Hack Facebook / Twitter Accounts by stealing cookies

In this tutorial i will explain how you can hack a Facebook/twitter accounts by stealing cookies. This method works only when the victims computer is in a LAN (local area network ).Best place to try out this is in schools ,collages ,cafes . where computers are connected in LAN .Before i proceed let me first explain "cookies "

What Are Cookies ? And What Is The Use Of Stealing Cookies ?
Cookies are small files that stored on users computer by websites when a user visits them. The stored Cookies are used by the web server to identify and authenticate  the user .For example when a user logins in Facebook a unique string is generated and one copy of it  is saved on the server and other is saved on the users browser as Cookies. Both are matched every time the user does any thing in his account

So if we steal the victims cookie and inject them  in our browser we will be able to imitate the victims identity to the web server and thus we will be able to login is his account . This is called as Side jacking .The best thing about this is that  we need not no the victims id or password all we need is the victims cookie



Hack Facebook / Twitter By Stealing Cookies
Things we need :-
1. Ettercap or Cain and able for ARP poisoning the victim
2. Wire shark for sniffing and stealing cookies
3. Firefox browser and Cookie logger add on for injecting the stolen cookies in our browser


Procedure :-


1. First ARP poison the victim .For this you can refer my previous articles on how to ARP poison the victims computer using Cain and able or Ettercap

2. After ARP poisoning open Wire shark ,click capture button from the menu bar , then select interface .Now select your interface (usually eth0 ) finally click start capture .

3. Now you can see the packets being captured , wait for a while till the victim logs in his account( Facebook /twitter ),

4. Mean while Find the IP address of Facebook ,for this you can open  CMD (command prompt ) and enter .Ping Facebook.com to find its IP address

5. Now filter the packets by entering the the IP address (Facebook) in the filter bar and click apply

6. Now Locate HTTP Get /home.php  and copy all the cookie names and values in a note pad as shown

7. Now open Firefox and open add and edit cookies ,which we downloaded earlier , add all the cookie values and save them as shown

8. Now open Facebook in a new tab , you will be logged in the victims account .


Voilà ......you have hacked the victims Facebook account by stealing cookies , You can also follow the same steps to hack  Twitter accounts


Hope you enjoyed this tutorial , If you have any doubts please feel  free to post a comment    

- See more at: http://hitsfits.blogspot.com/2013/07/hack-facebook-twitter-accounts-by.html#sthash.A7F5P45u.dpuf

Read More

How To Hack Remote ADSL routers

ADSL routers also known as DSL modems is a device used to connect the computer to the DSL phone line for using Internet Services (broad band ).These ADSL routers have a serious vulnerability in them, which most of you are not aware off . In this post I will show you how to exploit this common vulnerability that lies in most ADSL routers so as to gain complete access to the router settings 

Hack Remote ADSL Routers ( DSL modems )
Every DSL modem (router) comes with a user name and password using which it is possible to gain access to the router settings and configure the device. The vulnerability actually lies in the Default user name and password that comes with the factory settings. Usually the routers come preconfigured from the Internet Service provider and hence the users do not bother to change the password. This makes it possible for the attackers to gain unauthorized access and modify the router settings using a common set of default user names and passwords. Here is how you can do it.

Things Required :-

1. IP Scanner  - To scan IPs
2. Any Web Browser

Procedure :-

1. First Install and open IP Scanner, Enter the Ip Range that you want to scan, Being a broadband user, I prefer to scan  my own IP range, you can find your Ip address by going to whatismyip.com

2. After Entering the Range , go to options and select options, check only open ports radio button as show , finally click OK button

3. Now go to options and click "select ports " Enter Port 80 as shown and click OK


4. Now click start scan , After a few minutes the scanner will show a list of  Ips with port 80 open

5. Now copy one of the IPs from the list , and paste it  in your browser and hit enter , You will be prompted for the login details , just enter admin for both the login name and password , If your lucky you shall gain access to the router settings page as shown

If you do not succeed to gain access, select another IP from the list and repeat the step-5. At least 1 out of 5 IPs will have a default password and hence you will surely be able to gain access.

