emalderson

4 ms·

1.
by emalderson 3y ago
Well, the user doesn't create any .eml, he just selects "forward as attachment" on the email, so the .eml file creation is transparent to him. For everything else, you're right. Unfortunately, the practice of leaving the
2.
by emalderson 3y ago
Sure. Regarding the second approach, however, it may be difficult for a normal user to download the source code of the email and upload it on a server, or at least tedious. Regarding the first approach instead, I should find a way to interc
3.
by emalderson 3y ago
You're right. Maybe, in a production environment, there should be the option to set an internal or corporate email address. Gmail was used only for demonstration purposes in my thesis, since it was originally developed and presented at
4.
by emalderson 4y ago
Of course I forgot the word "detection" after phishing, thanks for pointing that out. Apart from that, I repeat that I'm conscious about what you are saying. This is the fundamental problem of phishing and social engineering
5.
by emalderson 4y ago
You're right from the start. Obviously, this is a PoC tool that is not mature enough to be used in a real-world and big-enterprise scenario. I have some ideas on how to make it more usable, like the automatic analysis of all emails by
6.
by emalderson 4y ago
Many emails may be safe and still raise some suspicion. Moreover, if the users who are meant to use the tool are not so tech savvy, then they may send all the emails to the SOC analyst. The safe ones will be usually flagged as safe rapidly,
7.
by emalderson 4y ago
Yes, it would be useful for a SOC-like scenario
8.
Show HN: I made an automated phishing email analysis tool called ThePhish(github.com)
4 points by emalderson 4y ago|15 comments
9.
Show HN: ThePhish: An automated phishing email analysis tool(github.com)
3 points by emalderson 4y ago|1 comments
10.
by emalderson 4y ago
ThePhish is an automated phishing email analysis tool based on TheHive, Cortex and MISP. It is a web application written in Python 3 and based on Flask that automates the entire analysis process starting from the extraction of the observabl