When we talk about cybersecurity, we usually think about hackers attacking computers, servers, or networks.

But there is another important target: people.

An attacker does not always need to directly break into a computer. Instead, they may try to trick a person into revealing information or performing an action that benefits the attacker.

This type of manipulation is known as Social Engineering.

As part of my cybersecurity learning, I performed a phishing attack simulation in my own virtual lab environment using two virtual machines. This practical helped me understand how phishing attacks work and, more importantly, how users can protect themselves from becoming victims.

Note: This practical was performed only in my own isolated lab environment for educational purposes.

What is Social Engineering?

Social engineering is an attack technique in which an attacker manipulates or deceives a person into revealing sensitive information, providing access, or performing an action that benefits the attacker.

In simple words:

Social Engineering = Tricking people instead of directly attacking the technology.

Simple Example

Imagine you receive an email saying:

"Your account will be blocked today. Click this link to verify your account."

You become worried and immediately click the link.

The attacker is using fear and urgency to make you act without thinking carefully.

This is an example of social engineering.

Common Types of Social Engineering Attacks

There are several types of social engineering attacks.

1. Phishing

Phishing involves sending fake emails or messages that try to trick users into:

• Clicking malicious links

• Opening attachments

• Entering credentials

• Sharing sensitive information

2. Spear Phishing

Spear phishing is a targeted phishing attack designed for a specific person or organization.

For example, an attacker may create an email specifically targeting an employee of a company.

3. Smishing

Smishing is phishing performed through SMS or text messages.

Example:

"Your bank account will be blocked. Click here to verify your account."

4. Vishing

Vishing is phishing performed through voice calls.

Example:

Someone calls pretending to be a bank employee and asks for your OTP or account information.

5. Pretexting

In pretexting, an attacker creates a believable story or fake identity to obtain information.

Example:

Someone pretends to be an IT employee and asks for your login credentials.

6. Baiting

Baiting uses something attractive to convince a victim to perform an action.

Example:

"Download this free software."

The downloaded file may contain malicious content.

What is a Phishing Attack?

Phishing is one of the most common forms of social engineering.

In a phishing attack, an attacker sends a fake email, message, or link that appears to come from a trusted person or organization.

The attacker may try to make the victim:

• Click a link

• Enter a username and password

• Download an attachment

• Provide an OTP

• Share sensitive information

A simple phishing attack can look like this:

1. Phishing Email ↓ 2. User Clicks the Link ↓ 3. Fake Website Opens ↓ 4. User Enters Credentials ↓ 5. Credentials May Be Exposed

This is why phishing awareness is important.

Step 1 — Creating the Phishing Simulation

I used the Social-Engineer Toolkit (SET) to perform the phishing simulation in my lab environment.

The basic idea was to create a webpage that looked similar to a legitimate login page and observe what happens when test credentials are submitted.

The screenshot shows the simulated login page opened in the browser.

The page contains a login interface where a user can enter credentials.

This demonstrates an important characteristic of phishing attacks:

A phishing page can be designed to look similar to a legitimate login page.

Therefore, users should not trust a website simply because it looks professional or familiar.

Step 2 — Target Machine Accesses the Page

Next, I opened the simulated phishing page from the target virtual machine.

When the browser accessed the webpage, the request reached the system running the phishing simulation.

The terminal shows the requests received from the target machine.

To understand what is happening, we can think of a simple web communication process:

Browser ↓ HTTP Request ↓ Web Server ↓ HTTP Response ↓ Webpage Displayed in Browser

This helped me understand how a browser communicates with a web server when accessing a webpage.

Step 3 — Submitting Test Credentials

I then entered test credentials into the simulated login page.

The terminal displayed the submitted test information in my controlled lab environment.

This demonstrates one of the major risks of phishing attacks.

If a user enters their real username and password into an attacker-controlled website, those credentials may be exposed to the attacker.

The important lesson is:

Never enter your credentials into a website until you have verified that the website is legitimate.

What Did I Learn From This Practical?

Before performing this lab, phishing might seem like simply sending a fake email.

After performing the practical, I understood the complete flow more clearly:

Attacker ↓ Sends Phishing Email ↓ User Clicks the Link ↓ Fake Login Page Opens ↓ User Enters Credentials ↓ Information May Be Captured

This practical helped me understand phishing from both a technical perspective and a security-awareness perspective.

Security Measures Against Phishing

Understanding how phishing works is useful, but knowing how to prevent it is even more important.

Here are some security measures users should follow.

1. Check the Sender's Email Address

Do not trust only the display name.

Always check:

• The complete email address

• The sender's domain

• Spelling mistakes

• Suspicious or unexpected domains

For example:

Display Name: Bank Support

But the actual email address could belong to a completely unrelated domain.