Exploitation
By gaining access to the router settings, it is possible for an attacker to modify any of the router settings which results in the malfunction of the router. As a result the target user’s computer will be disconnected from the Internet. In the worst case the attacker can copy the ISP login details from the router to steal the Internet connection 

The attacker can also specify a fake DNS server for the victim router and could carry out phishing attacks. The attacker can change the ISP's DNS servers to his own controlled DNS server, thus making a redirection of DNS for phishing. This attack is believed to be one of the most stealth attack on this kind of scenario.


Counter Measures
If you are using an ADSL router to connect to the Internet, it is highly recommended that you change your default router password


Hope you enjoyed the post , For further doubts and clarifications please pass your comments  - See more at: http://hitsfits.blogspot.com/2013/07/how-to-hack-remote-adsl-routers.html#sthash.c1q0DAQp.dpuf

Read More

How Hackers Use Your IP Address to Hack Your Computer & How to Stop It

Your IP (Internet Protocol) address is your unique ID on the internet. It's synonymous with your home address. Anyone in the world can contact your computer through its IP address, and send a retrieve information with it.
I'm sure at one time or another you've heard that hackers can hack your computer via your IP address. This is one of the reasons proxies and anonymity services exist, to protect people from learning your IP address. So how are hackers using just an address to get into your computer and make your life hell?
Open ports. Your computer runs services like media sharing on what are called ports. A port is just an opening that a service uses as a communications endpoint. There are 65,535 total allocated ports in TCP/UDP. To exploit a service on a port, a hacker would banner grab for the software and version. After they learn that information, they would search sites like Packet Storm for known exploits to run against the service.
Today's Null Byte is going to demonstrate a simple "port scan" on local computer using Nmap, and teach how a hacker would exploit these services, as well as how to guard ourselves against it. This will be done under Linux, but Nmap is available for all platforms. If you can't figure out how to install it in Windows with the GUI installer (yeah, right), follow along using Cygwin.

Step 1 Download & Install Nmap

Bold words are commands that must be entered in a terminal emulator.
First, we must download Nmap, which is going to be our tool that we use for port scanning and information gathering:
    wget http://nmap.org/dist/nmap-5.51.tar.bz2
Now, extract the archive:
    tar -zxvf nmap-5.51.tar.bz2
Change to the newly made directory:
    cd 
This is the standard installation procedure:
   ./configure
   make && sudo make install
Nmap should now be installed!

Step 2 Scan for a Target

Let's scan a local computer. I'm going to use a website as an example, rather than a local computer. This is because my firewall is absolutely crazy, and filters out scans. Don't scan a remote computer with the intentions of doing bad deeds. This is for educational purposes only.
Start by mapping out your local network:
    sudo nmap -sP 192.168.1.0/24
That should return a list of hosts that are up for a port scan!

Step 3 Scan Your Individual Target

Out of the returned list of targets, pick one that you would like to scan for services. Let's do a full scan of all the TCP/UDP ports:
    sudo nmap -p 1-65535 -T4 -A -v 
You should get something that looks like the following image:

As you can see, this target has MANY open ports. SSH piques my interest, so let's move on to banner grabbing to learn the software version or our choice of service.

Step 4 Banner Grabbing

For this, you can use the regular ol' telnet client. Telnet comes with Windows and most Linux distros:
    telnet 
From this, I would learn which software version the service is running, then see if I can find a way to exploit it.

How Can I Protect Myself?

Luck for all of you lovely people, I recently made a tutorial on iptables, which will filter out unwanted connections. Also, disable any unnecessary programs that connect to the internet (remote administration, media sharing, etc).
Windows users, install Comodo firewall, it's incredible and uses a simple point and click installation, and will filter ports for you. It has great default settings and it is free. - See more at: http://hitsfits.blogspot.com/2013/03/how-hackers-use-your-ip-address-to-hack.html#sthash.ST0IDnwf.dpuf

Read More

4 Ways to Crack a Facebook Password and How to Protect Yourself from Them

Despite security issues that have plagued Facebook for several years, people keeping staying around and new people keep on signing up. This has led Facebook to break records numbers with over one billion monthly active users as of October 2012—and around 600 million active daily users.
We share our lives on Facebook. We share our birthdays and our anniversaries. We share our vacation plans and locations. We share the births of our sons and the deaths of our fathers. We share our most cherished moments and our most painful thoughts. We divulge every aspect of our lives.
But we seemingly forget who's watching.
We use Facebook as a tool to connect, but there are those people who use that connectivity for malicious purposes. We reveal what others can use against us. They know when we're not home and for how long we're gone. They know the answers to our security questions. People can practically steal our identities—and that's merely with the visible information we purposely give them through our Facebook profile.

