DNS Spoofing : Redirect Traffic On LAN To Your Fake Website

DNS Spoofing : Redirect Traffic On LAN To Your Fake Website

wifi hacking   23:36:00

WHAT IS DNS..?

DNS which stands for Domain Name System, is a naming system for computer, services, or any other resources connected on a network or Internet. DNS mainly serves the function of mapping Domain names which can be easily memorized by humans (like facebook.com) to their ip addresses (like 173.252.120.6), which are rather difficult to remember by us. The DNS is, in fact, its own network. If a DNS doesn't know how to translate a particular Domain Name then its contacts other DNS, and so on, until the correct ip address of the domian is found.

WHAT IS DNS SPOOFING..?

DNS Spoofing (Or DNS cache poisining) is a hacking attack, in which data is introduced in DNS resolver's cache, which makes the DNS to return wrong ip address for a Domain. Hence, redirecting the traffic to hacker's computer.

OK, so enough with the geeky part. Now lets get our hands dirty.. ;)

STEP #1

Start by firing up kali and starting S.E.T ( Social Engineering Toolkit ) which comes per-installed in kali.

Open terminal window, type setoolkit and hit enter. If you are using S.E.T for the first time, you will get a disclaimer policy, enter y and press enter. 
Then, you will get a window like this :

Now, Select 1 option Social - Engineering Attacks, by giving input 1.

Then, Select 2 option Website Attack Vectors in the next step.

Then select 3 option Credential Harvester Attack Method.


And then, 2 option Site Cloner.

After, selecting the site cloner option, you'll be asked the ip address of the POST back... Enter YOUR ip Address

 To know your ip address, open a new terminal window and type ifconfig, there inet addr. will be your ip address. Look in eth0 if you are on cabled network and in wlan0 if on wireless network.

you will, then, be asked to enter the site's url. Enter the url of the site for which you want to make a fake website.

We will take facebook.com here as an example.

After entering the site's url, you will get the following message :

If it asks you to turn apache server's on reply with yes.

Now, leave this terminal window as it (Don't close it) and open a new terminal window.

STEP #2

Now let's configure ettercap before using it. Ettercap is also pre-installed in Kali.

Open a new terminal window and input :

leafpad  /etc/ettercap/etter.conf

A new window like this will open :

Change the values of selected variables in above picture from the default values to 0.

Save & exit.

Now, in the terminal window, input :

sudo chmod 777 /etc/ettercap/etter.dns

Then,

leafpad /etc/ettercap/etter.dns

Again, a text document will open before you. In this document search for the following part:

 And, edit it to :

Here we are using facebook.com, so edit it and then save and exit.

We are now done with configuring ettercap. Now let's fire it up.

STEP #3

Now fire ettercap by typing :

ettercap -G

In the terminal (Not the one in which S.E.T is open.. Don't touch it till hack is over ). After doing so gui of ettercap will pop  on the scree.

Now, follow the images :

 

 Select eth0 if on cable network and wlan0 if on wireless network.

 After clicking on hosts list, a tab with list of all the devices connected to your network will be shown to you.

In the same tab assign Target 1 to your router's ip & Target 2 to your victim's ip.

Then, go to Plugins -> Manage The plugins.

In the tab that opens now, enable dns_spoof :

Then,

As soon as we click on Start Sniffing, our attack has been initiated. Now we have to wait until our victim visits facebook.com.

As soon as our victim visits facebook.com ettercap will notify us.. :

The credentials which the victim will enter on the facebook login page will be stored in a text file the path of which is given in the terminal in which S.E.T is running... :

Go to the given path , open the file and KABOOOOM ... ::

Your victim is Done with his account .. XD

Feel free to clear your queries in the comments.

How To Disable/Hide Seen On Facebook Chat/Messages

How To Disable/Hide Seen On Facebook Chat/Messages

tipstricks   23:59:00

Facebook is a largest social media platform. We perform different type of tasks like posting status, photos, making friends and do chatting with them. The basic reason behind Facebook addiction is chatting with friends. Almost every person who love to use Facebook want to spent their time by doing chatting with each and every person who is online at that time. Facebook chat having many different features like text chatting, video chatting, stickers, attach files, photos and more. Chat box includes additional settings like turn on and off chat for specific list and people, play sound facility and many other.

