location)
                    top.location.href = window.location.href
                    top.location.replace(document.location)
                    top.location.href = window.location.href
                    top.location.href = "URL"
                    document.write(’’)
                    top.location = location
                    top.location.replace(document.location)
                    top.location.replace(’URL’)
                    top.location.href = document.location
                    top.location.replace(window.location.href)
                    top.location.href = location.href
                    self.parent.location = document.location
                    parent.location.href = self.document.location
                    top.location.href = self.location
                    top.location = window.location
                    top.location.replace(window.location.pathname)
                    window.top.location = window.self.location
                    setTimeout(function(){document.body.innerHTML=’’;},1);
                    window.self.onload = function(evt){document.body.innerHTML=’’;}
                    var url = window.location.href; top.location.replace(url)
                   ```
                
### Evilginx अनुसंधान ब्लॉग/वार्ताएँ :
- A smooth sea never made a skilled phisherman - Kuba Gretzky (x33fc0n 2024) :
    - Talk : [https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R](https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R)
    - Slides : [https://github.com/kgretzky/talks/blob/main/2024/x33fcon/a-smooth-sea-never-made-a-skilled-phisherman.pdf](https://github.com/kgretzky/talks/blob/main/2024/x33fcon/a-smooth-sea-never-made-a-skilled-phisherman.pdf)
- The triforce of initial Access : [https://trustedsec.com/blog/the-triforce-of-initial-access](https://trustedsec.com/blog/the-triforce-of-initial-access)
    - Bobber : [https://github.com/Flangvik/Bobber](https://github.com/Flangvik/Bobber)
- Bypassing Canary AiTM Detection : [https://insights.spotit.be/2024/06/03/clipping-the-canarys-wings-bypassing-aitm-phishing-detections/](https://insights.spotit.be/2024/06/03/clipping-the-canarys-wings-bypassing-aitm-phishing-detections/)
- Protect Evilginx using cloudflare and HTML obf : [https://www.jackphilipbutton.com/post/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation](https://www.jackphilipbutton.com/post/how-to-protect-evilginx-using-cloudflare-and-html-obfuscation)
- (Improve Evilginx email delivery trust) Adding SPF, DMARC, DKIM, MX records : [https://fortbridge.co.uk/research/add-spf-dmarc-dkim-mx-records-evilginx/](https://fortbridge.co.uk/research/add-spf-dmarc-dkim-mx-records-evilginx/)
    - [https://m3rcer.netlify.app/redteaming/spamfilterbypass/](https://m3rcer.netlify.app/redteaming/spamfilterbypass/)
- Phishing Tactics and OPSEC : [https://mgeeky.tech/uploads/WarCon22 - Modern Initial Access and Evasion Tactics.pdf](https://mgeeky.tech/uploads/WarCon22%20-%20Modern%20Initial%20Access%20and%20Evasion%20Tactics.pdf)
- Evilginx + BITB + Evasion Tactics : [https://youtu.be/p1opa2wnRvg](https://youtu.be/p1opa2wnRvg)
- Hook, Line and Phishlet - Conquering AD FS With Evilginx : [https://research.aurainfosec.io/pentest/hook-line-and-phishlet/](https://research.aurainfosec.io/pentest/hook-line-and-phishlet/)
- O365 Phishing Infrastructure - [https://badoption.eu/blog/2023/12/03/PhishingInfra.html](https://badoption.eu/blog/2023/12/03/PhishingInfra.html)
- You Can’t See Me – Protecting Your Phishing Infrastructure : [https://redsiege.com/blog/2024/01/you-cant-see-me-protecting-your-phishing-infrastructure/](https://redsiege.com/blog/2024/01/you-cant-see-me-protecting-your-phishing-infrastructure/)
- [https://janbakker.tech/evilginx-resources-for-microsoft-365/](https://janbakker.tech/evilginx-resources-for-microsoft-365/)
- Evilginx + BITB - [https://www.youtube.com/watch?v=luJjxpEwVHI&feature=youtu.be](https://www.youtube.com/watch?v=luJjxpEwVHI&feature=youtu.be)
- Hook, Line and Sinker: Phishing Windows Hello for Business using Evilginx : [https://medium.com/@yudasm/bypassing-windows-hello-for-business-for-phishing-181f2271dc02](https://medium.com/@yudasm/bypassing-windows-hello-for-business-for-phishing-181f2271dc02)
- Phishing the resistant - Phishing for primary Refresh token in Microsoft Entra by Dirk Jan  : [https://youtu.be/tNh_sYkmurI?si=qcb917IB5zHU1fQk](https://youtu.be/tNh_sYkmurI?si=qcb917IB5zHU1fQk)
- X33fcon 2024 - [https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R](https://youtu.be/Nh99d3YnpI4?si=Ltwus2PS0z97gf2R)
- Like Shooting Phish in a Barrel - Bypassing Link Crawlers : ****https://posts.specterops.io/like-shooting-phish-in-a-barrel-926c1905bb4b
- Drink Like a Phish - How to Make Your Phishing Sites Blend In ****: [https://posts.specterops.io/drink-like-a-phish-b9e91d0b5677](https://posts.specterops.io/drink-like-a-phish-b9e91d0b5677?source=collection_home---6------0-----------------------)
- Feeding the Phishes : ****https://posts.specterops.io/feeding-the-phishes-276c3579bba7
- https://posts.specterops.io/phish-out-of-water-aaeb677a5af3
- https://youtu.be/6jYZQKDlKco?si=cpfd4tWQ4V8ZAZaI
- https://posts.specterops.io/one-phish-two-phish-red-teams-spew-phish-1a2f02010ed7
- Push Security Phishing Tools Detection : https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d
    - Push Security का chrome एक्सटेंशन कुछ कमजोर नियमों के साथ evilginx का पता लगाता है
        - नियम 1: Cookie name=XXXX-XXXX & value=64_hex_chars
        - नियम 2: Script path=/s/64_hex_chars.js with content-length=0
        - नियम 3: दोनों नियम 1 और नियम 2 मौजूद हैं
        - पूरा snippet js blob logic यहाँ है https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d
- https://janbakker.tech/evilginx-loves-temporary-access-passes-too/
          
