User Agent Strings in Phishing Campaigns: Identification and Evasion Techniques

User agent strings, often overlooked in phishing operations, offer a unique vector for targeting and evasion. The ability to identify the device, browser, and OS environment of a victim enables phishing operators to tailor their attacks more precisely, increasing the likelihood of successful engagement. This article provides a comprehensive guide to utilizing user agent strings to manipulate and mask your campaign’s presence, evading integration with security solutions. By the end of this article, you’ll be better equipped to leverage user agent strings to bypass detection mechanisms and craft attacks tailored to specific targets.

Prerequisites and Setup

Before delving into user agent manipulation, ensure your environment is set up for efficient execution. Begin with tools like GoPhish for your phishing frameworks and Wireshark for capturing and analyzing user agent data. Additionally, Google’s Page Speed Insights can help simulate different user environments to test your phishing pages.

Installation steps:

Set up GoPhish with the following command:


gophish --smtp-host 0.0.0.0 --smtp-port 25 --listen-email-admin=user@example.com

This command starts GoPhish connected to a specified SMTP server for sending phishing emails. Don’t forget to replace the email placeholder with your admin email.

Environment Configuration: For user agent testing, modify your website or phishing landing page’s server-side logic to log user agent data from headers. This setup allows precise adjustments based on detected environments. Additionally, use Node.js scripts for automated checks against typical user profiles.


curl -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" -o /dev/null www.yourphishingpage.com

This command allows you to test the server response with a specific user agent; useful for ensuring your site renders correctly as expected across different systems.

Step-by-Step Execution

Collecting User Agent Strings

Step 1: Start by intercepting traffic using Wireshark. Capture packets that involve HTTP requests which include the user agent header. Filter the traffic using:


http.user_agent contains "Mozilla"

This filter in Wireshark will display HTTP packets with user agents that contain “Mozilla”, a common substring in browser identifiers for Chrome, Firefox, and others.

Step 2: Extract data and analyze using a simple Python script to aggregate frequent user agent strings, helping pinpoint common targets among the captured data.


from collections import Counter



user_agents = [get_user_agent(packet) for packet in captured_packets]

common_agents = Counter(user_agents).most_common(10)

print(common_agents)

Analyze your captures to get the top 10 most common user agents, offering insights into typical systems that you might want to emulate or exclude.

Implementing Targeted Phishing Campaigns

Step 1: With your common user agent strings from the data analysis, craft your phishing email’s design to suit the detected environment. Use HTML/CSS adapted for specific browsers.


<body>

<div style="font-family: Arial, sans-serif;">

    <!-- conditional comments for IE targeting -->

    <!--[if IE]>

    <p>Special content for Internet Explorer users</p>

    <![endif]-->

    <p>Hello! Check this out:</p>

    <a href="http://phishingsite.com">Click here for a special offer</a>

</div>

</body>

This block helps adjust the rendering for Internet Explorer, ensuring legacy users receive a consistent experience with your lure.

Step 2: Emulate a realistic source by selecting user agents that match a genuine browsing session. Configure your phishing scripts or malware delivery mechanisms to serve different payloads based on the user agent string.


if 'Mozilla/5.0 (Windows NT 10.0; Win64; x64)' in request.user_agent:

    serve_payload_windows()

elif 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)' in request.user_agent:

    serve_payload_mac()

This code segment conditionally serves platform-specific payloads, enhancing the attack’s relevance and reducing security solution detection rates by not delivering all payloads universally.

Evading Detection

Evasion extends beyond merely masking the attack origin—deploy payloads with precision to prevent unnecessary exposure.

Step 1: Rotate user agent strings in your requests to mimic a series of different browsing activities, avoiding triggers from anomaly-based detection systems.


import random



user_agents = [

    "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...",

    "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36...",

    "Mozilla/5.0 (Linux; Android 8.0.0; SM-G960U) AppleWebKit/537.36..."

]



selected_agent = random.choice(user_agents)

This script selects a random user agent from the list for each request, simulating a broader user base and confusing simple analytics.

Advanced Variations

Variation 1: Scripted Emulation

Use a headless browser framework like Puppeteer to further emulate browsing activities, dynamically changing user agent strings as part of larger scripted interactions. This simulates legitimate user actions and reduces detection likelihood.


const puppeteer = require('puppeteer');



(async () => {

  const browser = await puppeteer.launch();

  const page = await browser.newPage();

  await page.setUserAgent('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...');

  await page.goto('http://example.com');

  // Perform more actions

  await browser.close();

})();

This script navigates to a site with a specified user agent, providing a realistic overview of user engagement for any target testing the phishing vector.

Variation 2: Automated User Agent Analysis

Utilize an integrated automation tool like Selenium to analyze target environments in real-time. This allows adaptive phishing strategies—dynamic delivery of content based on real-time information about the target’s browsing capabilities.


from selenium import webdriver

from selenium.webdriver.common.desired_capabilities import DesiredCapabilities



capabilities = DesiredCapabilities.CHROME

capabilities["goog:chromeOptions"] = {"args": ["--headless", "--disable-gpu"]}

driver = webdriver.Chrome(desired_capabilities=capabilities)

driver.execute_cdp_cmd('Network.setUserAgentOverride', {"userAgent": 'Mozilla/5.0 (X11; Linux x86_64)'})



driver.get('http://test-site-to-check')

# Do further automated tests or engagement simulation

driver.quit()

This script sets a custom user agent and automates browsing to monitor how the phishing site performs, adapting attack vectors in line with discovered parameters.

Good / Better / Best

Good: Simply substituting user agent strings for all requests—while indicating variety, it can still perform unnaturally and easy to detect due to no additional complexity. For instance:


curl -H "User-Agent: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1)" http://phishing-target.com

This request uses a basic user agent without differentiation or further action to bypass typical checks, relying on user trust alone.

Better: Leverage an existing user agent list to systematically vary each request based on traffic patterns learned from the target, enhancing campaign realism:


curl -H "User-Agent: $(shuf -n 1 user_agents.txt)" http://dynamic-phishing-target.com

The user agents are selected randomly, creating a pseudo-random yet identifiable pattern that closely matches typical client behavior.

Best: Integrate system and script simulations, performing additional browsing actions in a way that mimics genuine user interactions and machines:


(async () => {

  const browser = await puppeteer.launch({ headless: false });

  // define multiple actions mimicking user behavior

  const page = await browser.newPage();

  await page.setUserAgent('Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36...');

  await page.goto('http://even-more-realistic-target.com');

  await browser.close();

})();

This approach uses deeply integrated environmental mimicry to create session-based deception.

Related Concepts

Understanding user agent strings leads naturally to the topic of fingerprinting and browser impersonation. Techniques such as altering browser fingerprints can help further evade detection by creating convincing emulations of native devices. This article builds on the manipulation of user agent strings by expanding to full browser environments, increasing the depth of penetration testing engagements.