The scariest part is that as technology advances, we become more susceptible to hacking. As if we didn't already do a great enough job to aid these hackers, they can get into our emails and Facebook accounts and steal every other part of our lives that we intended to keep away from prying eyes.
And you don't have to be a professional hacker to get into someone's Facebook account.
It can be as easy as letting Firesheep run on your computer for a few minutes. In fact, Facebook allows a user to get into their Facebook without knowing their password. All they have to do is choose three friends to send a code to. You type in the three codes and voilà—you're into the account. It's as easy as that.
These are a few other ways that hackers, and even regular folks, can hack into someone's Facebook account and ways to prevent it from happening to you.

Reset the Password

The easiest way to "hack" into someone's Facebook is through resetting the password. This could be easier done by people who are friends with the person they're trying to hack.

• The first step would be to get your friend's Facebook email login. If you don't already know it, try looking on their Facebook page in the Contact Info section.
• Next, click on Forgotten your password? and type in the victim's email. Their account should come up. Click This is my account.
• It will ask if you would like to reset the password via the victim's emails. This doesn't help, so press No longer have access to these?
• It will now ask How can we reach you? Type in an email that you have that also isn't linked to any other Facebook account.
• It will now ask you a question. If you're close friends with the victim, that's great. If you don't know too much about them, make an educated guess. If you figure it out, you can change the password. Now you have to wait 24 hours to login to their account.
• If you don't figure out the question, you can click on Recover your account with help from friends. This allows you to choose between three and five friends.

• It will send them passwords, which you may ask them for, and then type into the next page. You can either create three to five fake Facebook accounts and add your friend (especially if they just add anyone), or you can choose three to five close friends of yours that would be willing to give you the password.

How to Protect Yourself

• Use an email address specifically for your Facebook and don't put that email address on your profile.
• When choosing a security question and answer, make it difficult. Make it so that no one can figure it out by simply going through your Facebook. No pet names, no anniversaries—not even third grade teacher's names. It's as easy as looking through a yearbook.
• Learn about recovering your account from friends. You can select the three friends you want the password sent to. That way you can protect yourself from a friend and other mutual friends ganging up on you to get into your account.

Use a Keylogger

Software Keylogger
A software keylogger is a program that can record each stroke on the keyboard that the user makes, most often without their knowledge. The software has to be downloaded manually on the victim's computer. It will automatically start capturing keystrokes as soon as the computer is turned on and remain undetected in the background. The software can be programmed to send you a summary of all the keystrokes via email.
CNET has Free Keylogger, which as the title suggests, is free. If this isn't what you're looking for, you can search for other free keyloggers or pay for one.

Hardware Keylogger
These work the same way as the software keylogger, except that a USB drive with the software needs to be connected to the victim's computer. The USB drive will save a summary of the keystrokes, so it's as simple as plugging it to your own computer and extracting the data. You can look through Keelog for prices, but it's bit higher than buying the software since you have the buy the USB drive with the program already on it.

How to Protect Yourself

• Use a firewall. Keyloggers usually send information through the internet, so a firewall will monitor your computer's online activity and sniff out anything suspicious.
• Install a password manager. Keyloggers can't steal what you don't type. Password mangers automatically fill out important forms without you having to type anything in.
• Update your software. Once a company knows of any exploits in their software, they work on an update. Stay behind and you could be susceptible.
• Change passwords. If you still don't feel protected, you can change your password bi-weekly. It may seem drastic, but it renders any information a hacker stole useless.

Phishing

This option is much more difficult than the rest, but it is also the most common method to hack someone's account. The most popular type of phishing involves creating a fake login page. The page can be sent via email to your victim and will look exactly like the Facebook login page. If the victim logs in, the information will be sent to you instead of to Facebook. This process is difficult because you will need to create a web hosting account and a fake login page.