But for making user experience more better, Facebook introduce two real time working features like typing and seen messages which appears on both users end. Typing feature is amazing but few people don't like seen option. Just because after reading someone message seen option start appearing but problem is when we don't want to reply that specific person then seen option create trouble. Seen option is visible even chat is offline. No doubt we can easily mark then as unread manually but don't worry today i am going to discuss about how we can automatically hide seen option. So here is the tutorial about how to disable seen option on Facebook messages. This feature is very useful for those who work online and want to use Facebook side by side by doing chat online.

 

#1 Method To Disable Seen Option on Facebook Automatically

Note:- This method is working only on Web version and only on the same device where you will install below given extension according to browser type.

• First of all install Below given extension.

For Mozilla Firefox Visit Here

For Google Chrome Visit Here

• Choose and install above given extension according to browser type.
• After installing extension restart your browser.
• Now Login your Facebook account on that browser Seen option will not visible to your friends while doing chatting.

How To Check Extension Is Working Or Not ?

• Whenever someone send you a message simply reply or read that message. After reading visit to Message Box from Icon visible in navigation bar of Facebook.
• Now Checkout the color of that person message in inbox if the color visible is dark blue as compare to other messages after reading Or just reload Facebook if the Mark as Read option is visible then extension is working.

How to Disable Seen Extension ?

• In case you want to stop feature. Simply go to Add-one option in Firefox or extension option in chrome.
• Click on the disable or remove button visible in front extension we had installed.

   

  #2nd Method To Disable Seen Option in Facebook Chat (Manually)

  This is simple process almost every knows. In case you don't then must read about it.
• If you don't want to install any kind of extension then the option available for you is, by it doing manually.
• To do this when someone send you a message then go to inbox area >> Read the message >> After that click Mark as unread option.
• Now for each person where you want to hide seen option.. Every time you have to click on Mark as unread option after reading his or her message.

According to me if you really get irritate from messages then installing an extension is a good idea. If you like this trick and find working and useful must share it with others.

 In case you face any kind of issue feel free to ask in comments.

4 Ways to Crack a Facebook Password and How to Protect Yourself from Them

4 Ways to Crack a Facebook Password and How to Protect Yourself from Them

password   18:45:00

Despite the security concerns that have plagued Facebook for years, most people are sticking around and new members keep on joining. This has led Facebook to break records numbers with over one billion monthly active

users as of October 2012—and around 600 million active daily users.
We share our lives on Facebook. We share our birthdays and our anniversaries. We share our vacation plans and locations. We share the births of our sons and the deaths of our fathers. We share our most cherished moments and our most painful thoughts. We divulge every aspect of our lives. We even clamor to see the latest versions even before they're ready for primetime.

But we sometimes forget who's watching.

We use Facebook as a tool to connect, but there are those people who use that connectivity for malicious purposes. We reveal what others can use against us. They know when we're not home and for how long we're gone. They know the answers to our security questions. People can practically steal our identities—and that's just with the visible information we purposely give away through our public Facebook profile.

 The scariest part is that as we get more comfortable with advances in technology, we actually become more susceptible to hacking. As if we haven't already done enough to aid hackers in their quest for our data by sharing publicly, those in the know can get into our emails and Facebook accounts to steal every other part of our lives that we intended to keep away from prying eyes.

In fact, you don't even have to be a professional hacker to get into someone's Facebook account.

It can be as easy as running Firesheep on your computer for a few minutes. In fact, Facebook actually allows people to get into someone else's Facebook account without knowing their password. All you have to do is choose three friends to send a code to. You type in the three codes, and voilà—you're into the account. It's as easy as that.

In this article I'll show you these, and a couple other ways that hackers (and even regular folks) can hack into someone's Facebook account. But don't worry, I'll also show you how to prevent it from happening to you.

Method 1: Reset the Password

The easiest way to "hack" into someone's Facebook is through resetting the password. This could be easier done by people who are friends with the person they're trying to hack.

• The first step would be to get your friend's Facebook email login. If you don't already know it, try looking on their Facebook page in the Contact Info section.
• Next, click on Forgotten your password? and type in the victim's email. Their account should come up. Click This is my account.
• It will ask if you would like to reset the password via the victim's emails. This doesn't help, so press No longer have access to these?
• It will now ask How can we reach you? Type in an email that you have that also isn't linked to any other Facebook account.
• It will now ask you a question. If you're close friends with the victim, that's great. If you don't know too much about them, make an educated guess. If you figure it out, you can change the password. Now you have to wait 24 hours to login to their account.
• If you don't figure out the question, you can click on Recover your account with help from friends. This allows you to choose between three and five friends.