### Evilginx के विरुद्ध रक्षा रणनीतियाँ
- Unravelling and Countering Adversary in the middle Phishing - X33fcon 2024 - [https://youtu.be/-W-LxcbUxI4](https://youtu.be/-W-LxcbUxI4?feature=shared)
- Using HoneyTokens to detect AiTM : [https://zolder.io/using-honeytokens-to-detect-aitm-phishing-attacks-on-your-microsoft-365-tenant/](https://zolder.io/using-honeytokens-to-detect-aitm-phishing-attacks-on-your-microsoft-365-tenant/)
- Protect Against Modern Phishing : [https://bleekseeks.com/blog/how-to-protect-against-modern-phishing-attacks](https://bleekseeks.com/blog/how-to-protect-against-modern-phishing-attacks)
- [https://www.youtube.com/watch?v=wTLB0Yh70_0](https://www.youtube.com/watch?v=wTLB0Yh70_0)
- JA3, JA3S, JA4 फिंगरप्रिंटिंग का उपयोग करके evilginx का पता लगाना
    - JA4 Database : [https://ja4db.com/](https://ja4db.com/)
    

    



## GoPhish Infra को सुरक्षित करना

> ये संशोधन नवीनतम evilginx + gophish संस्करण यानी evilginx3.3 में भी काम करेंगे
> 
- सुझाव : evilginx के साथ उपयोग करते समय फ़िशिंग टेम्पलेट में {{.URL}} पैरामीटर का उपयोग करें ( [https://github.com/kgretzky/evilginx2/issues/1042#issuecomment-2052073864](https://github.com/kgretzky/evilginx2/issues/1042#issuecomment-2052073864))
- GoPhish Infra को सुरक्षित करने के लिए gophish स्रोत कोड और फ़ाइल संरचना में संशोधन
    - `X-Gophish` इंस्टेंस हटाएँ ( `X-Gophish-Contact` , `X-Gophish-Signature`)
    - `const ServerName= "gophish"` हटाएँ और इसे `const ServerName= "IGNORE"` में बदलें फ़ाइल `config/config.go` में
    - `config.json` फ़ाइल में डिफ़ॉल्ट Admin सर्वर पोर्ट बदलें।
    - SMTP परीक्षण के दौरान पहचान से बचने के लिए परीक्षण ईमेल संदेश हस्ताक्षर संशोधित करें। `Controllers > api > util.go`
        