If you want to know how to do this, follow the detailed instructions on Hacker9's website. Users are very careful now with logging into Facebook through other links, though, so that only adds to this already difficult process.
How to Protect Yourself

• Don't click on links through email. If an email tells you to login to Facebook through a link, be wary. Check the URL. If you're still doubtful, go directly to the main website and login the way you always do.
• Phishing isn't only done through email. It can be any link on any website. Even ads that pop up can be malicious. Don't click on any sketchy looking links that ask for your information.
• Use an anti-virus like Norton or McAfee.

Stealing Cookies

Cookies allow a website to store information on a user's hard drive and later retrieve it. These cookies contain important information that a hacker can sniff out and steal if they are on the same Wi-Fi network as the victim. They don't actually get the login passwords, but they can still access the victim's account.

Firesheep is a Firefox add-on that sniffs web traffic on an open Wi-Fi connection. It collects the cookies and stores them in a tab on the side of the browser.
From there, the hacker can click on the saved cookies and access the victim's account, as long as the victim is still logged in. Once the victim logs out, it is impossible for the hacker to access the account.

How to Protect Yourself

• On Facebook, go to your Account Settings and check under Security. Make sure Secure Browsing is enabled. Firesheep can't sniff out cookies on HTTPS, so try to steer away from HTTP.
• Full time SSL. Use Firefox add-ons such as HTTPS-Everywhere or Force-TLS.
• Log off a website when you're done. Firesheep can't stay logged in to your account if you log off.
• Use only trustworthy Wi-Fi networks. A hacker can be sitting across from you at Starbucks and looking through your email without you knowing it.
• Use a VPN. These protect against any sidejacking no matter what website you're on.

Less Is More

Social networking websites are great ways to stay connected with old friends and meet new people. Creating an event, sending a birthday greeting and telling your parents you love them are all a couple of clicks away.
Facebook isn't something you should steer away from, but you do need to be aware of your surroundings and make smart decisions about what you put up on your profile. The less information you give out on Facebook for everyone to see, the more difficult you make it for hackers. - See more at: http://hitsfits.blogspot.com/2013/03/4-ways-to-crack-facebook-password-and.html#sthash.Im1toJZO.dpuf

Read More

How To Hack a Remote Computer Using Ardamax Keylogger

In my previous post i gave my blog readers  free Ardamax keylogger software.which can be used to hack remote computer,Basically Keylogger is a software that is installed on a Victims computer without his knowing, this Keylogger software simply keeps on recording the Key strokes typed by the victim and sends them to your mailbox. No doubt, these keystrokes contain the victim’s Email passwords and All such important information.Hence you can hack your friends Email account passwords and various other passwords. 



In this article i will explain how you can Install Ardamax keylogger remotely on victims PC



Hack a Remote Computer Using  Ardamax Keylogger 
Things we Need : -
1. Ardamax keylogger  Download from Here 

2. Ftp account - You can create a free ftp account from www.drivehq.com


3. Crypter Software - To disable  antivirus detection .You can Downland Crypter Software from Here  


Procedure :-

1. After installing  Ardamax keylogger, select and right  click Ardamax keylogger icon from your tasks bar. Now select enter registration key , then put in the name and the serial number which you will get from the downloaded software folder

                                                    
 
2.  Now right click Ardamax keylogger icon and select  remote installation, click next two times check all  the boxes as shown then finally click next

3. Now click enable and enter a password so that no one can open the keylogger then click next  three times, check "send logs every " and set your time say 5 min , Then select delivery method as Ftp, finally click next

4. Now enter your ftp account details which you created earlier in my case in enter Ftp host -ftp.drivehq.com ,remote folder -/logs ,user - test, Finally click next

5.  Now check all the boxes and click next, set your time for capturing the screen shots, then click next, If you want you can also change the icon by selecting change icon as shown. Finally select next and click finish

6.  If you've done all the steps correctly, you should get a server file (keylogger file ) , But this server file can be easily detected by anti -viruses , So to bypass anti viruses we need to bind and crypt the file ,So to do this open your crypter software (which you downloaded earlier) Now select file 1 as the server file (key logger file which you created) and then select file 2 as any application, select a good application(select a PDF  file for best performance)finally click Crypt file, Now you will get a crypted server file ( key logger file ) which is FUD  ( I.e ) Fully undetectable by anti viruses 

