7 Minute Security

Today we're revisiting how to make a kick-butt cred-capturing phishing campaign with Gophish, Amazon Lightsail, LetsEncrypt, ExpiredDomains.net and a special little extra something that makes creating phishing landing pages waaaaaaayyyyyyyyyy easier! For some quicker review, you can check out part 1 and also the complementary YouTube video, but I wanted to revisit this kick-butt process and update a few items: First, this SingleFile extension is amaaaaaaaazing for making phishing landing pages with ease! The process to get GApps to let you generate an app-specific password for using with GoPhish is kinda annoying. The steps below should get you going: After domain registration, log into admin.google.com or click Manage Workspace button at checkout. At the next screen click Workspace Admin Console. Sign in with the person you’ll be spoofing from, and the temporary password emailed to your backup email account during checkout. In the search bar search for Less Secure Apps, choose Allow users to manage the