Spear phishing is a targeted email attack aimed at specific individuals within an organization. Unlike general phishing, spear phishing is personalized and often involves extensive reconnaissance to increase the likelihood of success.
* Understanding Spear Phishing:
* Targeted Attack: Focuses on specific individuals or groups within an organization.
* Customization: Emails are customized based on the recipient's role, interests, or recent activities.
* Purpose:
* Testing Security Awareness: Evaluates how well individuals recognize and respond to phishing attempts.
* Information Gathering: Attempts to collect sensitive information such as credentials, financial data, or personal details.
* Process:
* Reconnaissance: Gather information about the target through social media, public records, and other sources.
* Email Crafting: Create a convincing email that appears to come from a trusted source.
* Delivery and Monitoring: Send the email and monitor for responses or actions taken by the recipient.
* References from Pentesting Literature:
* Spear phishing is highlighted in penetration testing methodologies for testing security awareness and the effectiveness of email filtering systems.
* HTB write-ups and phishing simulation exercises often detail the use of spear phishing to assess organizational security.
Step-by-Step ExplanationReferences:
* Penetration Testing - A Hands-on Introduction to Hacking
* HTB Official Writeups