        ```yaml
        Controllers > api > util.go
        models > testdata > email_request.go
        models > testdata > email_request_test.go
        models > testdata > maillog.go
        models > testdata > maillog_test.go
        models > testdata > smtp_test.go
        ```
        
    - 404 प्रतिक्रिया बदलें
        - नीचे दिए गए कस्टम फंक्शन को `controllers/phish.go` फ़ाइल में जोड़ें
            
            ```go
            func customNotFound(w http.ResponseWriter, r *http.Request) {
            	http.Error(w, "Try again!", http.StatusNotFound)
            }
            ```
            
        - अब `http.NotFound(w, r)` के सभी उदाहरणों को `customNotFound(w, r)` से बदलें
    - robots.txt हार्डकोडेड प्रतिक्रिया हटाएँ और इसे `controllers/phish.go` फ़ाइल में संशोधित करें
        - phish.go फ़ाइल में संबंधित कोड को नीचे दिए गए कोड में बदलें।
            
            ```go
            //Modified Response
            // RobotsHandler prevents search engines, etc. from indexing phishing materials
            func (ps *PhishingServer) RobotsHandler(w http.ResponseWriter, r *http.Request) {
            	fmt.Fprintln(w, "User-agent: *\nDisallow: /*/*\nDisallow: /.git/*")
            }
            ```
            
    - अनुरोधों में `"rid"` GET पैरामीटर संशोधित करें
        - सुनिश्चित करें कि `"rid"` के सभी उदाहरणों को किसी और चीज़ में बदल दिया गया है।
        - ये evilginx3.3 स्रोत कोड में भी मौजूद हैं, इसलिए वहाँ भी संशोधित करना सुनिश्चित करें।
    - उन्नत रोकथाम के लिए, आप स्टैटिक फ़ोल्डर को भी संशोधित कर सकते हैं और इसे किसी और चीज़ का नाम दे सकते हैं, साथ ही पथ-आधारित पहचान से बचने के लिए इसके अंदर की फ़ाइलों का नाम बदल सकते हैं। बस प्रासंगिक स्रोत कोड को भी संशोधित करना न भूलें।
        - जैसे images name, उदाहरण : pixel.png, इसे किसी और चीज़ में बदलें।
    - `util/util.go` फ़ाइल में प्रमाणपत्र गुण बदलें
        
        ```go
        	template := x509.Certificate{
        		SerialNumber: serialNumber,
        		Subject: pkix.Name{
        			//Organization: []string{"Gophish"},
        			Organization: []string{"Microsoft Corporation"},
        		},
        ```
        
    - किसी भी Golang सर्वर फिंगरप्रिंट से बचने के लिए Nginx का उपयोग करके ट्रैफ़िक को प्रॉक्सी करें
        - `service nginx start`
        - आपको gophish `config.json` को बदलने की आवश्यकता है ताकि http के लिए पोर्ट 80 से 8080 और https के लिए डिफ़ॉल्ट से 60002 में बदल जाए, जैसा कि नीचे दिखाया गया है
            
            ```yaml
            {
            	"admin_server": {
            		"listen_url": "127.0.0.1:60002",
            		"use_tls": true,
            		"cert_path": "gophish_admin.crt",
            		"key_path": "gophish_admin.key",
            		"trusted_origins": []
            	},
            	"phish_server": {
            		"listen_url": "127.0.0.1:8080",
            		"use_tls": false,
            		"cert_path": "example.crt",
            		"key_path": "example.key"
            	},
            	"db_name": "sqlite3",
            	"db_path": "gophish.db",
            	"migrations_prefix": "db/db_",
            	"contact_address": "",
            	"logging": {
            		"filename": "",
            		"level": ""
            	}
            }
            ```
            
        - नीचे दिया गया कॉन्फ़िगरेशन "Bot" या "bot" वाले user agent वाले सभी अनुरोधों को ब्लॉक करेगा
            
            ```yaml
            # /etc/nginx/nginx.conf
            
            events {
                # Define event processing parameters here
                worker_connections 1024; # Adjust according to your requirements
            }
            
            http {
            
                upstream backend {
                    server localhost:8080;
                }
                # HTTP server
                server {
                    listen 80 default_server;
                    
