Lab 04
Information Security
LAB INSTRUCTOR: MISS AQSA
Student Name : Syed Arqam hussain.
Student id : Bs-AI
Course: Information Security
Department: Artificial intelligence & mathematical science
Semester:3
Section: III-B
Information Security – Lab 4
Topic: Email Security and Phishing Awareness
Objective:
To understand what phishing is, how cybercriminals trick users through fake emails or
websites, and how to identify and protect against phishing attempts.
1. Phishing
Phishing is a cyber-attack technique where attackers send fake emails or messages
pretending to be from trusted sources (like banks, social media, or school accounts) to
steal information such as passwords, credit card numbers, or personal details.
Example:
“Your account has been locked! Click here to verify your password.”
The link looks real but takes you to a fake website that steals your login details.
2. Types of Phishing Attacks:
Type Description Example
Email Phishing Fake emails asking for “Verify your account
credentials now!”
Spear Phishing Targeted attack on specific Fake email to a company
person or organization employee
Smishing Phishing via SMS “Your package is delayed.
Click this link.”
Vishing Voice call phishing Scammer calls pretending
to be bank representative
3. Signs of a Phishing Email:
Suspicious sender address (like support@[Link])
Generic greetings (“Dear user”)
Urgent or threatening language (“Your account will be suspended”)
Unknown attachments or links
Misspelled URLs (like [Link])
Tips for Staying Safe Online
Never click on unknown links or attachments.
Malicious links or files can install malware or steal your personal data.
Always check the sender’s email domain.
Attackers often use fake addresses that look similar to real ones (e.g.,
support@[Link]).
Look for HTTPS and the padlock symbol 🔒 before entering login details.
HTTPS ensures your data is securely transmitted and encrypted.
Use strong, unique passwords for each account.
Combine uppercase, lowercase, numbers, and symbols — and avoid reusing the same
password.
Enable Two-Factor Authentication (2FA) wherever possible.
Even if your password is stolen, 2FA provides an extra layer of protection.
Online Practice (No Download Required):
We’ll use Google’s official Phishing Quiz to practice identifying fake and real emails.
Website:
[Link]
Lab Procedure:
Step 1: Open your browser and go to: [Link]
Step 2: Enter your name to start the quiz.
Step 3: You will see 8 sample emails — some real, some fake. For each email, click
“This is Phishing” or “This is Legitimate.”
Step 4: Read the explanation after each choice.
Step 5: At the end, note your final score and review your mistakes.
Step 6: Take a screenshot of your result page showing your score.
Student Tasks:
\
Task 1: Take the phishing quiz and record your score (e.g., 6/8 correct).
Task 2: List five warning signs that helped you identify fake emails.
Mismatched Domain name
Scammer uses urgency to hide the most important details.
Ask for OTP.
Fake or misspelled URL.
Hacker use name of google to hide their link.
Task 3: Take one example screenshot from the quiz (a phishing email) and explain why
it’s suspicious.
Explanation:
Here you can clearly see the difference between the domain name and email address on
the red spotted area that’s how you can catch this email is phishing email.
Task 4: Visit a few real websites and note whether they use HTTPS or HTTP.
Phishing Quiz: {use https}
[Link]
Quora : {uses https}
[Link]
Adobe : {uses https}
[Link]