•  It will send them passwords, which you may ask them for, and then type into the next page. You can either create three to five fake Facebook accounts and add your friend (especially if they just add anyone), or you can choose three to five close friends of yours that would be willing to give you the password.

How to Protect Yourself

• Use an email address specifically for your Facebook and don't put that email address on your profile.
• When choosing a security question and answer, make it difficult. Make it so that no one can figure it out by simply going through your Facebook. No pet names, no anniversaries—not even third grade teacher's names. It's as easy as looking through a yearbook.
• Learn about recovering your account from friends. You can select the three friends you want the password sent to. That way you can protect yourself from a friend and other mutual friends ganging up on you to get into your account.

Method 2: Use a Keylogger

Software Keylogger
A software keylogger is a program that can record each stroke on the keyboard that the user makes, most often without their knowledge. The software has to be downloaded manually on the victim's computer. It will automatically start capturing keystrokes as soon as the computer is turned on and remain undetected in the background. The software can be programmed to send you a summary of all the keystrokes via email.
CNET has Free Keylogger, which as the title suggests, is free. If this isn't what you're looking for, you can search for other free keyloggers or pay for one.

Hardware Keylogger
These work the same way as the software keylogger, except that a USB drive with the software needs to be connected to the victim's computer. The USB drive will save a summary of the keystrokes, so it's as simple as plugging it to your own computer and extracting the data. You can look through Keelog for prices, but it's bit higher than buying the software since you have the buy the USB drive with the program already on it.

How to Protect Yourself

• Use a firewall. Keyloggers usually send information through the internet, so a firewall will monitor your computer's online activity and sniff out anything suspicious.
• Install a password manager. Keyloggers can't steal what you don't type. Password mangers automatically fill out important forms without you having to type anything in.
• Update your software. Once a company knows of any exploits in their software, they work on an update. Stay behind and you could be susceptible.
• Change passwords. If you still don't feel protected, you can change your password bi-weekly. It may seem drastic, but it renders any information a hacker stole useless.

Method 3: Phishing

This option is much more difficult than the rest, but it is also the most common method to hack someone's account. The most popular type of phishing involves creating a fake login page. The page can be sent via email to your victim and will look exactly like the Facebook login page. If the victim logs in, the information will be sent to you instead of to Facebook. This process is difficult because you will need to create a web hosting account and a fake login page.

The easiest way to do this would be to follow my detailed instructions available. Users are very careful now with logging into Facebook through other links, though, and email phishing filters are getting better every day, so that only adds to this already difficult process. But, it's still possible, especially if you clone the entire Facebook website.

How to Protect Yourself

• Don't click on links through email. If an email tells you to login to Facebook through a link, be wary. First check the URL. If you're still doubtful, go directly to the main website and login the way you usually do.
• Phishing isn't only done through email. It can be any link on any website / chat room / text message / etc. Even ads that pop up can be malicious. Don't click on any sketchy looking links that ask for your information.
• Use anti-virus & web security software, like Norton or McAfee.

Method 4: Stealing Cookies

Cookies allow a website to store information on a user's hard drive and later retrieve it. These cookies contain important information used to track a session that a hacker can sniff out and steal if they are on the same Wi-Fi network as the victim. They don't actually get the login passwords, but they can still access the victim's account by cloning the cookies, tricking Facebook into thinking the hacker's browser is already authenticated.

Firesheep is a Firefox add-on that sniffs web traffic on an open Wi-Fi connection. It collects the cookies and stores them in a tab on the side of the browser.

From there, the hacker can click on the saved cookies and access the victim's account, as long as the victim is still logged in. Once the victim logs out, it is impossible for the hacker to access the account.

How to Protect Yourself

• On Facebook, go to your Account Settings and check under Security. Make sure Secure Browsing is enabled. Firesheep can't sniff out cookies over encrypted connections like HTTPS, so try to steer away from HTTP.
• Full time SSL. Use Firefox add-ons such as HTTPS-Everywhere or Force-TLS.
• Log off a website when you're done. Firesheep can't stay logged in to your account if you log off.
• Use only trustworthy Wi-Fi networks. A hacker can be sitting across from you at Starbucks and looking through your email without you knowing it.
• Use a VPN. These protect against any sidejacking from the same WiFi network, no matter what website you're on as all your network traffic will be encrypted all the way to your VPN provider.

Protecting Yourself: Less Is More

Social networking websites are great ways to stay connected with old friends and meet new people. Creating an event, sending a birthday greeting and telling your parents you love them are all a couple of clicks away.