2. Check the Link Before Clicking

Before clicking a link:

• Hover over it and inspect the destination.

• Check the domain carefully.

• Look for spelling mistakes.

• Be cautious with shortened or unexpected URLs.

For example, a small spelling difference in a domain can be a warning sign.

3. Don't Rely Only on HTTPS

This is an important point.

You may hear:

"If the website has HTTPS, it is safe."

That is not necessarily true.

HTTPS encrypts communication between your browser and the website, but a phishing website can also use HTTPS.

Therefore:

Check HTTPS, but also verify the actual domain and the context in which you received the link.

4. Avoid Clicking Unexpected Links

If an email unexpectedly asks you to log in or verify your account, don't immediately click the link.

Instead:

Open your browser → Manually enter the organization's known website → Log in from there.

This reduces the risk of being redirected to a phishing website.

5. Check Suspicious Email Headers

If an email looks suspicious, examining its headers can provide additional information.

Important fields include:

• From

• Reply-To

• Return-Path

• Received

• Authentication-Results

You can also look at:

• SPF

• DKIM

• DMARC

These mechanisms help email systems authenticate and evaluate messages.

However, a single header field should not be treated as absolute proof that an email is legitimate.

6. Be Careful With Urgent Messages

Be especially careful when an email tries to make you panic.

For example:

"Your account will be deleted today!"

"Your payment failed. Act immediately!"

"Verify your account now!"

Attackers may use urgency, fear, or curiosity to make users act without checking the message properly.

Take a moment and verify the request.

7. Never Share Passwords or OTPs

Never share sensitive information through unexpected emails, messages, or phone calls.

This includes:

• Passwords

• OTPs

• MFA codes

• Recovery codes

• Banking credentials

• API keys

8. Enable Multi-Factor Authentication

Enable Multi-Factor Authentication (MFA) on important accounts.

For example:

Password + Authenticator approval

MFA provides an additional layer of protection if your password is compromised.

9. Be Careful With Email Attachments

Don't open unexpected attachments, especially if they come from unknown or suspicious senders.

Be particularly cautious with files such as:

• .exe

• .zip

• .docm

• .xlsm

If you were not expecting the attachment, verify it before opening it.

10. Keep Your System Updated

Keep your:

• Operating system

• Web browser

• Applications

• Antivirus/EDR

updated.

Security updates can help protect your system against known vulnerabilities.

11. Use Security Controls

Organizations can use multiple security controls to reduce phishing risks, including:

• Email security gateways

• Spam and phishing filters

• DNS filtering

• Secure Web Gateways

• Endpoint Detection and Response (EDR)

• Firewalls

• SIEM

• Multi-Factor Authentication

These controls can help detect, block, and investigate suspicious activity.

12. Report Suspicious Emails

If you receive a suspicious email:

Don't click → Don't reply → Don't enter information → Report it

In an organization, report the email to the IT or security/SOC team using the organization's reporting process.

What Should You Do If You Already Clicked a Phishing Link?

If you accidentally clicked a suspicious link, don't panic.

Take these steps:

If you only clicked the link:

• Close the webpage.

• Don't download anything.

• Don't enter credentials.

• Report the email to your security/IT team if applicable.

If you entered your password:

• Change the password immediately from the legitimate website.

• Don't reuse that password on other accounts.

• Enable MFA if available.

• Report the incident to the appropriate security team.

If you downloaded or opened a suspicious file:

• Stop interacting with the file.

• Disconnect from the network if instructed by your organization's security team.

• Report it immediately.

• Allow the security/IT team to investigate the system.

Key Takeaways

From this practical, I learned that:

• Social engineering targets people and their behavior.

• Phishing is a common type of social engineering.

• A phishing website can look very similar to a legitimate website.

• HTTPS alone does not mean a website is safe.

• Always verify the actual domain name.

• Check suspicious email sender information and headers.

• Understand the purpose of SPF, DKIM, and DMARC.

• Never share passwords or OTPs.

• Don't let urgency make you act without verification.

• Be careful with unexpected attachments.

• Enable MFA on important accounts.

• Report suspicious emails to the appropriate security team.

Conclusion

This hands-on lab helped me understand how a phishing attack works in a controlled environment.

Instead of learning phishing only through theory, I was able to observe the interaction between a browser and a simulated phishing server and understand how information submitted through an untrusted page can potentially be exposed.

The most important lesson I learned is:

Think before you click. Verify before you trust. Never enter your credentials without checking where you are.

Understanding phishing from both the attacker's perspective and the defensive perspective has helped me connect social engineering with email security, security awareness, and SOC investigation.