            
                    # Reject requests with "bot" or "Bot" in User-Agent
                    if ($http_user_agent ~* (bot|Bot)) {
                        return 403;
                    }
            
                    location / {
                        proxy_pass http://backend;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            
                upstream backend_https {
                    server localhost:60002;
                }
                # HTTPS server
                server {
                    listen 60001 ssl default_server;
            
                    ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
                    ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;
            
                    # Reject requests with "bot" or "Bot" in User-Agent
                    if ($http_user_agent ~* (bot|Bot)) {
                        return 403;
                    }
            
                    location / {
                        proxy_pass https://backend_https;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            }
            
            ```
            
        - केवल विशिष्ट user agent की अनुमति देने के लिए, नीचे दिए गए कॉन्फ़िगरेशन का उपयोग करें। यह सभी अनुरोधों को ब्लॉक करेगा और केवल उन अनुरोधों की अनुमति देगा जिनमें user agent "`iamdevil`" है।
            
            ```yaml
            # /etc/nginx/nginx.conf
            
            events {
                # Define event processing parameters here
                worker_connections 1024; # Adjust according to your requirements
            }
            
            http {
            
                upstream backend {
                    server localhost:8080;
                }
            
                # HTTP server
                server {
                    listen 80 default_server;
            
                    # Reject requests with user agent other than "iamdevil"
                    if ($http_user_agent != "iamdevil") {
                        return 403;
                    }
            
                    location / {
                        proxy_pass http://backend;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            
                upstream backend_https {
                    server localhost:60002;
                }
            
                # HTTPS server
                server {
                    listen 60001 ssl default_server;
            
                    ssl_certificate /root/Phishing/gophish-mod/gophish_admin.crt;
                    ssl_certificate_key /root/Phishing/gophish-mod/gophish_admin.key;
            
                    # Reject requests with user agent other than "iamdevil"
                    if ($http_user_agent != "iamdevil") {
                        return 403;
                    }
            
                    location / {
                        proxy_pass https://backend_https;
                        proxy_set_header Host $host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
                        proxy_set_header X-Forwarded-Proto $scheme;
                    }
                }
            }
            ```
            
    - हस्ताक्षरित ट्रैकिंग पिक्सेल के आधार पर पहचान से बचने के लिए Gophish ट्रैकिंग पिक्सेल हस्ताक्षर संशोधित करें।
    - Gophish ईमेल हेडर अनुक्रम पैटर्न बदलें। इसका उपयोग gophish का पता लगाने के लिए किया जा सकता है (BreakDev Red Community से)।
    - IOCs और ईमेल की अन्य पहचान और स्पैमनेस को हटाने के लिए gophish के सामने PostFix सेट अप करें और हेडर को भी हटाएँ और ठीक करें।

- **GoPhish अनुसंधान ब्लॉग/वार्ताएँ :**
    - [https://edermi.github.io/post/2021/modding_gophish/](https://edermi.github.io/post/2021/modding_gophish/)
    - [https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls](https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls)
    - [https://cyberwarfare.live/wp-content/uploads/2023/08/OPSEC-on-the-High-Seas_-A-Gophish-Adventure.pdf](https://cyberwarfare.live/wp-content/uploads/2023/08/OPSEC-on-the-High-Seas_-A-Gophish-Adventure.pdf)
    - [https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls](https://www.sprocketsecurity.com/resources/never-had-a-bad-day-phishing-how-to-set-up-gophish-to-evade-security-controls)
    - [https://github.com/puzzlepeaches/sneaky_gophish](https://github.com/puzzlepeaches/sneaky_gophish)
    - [https://cybercx.co.nz/blog/identifying-gophish-servers/](https://cybercx.co.nz/blog/identifying-gophish-servers/)
    - [https://github.com/gophish/gophish/issues/1553#issuecomment-523969887](https://github.com/gophish/gophish/issues/1553#issuecomment-523969887)

- **GoPhish के विकल्प :**
    - SniperPhish : https://github.com/GemGeorge/SniperPhish
    - Mailcow : https://github.com/mailcow/mailcow-dockerized