Facebook isn't something you need to steer away from, but you do need to be aware of your surroundings and make smart decisions about what you put up on your profile. The less information you give out on Facebook for everyone to see, the more difficult you make it for hackers.

If your Facebook account ever gets hacked, check out our guide on getting your hacked Facebook account back for information on restoring your account.

Phishing : For Dummies XD

Phishing : For Dummies XD

website hacking   18:44:00

Today, I'm going to show you how a saavy Social Engineer would trick a friend into unknowingly surrendering their Facebook password. My intent is to warn and demonstrate how easy it is to succumb to phishing via Social Engineering, and therefore expose yourself.

What is Phishing?

Phishing is the act of tricking someone into signing onto a fake website, which mimics a real site, such as Facebook. The phishing page will log the credentials that the user enters in the password field, and usually goes unnoticed with the right circumstances and some Social Engineering.

The phishing page is created by visiting the website you want to mock, copying the source HTML code, and then altering it to use a custom PHP script to log the victim's credentials. A good phishing page will seamlessly use cookies to bypass redirect filters. So if a cookie for the site exists, the user will be logged in and more than likely won't realize what happened.

Warnings

• Phishing is illegal.
• Only phish your friends who give you consent to do so.

Step 1 Get a Web Host

You need a place to host your phishing page. I like T35—they are free, and offer cPanel hosting.

1. Make a free account on T35.
2. Go to your email that you used and click the link confirming the account.

Step 2 Create the Phishing Page

Now we need to create the site that will log the victim's credentials.

1. Open up a text document using notepad, or your choice in text editors.
2. Go to the Facebook login page.
3. Right-click somewhere on the page, and click View page source.
4. Copy all of the contents of the source code and paste them into your text document.
5. Hit ctrl + f, and search for "action=" and change the method to "GET", and the text to the right of"action=" to "log.php".
6. Click File > Save as and save it with the name "index.php" (make sure to click the drop-down menu to select "all files" if it's not selected already).
7. Make a new text file, and paste this as the contents (paste the raw text, not the numbered). This is the file written in PHP that logs the victim's login details.
8. Save the file as "log.php". Again, make sure "all files" is selected in the file type drop-down menu.
9. Log in to your T35 account and click Upload. Upload both files to the root of your website (not in a folder).
10. When credentials are logged, they will be in a file called "passwords.txt" in the root of your website. Check the box next to the "passwords.txt" file when you get some logs, and click chmod. Change the file to 466 permissions, so other people can't read the victim's passwords.

Step 3 Perform the Phish

In a status update on Facebook, post something like the following:

    "Check out this funny picture of me on my website xD <post link to phishing page here>."

It's really that simple. You should start to see people's login credentials getting stored in your "passwords.txt" file. Simply because it comes from a "trusted" Facebook friend, they will go with their instincts and click the link without thinking twice about it. The best part about that PHP code posted above, is the header sends you back to the Facebook homepage, bypassing the redirect filter warning that Facebook has implemented, which will make it nearly seamless to the user who fell for it.

How to Get Your Hacked Facebook Account Back.

How to Get Your Hacked Facebook Account Back.

password   17:12:00

If your facebook account was hacked by someone and you really want it back this tutorial would help you get it back.

Step 1:

First goto this link. https://www.facebook.com/hacked
Click the button "Your account has been Compromised".

 

 

Then type in your email address, Login name , Full Name or your specified Phone No.
Then facebook would search for matching users. If you still don't see your account, try entering something else other than the one you entered.
( for example if you entered your phone number and it didn't work try entering your email or Login name.) Most of the time using your email would be the wisest choice.)
And hit Search. :)

 

Step 2:

Well now the kind of difficult part begins. But I don't think it would be for you.
Now for this step you got to enter your account's password. Well if you knew the password you won't be here anyway, cause you don't know your new password the Hacker's changed, enter your old password. The password that you use, to enter into your account before you got HACKED :<

 

 

 

 

Step 3:

Then cause you entered an old actually now wrong password this page will come up.
Well no need to be down yet. Just click the reset my password button.

 

Step 4:

Your primary email would be changed so well of course you don't want to send your reset your password link to the hacker's account so, Click "no longer have access to these?" link.

 

Step 5:

Well now you almost got your account back.
Now write your new email address that you want to send the change password link as well set as your primary email.

 

Step 6:

Well now, follow the next steps and you would have your account back in 24 hours. XD