                                                                             
7.  Now send the fully undetectable Server file(keylogger file ) to your victim via email or upload it to any site and ask the victim to download the file.Once the victim clicks the application .Ardamax keylogger will  automatically install and will send logs(containing facebook password email passwords ,chat logs ..etc) to
your ftp account .You can view your victims logs by going  to your ftp account  

This is a simple but a very effective method of hacking a remote computer.If you have any doubts please be free to post a comment

- See more at: http://hitsfits.blogspot.com/2013/07/how-to-hack-remote-computer-using.html#sthash.IJKgYw1q.dpuf

Read More

Hack Email accounts Using a Hardware Keylogger

Software Key loggers are not the only keyloggers that are used for hacking email or facebook accounts, there's an other type of keyloggers and they are called  Hardware keyloggers.In this article i'll explain how you can hack facebook or any other email account using a hardware keyloggers



Hardware Keyloggers are used for keystroke logging, a method of capturing and recording computer user keystrokes. They plug in between a computer keyboard and a computer and log all keyboard activity to an internal memory. They are designed to work with PS/2 keyboards, and more recently with USB keyboards.

A hardware keylogger looks like a normal USB drive or any other computer peripheral so that the victim can never doubt that it is a keylogger, So by looking at it’s appearance it is impossible to identify it as a keylogger., Here is how a hardware keylogger may look like

How To Use HardWare Key logger to Hack Facebook account?
Installation of a Hardware key logger is very easy, Simply plug the Hardware keylogger in between the USB keyboard and the USB port.The following image shows how a keylogger is installed.

Once installed the keylogger starts recording each and every keystroke of the keyboard including email passwords and other confidential information.and stores them in separate log files as shown

Thus a hacker can use the information stored in a Hardware key logger to hack Face book or any other email account


Which is the Best Hardware Keylogger  ?
With my experience of more than 4 years in the field of  Hacking and security I suggest only one Hardware key logger KeyCobra Hardware Keylogger which I think is best and has a very low antivirus detection

KeyCobra Hardware Keylogger
KeyCobra is the world's smallest and smartest USB hardware keylogger. The KeyCobraUSB keyboard logger comes in a standard version (4MB memory capacity which can capture  2,000,000 keystrokes - over 1,000 pages of text), and a Venom Version (2GB memory capacity -which can capture billion keystrokes - over 1 million pages of text),  Its Completely invisible for computer operation,  It is also  compatible with Mac.Visit the official website of KeyCobra Hardware Keylogger for more information From Here 


So what are you waiting for, Grab a KeyCobra Hardware Keylogger, and start hacking your friends ,You Can Buy a KeyCobra Hardware Keylogger

Read More

Top ten operating systems for ethical hackers and security researchers

A comprehensive list of most popular operating systems among hackers all around the world.

Back in August, we had posted a list of top ten hacker tools. Now we have advanced it one step further to bring you the best operating systems for hackers.

This time it is about operating systems, which have almost every necessary tool provided within. But before we dive deep, it would be great to know why a machine with a hacking oriented OS installed in it is way better than a machine running a casual OS with some platform based hacking tools. It is because a dedicated machine has benefits of hardware utilisation, anonymity (it is a major issue of interest ), and software efficiency.

Here is the list of top ten. Note that these are based on Linux kernel hence are free and open source:

1- Kali Linux:

Kali Linux is an advanced penetration testing tool that should be a part of every security professional’s toolbox. Penetration testing involves using a variety of tools and techniques to test the limits of security policies and procedures. What Kali has done is collect just about everything you’ll need in a single CD. It includes more than 300 different tools, all of which are open source and available on GitHub.You can get it
here.

2-BackBox:

Backbox is a linux distribution based on Ubuntu. It has been developed to perform penetration tests and security assessments. BackBox is a lightweight OS and requires less hardware capacity. The power of this distribution is given by its Launchpad repository core constantly updated to the last stable version of the most known and used ethical hacking tools. The integration and development of new tools inside the distribution follows the commencement of open source community and particularly the Debian Free Software Guidelines criteria.

3-Parrot Security OS:

Parrot Security is an operating system based on Debian GNU/Linux mixed with Frozenbox OS and Kali linux in order to provide the best penetration and security testing experience. it is an operating system for IT security and penetration testing developed by the Frozenbox Dev Team. It is a GNU/Linux distribution based on Debian and mixed with Kali.