## AiTM पोस्ट एक्सप्लॉइटेशन / फ़िशिंग अनुसंधान ब्लॉग/वार्ताएँ

- AiTm (Post Exploitation) : https://www.youtube.com/live/WY4mH-8TbWY?si=LkZ1LuduDln1vRuj
    - https://youtu.be/py68OE4tQ4Q?si=n6QlNuro88c1PRzn
- https://trustedsec.com/blog/the-triforce-of-initial-access
- https://www.youtube.com/live/tOzURCc-qUc?si=DMkLwXHVQomRMEJD## अन्य तकनीकें/ब्लॉग/शोध
- फिशिंग के लिए वैध साइटों का दुरुपयोग : https://lots-project.com/
- Muraena : https://github.com/muraenateam/muraena
- NecroBrowser : https://github.com/muraenateam/necrobrowser
- BITB : https://mrd0x.com/browser-in-the-browser-phishing-attack/
    - Frameless-bitb : https://github.com/waelmas/frameless-bitb
        - https://youtu.be/luJjxpEwVHI?si=sk8kMfdfhZbTz8qR
    - CuddlePhish : https://github.com/fkasler/cuddlephish
    - https://pushsecurity.com/blog/phishing-2-0-how-phishing-toolkits-are-evolving-with-aitm/
    - Okta Chained with Azure with auto MFA Subscription for Okta and Frame Buster Bypass to perform BITB : https://x.com/otterhacker/status/1929487165458641045?s=46&t=mlJvZy0Zrkrxzuvtt7m2cQ
        - https://github.com/OtterHacker/OktaGinx/
- प्रोग्रेसिव वेब ऐप्स (PWA) फिशिंग : https://mrd0x.com/progressive-web-apps-pwa-phishing/
- noVNC फिशिंग : https://adepts.of0x.cc/novnc-phishing/
    - EvilnoVNC : https://github.com/JoelGMSec/EvilnoVNC
    - MultiEvilnoVNC : https://blog.wanetty.com/blog/tools/multievilnovnc
    - https://fhlipzero.io/blogs/6_noVNC/noVNC.html
    - Delusion (NoVNC पर आधारित टूलकिट) : https://cloud.google.com/blog/topics/threat-intelligence/session-stealing-browser-in-the-middle
    - NoVNC का पता लगाना : https://gist.github.com/rad9800/bb73de360fc07ac544f0bc9faac9082d
- noVNC और Docker : https://powerseb.github.io/posts/Another-phishing-tool/
    - https://github.com/powerseb/NoPhish
    - https://fhlipzero.io/blogs/6_noVNC/noVNC.html
    - https://github.com/Macmod/YesPhish/tree/patchright-chrome
- EvilQR - QR फिशिंग
    - QR जनरेट करें : https://github.com/Flangvik/QRucible
    - https://badoption.eu/blog/2024/01/08/mobilephish.html
    - QR2Ascii : https://github.com/Jojodicus/qr2eascii
    - https://github.com/kgretzky/evilqr , https://breakdev.org/evilqr-phishing/
    - https://github.com/swagkarna/EvilJack
    - https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/hunting-for-qr-code-aitm-phishing-and-user-compromise/bc-p/4054850
- NoPhish (docker और noVNC) : https://github.com/powerseb/NoPhish और https://badoption.eu/blog/2023/07/12/entra_phish.html
- EvilGoPhish : https://github.com/fin3ss3g0d/evilgophish
- स्मिशिंग : https://blog.shared-video.mov/systematic-destruction-hacking-the-scammers-pt.-2
- CloudFlare Workers के साथ फिशिंग
    - TryCloudflare : https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
    - https://github.com/zolderio/AITMWorker
    - https://gist.github.com/RedTeamOperations/33f245a777c9b322b0466b59d6687f15
    - https://cyberwarfare.live/wp-content/uploads/2023/08/Certified-Red-Team-CredOps-Infiltrator-CRT-COI-1.pdf
- Cloudflare पब्लिक बकेट के साथ फिशिंग : https://developers.cloudflare.com/r2/buckets/public-buckets/
    - https://medium.com/trac-labs/aitm-phishing-hold-the-gabagool-analyzing-the-gabagool-phishing-kit-531f5bbaf0e4
- फिशिंग के लिए Google ओपन रीडायरेक्शन
