Hacking Facebook Passwords - Phishing

This topic is just to educate people about the ways your login details can get hacked by using a phishing website.

How does this work? Well it is very simple...
1: You create a website that looks exactly like the one you want to hack the login details from. This case it is Facebook.
2: You modify the code so that when a user wants to login; his or her details are stored in a file called passwords.txt for eg.
3: You now upload the fake site to your own server on the internet.
4: Now you have to find a way to send your victim a link to your fake site.
5: If your victim falls for the trick, he or she will try to login.
6: After your victim did the fake login attempt you redirect them to the real site, because the moment they get suspicious they will change their login details.
7: You now go to your fake site and open passwords.txt and you will find their login details stored there.
8: You now use those details to login to the real site.

Fortunately I already coded the site for you guys. The code I attached is the most complete version I know of on the internet as it will match the PC, Mobile and iPhone version of the Facebook website. Below are the steps you have to follow to get it working:

1: Download the zip file below: (File Removed)
2: Use google to search for a free web-host.
3: Register a domain that look similar to www.facebook.com ... for eg. register something like www.faccebook.com as your victim will not notice the difference that easily. You don't have to use a domain name if your victim is not very computer literate... an IP works as well, but not as successfully.
4: Now unzip the file you downloaded onto the server's root directory (sometimes known as home or public_html)... there should be a .htaccess and index.php file with some folders called pc, mobile and iphone.
5: Next test your fake website by visiting your domain... if should look exactly like facebook... use your mobile phone to test it as well.
6: The trick is to find a way to trick your victim into visiting your fake site thinking it is facebook. The best way is to post your site's link as your status and telling people it is something interesting like a very cool app.
A more personal attack can be done by registering for mobile notification on facebook and when you get a notification you just edit the link in the SMS to your fake site's link. Then forward this SMS to your victim and there is a good chance they might follow the link... just don't use your personal number as RICA was put into place to catch people when they do things like this.
7: Now visit your fake site's pc, mobile and iphone directories as there is a password.txt file in each folder. Once you caught your victim the login details will be saved in either pc/passwords.txt, mobile/passwords.txt or iphone/passwords.txt depending on which device they used.
8: Use those details to login on the real site.


I installed the fake site on a server for you to test: Facebook

Use any login credentials and download the password files here:
Passwords for PC
Passwords for Mobile
Passwords for iPhone

Enjoy, but remember that this is only to educate people and not to use on uninformed people.

Very clever !!!! Damn

So how do you get the face book look-a-like? Is it as easy as copying the source code?

BB_guy wrote:

Very clever !!!! Damn

So how do you get the face book look-a-like? Is it as easy as copying the source code?

Yes, you just copy the code and make a few changes... the file I attached is already complete and I added extra abilities so that mobile phones and iPhones can be fooled as well.

:woohoo:

Any body bank with ABSA, I guarantee fast and secure internet banking ....LMAO

www ASBA co.za

hehehe

Smile nice post

WOW hectic!

Did you notice when you type in your email and password at the top, it takes you to legit face book page?!?!?!(pretty cool)

The only bug is in the address bar, is an IP addy and not the "facebook com" domain name.

Its pretty cool though to see how it works

BB_guy wrote:

The only bug is in the address bar, is an IP addy and not the "facebook com" domain name.

Not really a bug and that's why you have to register a domain that looks similar to facebook so you can fool people easier...

Oh, there is a way to have the address bar show facebook.com, but I don't know how that is done without actually owning the domain... I think they must somehow use DNS...

admin wrote:

BB_guy wrote:

The only bug is in the address bar, is an IP addy and not the "facebook com" domain name.

Not really a bug and that's why you have to register a domain that looks similar to facebook so you can fool people easier...

Oh, there is a way to have the address bar show facebook.com, but I don't know how that is done without actually owning the domain... I think they must somehow use DNS...

With DNS poisoning you can do that.....

UltimateThug wrote:

admin wrote:

BB_guy wrote:

The only bug is in the address bar, is an IP addy and not the "facebook com" domain name.

Not really a bug and that's why you have to register a domain that looks similar to facebook so you can fool people easier...

Oh, there is a way to have the address bar show facebook.com, but I don't know how that is done without actually owning the domain... I think they must somehow use DNS...

With DNS poisoning you can do that.....

Ahh, do you know how to do that? Would like to learn that...