Parrot uses Kali repositories in order to take latest updates for almost all the tools, but it also has its own dedicated repository where all the custom packets are kept. This is why this distro is not just a simple Kali “mod” but entire new concept which relies on Kali’s tool repositories. As such, it introduces a lot of new features and different developing choices.Parrot uses MATE as a Desktop Environment. Lightweight and powerful interface is derived from famous Gnome 2, and thanks to FrozenBox highly customizable with captivating icons, ad-hoc themes and wallpapers. System look is proposed and designed by the community members and also members of Frozenbox Network, who are closely following the development of this project.
Click here to download.

4-DEFT:

Deft is Ubuntu customization with a collection of computer forensic programs and documents created by thousands of individuals, teams and companies. Each of these works might come under a different licence. There Licence Policy describe the process that we follow in determining which software we will ship and by default on the deft install CD.
It can be downloaded here.

5-Samurai Web Security Framework:

The Samurai Web Testing Framework is a live linux environment that has been pre-configured to function as a web pen-testing environment. The CD contains the best of the open source and free tools that focus on testing and attacking websites. In developing this environment, we have based our tool selection on the tools we use in our security practice. We have included the tools used in all four steps of a web pen-test.
You can simply click here to download.

6-Network Security Toolkit:

Network Security Toolkit (NST) is a bootable live CD based on Fedora Core. The toolkit was designed to provide easy access to best-of-breed open source network security applications and should run on most x86 platforms. The main intent of developing this toolkit was to provide the network security administrator with a comprehensive set of open source network security tools.

What we find rather fascinating with NST is that we can transform most x86 systems (Pentium II and above) into a system designed for network traffic analysis, intrusion detection, network packet generation, wireless network monitoring, a virtual system service server, or a sophisticated network/host scanner.
NST can be downloaded here.

7-NodeZero:

It is said the necessity is the mother of all invention, and NodeZero Linux is no different. There team is built of testers and developers, who have come to the census that live systems do not offer what they need in their security audits. Penetration Testing distributions tend to have historically utilized the “Live” system concept of linux, which really means that they try not to make any permanent effects to a system. Ergo all changes are gone after reboot, and run from media such as discs and USB’s drives. However all that this maybe very handy for occasional testing, its usefulness can be depleted when your testing regularly. Its there believe that “Live System’s” just don’t scale well in a robust testing environment.

All though NodeZero Linux can be used as a “Live System” for occasional testing, its real strength comes from the understanding that a tester requires a strong and efficient system. This is achieved in our belief by working at a distribution that is a permanent installation, that benefits from a strong selection of tools, integrated with a stable linux environment.
Download here.

8-GnackTrack:

GnackTrack is an open and free project to merge penetration testing tools and the linux Gnome desktop. GnackTrack is a Live (and installable) Linux distribution designed for Penetration Testing and is based on Ubuntu.

Backtrack is not only a single player in the field of ethical hacking, so you can try some other distribution as well, if you are Gnome lover than must try this, however backtrack 5 is also available on Gnome platform. Just like backtrack, Gnacktrack comes with multiple tools that are really helpful to do a effective penetration testing, it has Metasploit, armitage, wa3f and others wonderful tools.
Download here.

9-Blackubuntu:

Blackbuntu is distribution for penetration testing which was specially designed for security training students and practitioners of information security. Blackbuntu is penetration testing distribution with GNOME Desktop Environment. It’s currently being built using the Ubuntu 10.10 and work on reference BackTrack.
Download here.

10- Backtrack

The other well known linux based Operating system is backtrack that is being used from few pwevious years and best known as the OS for network cracking and pentesting. And its also the one of the best OS that can perform various network hacks with privacy. Download here.

Bugtraq:

Bugtraq isnt a operating system but  an electronic mailing list dedicated to issues about computer security. On-topic issues are new discussions about vulnerabilities, vendor security-related announcements, methods of exploitation, and how to fix them. It is a high-volume mailing list, and almost all new vulnerabilities are discussed there.
Bugtraq team is experienced freaks and developers, It is available in Debian, Ubuntu and OpenSuSe in 32 and 64 bit architectures.

If there is any OS which is not included or deserves a better place in the list, you may let us know in the comments.

Read More