    - https://untrustednetwork.net/en/2024/02/26/google-open-redirect/
    - ओपन रीडायरेक्ट (काम नहीं कर रहा) : https://googleweblight.com/i?u=m4lici0u5.com
    - ओपन रीडायरेक्ट : https://www.google.com/url?q=https://m4lici0u5.com
    - ओपन रीडायरेक्ट : https://business.google.com/website_shared/launch_bw.html?f=https://m4lici0u5.com
    - अधिक यहां पाया जा सकता है : https://lots-project.com/
- https://blog.delivr.to/delivr-tos-top-10-payloads-dec-24-pastejacking-image-less-qr-codes-and-concatenated-zip-a32e668106dd#878d
- Azure Information Protection का उपयोग करके मेल सुरक्षा नियंत्रणों को पार कर फिशिंग
    - https://youtu.be/tHNi5BzScVo?si=H2czog19AmTp_O26
    - https://youtu.be/EYUp_MNtJIk?si=sg_9RQggDvqOSLNL
    - https://youtu.be/KhdzIPPW4W0?si=E4CmWx0iO8EaR6JF
- https://nicolasuter.medium.com/aitm-phishing-with-azure-functions-a1530b52df05
- https://pushsecurity.com/blog/a-new-class-of-phishing-verification-phishing-and-cross-idp-impersonation/
- https://blog.delivr.to/delivr-tos-top-10-payloads-dec-24-pastejacking-image-less-qr-codes-and-concatenated-zip-a32e668106dd#878d
- https://trustedsec.com/blog/oops-i-udld-it-again
- Docusign दुरुपयोग द्वारा क्रेडेंशियल फिशिंग : https://sublime.security/blog/living-off-the-land-credential-phishing-via-docusign-abuse/
- EML अटैचमेंट के साथ छिपी क्रेडेंशियल फिशिंग : https://sublime.security/blog/hidden-credential-phishing-within-eml-attachments/
- https://sublime.security/blog/talking-year-end-credential-phishing-scams-over-turkey/
- फिशिंग के लिए Microsoft Customer Voice का उपयोग : https://cofense.com/blog/microsoft-customer-voice-urls-used-in-latest-phishing-campaign
- https://www.youtube.com/live/tOzURCc-qUc?si=DMkLwXHVQomRMEJD
- DoubleClickJacking : https://www.paulosyibelo.com/2024/12/doubleclickjacking-what.html
    - https://safetyscience.info/labs/doubleclickjacking/
- विभिन्न तकनीकों की तुलना : https://blog.quarkslab.com/technical-dive-into-modern-phishing.html
- https://cloud.google.com/blog/topics/threat-intelligence/session-stealing-browser-in-the-middle
- फिशिंग के लिए इनकमिंग Microsoft Teams वेबहुक का दुरुपयोग : https://www.blackhillsinfosec.com/wishing-webhook-phishing-in-teams/
    - https://www.youtube.com/live/kMMZrd9intI?si=rd_EKWmXeKbbGAEI
- फिशिंग के लिए Rogue RDP या RDP (.rdp) : https://github.com/GoSecure/pyrdp
    - https://cloud.google.com/blog/topics/threat-intelligence/windows-rogue-remote-desktop-protocol
    - https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
- https://easydmarc.com/blog/google-spoofed-via-dkim-replay-attack-a-technical-breakdown/
- फिशिंग के लिए SVG : https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/pixel-perfect-trap-the-surge-of-svg-borne-phishing-attacks/
- प्रारंभिक पहुंच के लिए फिशिंग के साथ ClickOnce का उपयोग : https://www.netspi.com/blog/technical-blog/adversary-simulation/all-you-need-is-one-a-clickonce-love-story/
- https://denniskniep.github.io/posts/09-device-code-phishing/
- https://badoption.eu/blog/2025/04/25/github.html
- https://atticsecurity.com/blog/aitm-for-whfb-persistence/
- [अवश्य देखें] Evilworker : https://github.com/Ahaz1701/EvilWorker
    - https://medium.com/@ahaz1701/evilworker-da94ae171249

## फिशिंग शोध वार्ताएं
- https://youtu.be/zmo_tPbCXtA?si=4imjZtwQ6I9iu_tP