I went to Ispa's last Iweek and Coza had a guy talking about it, he was trying to promote IPV6 deployment as it doesn't have this flaw anymore.

You basically spoof as an authoritave DNS server providing a legit DNS resolution update, but just change the IP to one you would like it to be. It will then get saved in the cache of that DNS server and redirects everyone.

Very dangerous and the guy was saying everyone has been very surprised it hasn't been used more then what it has for attacks as there is limited defense against it, due to IPv4 open architecture and design.

Guessing there would be software that does this for you, like enter DNS server IP and start sending this IP for this domain....

admin wrote:

UltimateThug wrote:

admin wrote:

BB_guy wrote:

The only bug is in the address bar, is an IP addy and not the "facebook com" domain name.

Not really a bug and that's why you have to register a domain that looks similar to facebook so you can fool people easier...

Oh, there is a way to have the address bar show facebook.com, but I don't know how that is done without actually owning the domain... I think they must somehow use DNS...

With DNS poisoning you can do that.....

Ahh, do you know how to do that? Would like to learn that...

No PLEASE! No more of that! As soon as you post this noone will be able to go anywhere. PM ADMIN rather. :laugh:

UltimateThug wrote:

I went to Ispa's last Iweek and Coza had a guy talking about it, he was trying to promote IPV6 deployment as it doesn't have this flaw anymore.

You basically spoof as an authoritave DNS server providing a legit DNS resolution update, but just change the IP to one you would like it to be. It will then get saved in the cache of that DNS server and redirects everyone.

Very dangerous and the guy was saying everyone has been very surprised it hasn't been used more then what it has for attacks as there is limited defense against it, due to IPv4 open architecture and design.

Guessing there would be software that does this for you, like enter DNS server IP and start sending this IP for this domain....

Yes, this is very cool... I just had a look in my old security handbooks and I would like to attempt this...

Also found this video:

All this was very easy to do a few years back with TESO's BIND exploit hack some top level NS's... Also if you hack any NS and point 2 A recordings of www.blah.com to 2 different IP's you can 'spoof' in essence any site. You can even have IP X.X.X.X with VirtualHost IP:80 / ServerName ...

And then you can try pull down as much html as you can for a site and start your 'phishing' attack iike that. You actually only need the index / default page.

Or find some open NS's like afraid.org and people that don't have 'stealth' flags you an just hop on wwww.domain.com and spoof it, or if they don't have domain.com pointing to X IP then you can use that... and if its set to open not public then it wont even inform you that somebody has attached to that hostname... And there are THOUSANDS of domains on there...

Yeah very scary... but very fun, admin actually got me motivated to set up a lab at the office and play a bit...

hehe, those days for me are long over.. way to much heat.

I did something simular for MSN messenger and Myspace....

I simply installed in a internet cafe in the UK. .

One week = +-40 log in details..

I left it at that.

00pump wrote:

hehe, those days for me are long over.. way to much heat.

I'll keep it on the lan, just want to do it so I can say that I have

I've already thought about how to circumvent this.... If you NAT to your DNS servers it won't accept unsolicited replies.... All ports inbound are blocked on our firewalls it has to be established from the secure side to accept a reply...

Below is a phishing email I got this morning... it's fake obviously:

Do you know that with Absa Internet banking, you can eliminate the cost of receiving and transferring funds from or to your account?

Absa has introduced a new scheme for all account holders to receive a return on incurred charges over the year.
This benefit is available to all internet banking subscribers with a minimum balance of R1000.

You are hereby advised to verify your account in other to qualify for this benefit.

Click here to verify < www.wholesalerzoom.co.uk/secure_verifyme/index.php >

ABSA BANK
Internet Banking Team

Sons of bitches. Is there a (easy)way to trace where this type of thing comes from?

(I get a 404 error, when clicking on the link, site taken down already?)

WTF I checked the link in the 404 page, (www.W....co.uk)
and got 7 detected threats from Avast ?!?!?!?!?! WOW!!!

Son of a budgie...HECTIC!!!

Yep, that site is taken down already.

Remeber nobody can be 100% safe, specially with 0dayz

Just if none of you heard, old news but google was hacked

gizmodo.com/5449037/google-hacked-the-ch...e-hackers-right-back

www.wired.com/threatlevel/2010/01/operation-aurora/

www.computerworld.com/s/article/9146239/..._link_in_Google_hack

Stay secure