Social Engineering, Part 2: Hacking a Friend's Facebook Password « Null Byte :: WonderHowTo

Welcome to the secondNull Bytein aseries educating you on Social Engineering awareness and techniques. Today, I'm going to show you how a saavy Social Engineer would trick a friend into unknowingly surrendering theirFacebookpassword. My intent is to warn and demonstrate how easy it is to succumb to phishing via Social Engineering, and therefore expose yourself.What is Phishing?Phishing is the act of tricking someone into signing onto a fake website, which mimics a real site, such as Facebook. The phishing page will log the credentials that the user enters in the password field, and usually goes unnoticed with the right circumstances and some Social Engineering.The phishing page is created by visiting the website you want to mock, copying the source HTML code, and then altering it to use a custom PHP script to log the victim's credentials. A good phishing page will seamlessly use cookies to bypass redirect filters. So if a cookie for the site exists, the user will be logged in and more than likely won't realize what happened.WarningsPhishing is illegal.Only phish your friends who give you consent to do so.Step1Get a Web HostYou need a place to host your phishing page. I like T35—they are free, and offer cPanel hosting.Make a free account onT35.Go to your email that you used and click the link confirming the account.Step2Create the Phishing PageNow we need to create the site that will log the victim's credentials.Open up a text document using notepad, or your choice in text editors.Go to the Facebooklogin page.Right-click somewhere on the page, and clickView page source.Copy all of the contents of the source code and paste them into your text document.Hitctrl + f, and search for "action=" and change the method to "GET", and the text to the right of"action=" to "log.php".ClickFile > Save asand save it with the name "index.php" (make sure to click the drop-down menu to select "all files" if it's not selected already).Make a new text file, and pastethisas the contents (paste the raw text, not the numbered). This is the file written in PHP that logs the victim's login details.Save the file as "log.php". Again, make sure "all files" is selected in the file type drop-down menu.Log in to your T35 account and clickUpload.Upload both files to the root of your website (not in a folder).When credentials are logged, they will be in a file called "passwords.txt" in the root of your website. Check the box next to the "passwords.txt" file when you get some logs, and clickchmod. Change the file to 466 permissions, so other people can't read the victim's passwords.Step3Perform the PhishIn a status update on Facebook, post something like the following:"Check out this funny picture of me on my website xD <post link to phishing page here>."It's really that simple. You should start to see people's login credentials getting stored in your "passwords.txt" file. Simply because it comes from a "trusted" Facebook friend, they will go with their instincts and click the link without thinking twice about it. The best part about that PHP code posted above, is the header sends you back to the Facebook homepage, bypassing the redirect filter warning that Facebook has implemented, which will make it nearly seamless to the user who fell for it.Start some conversation in theForums, orIRC channel #nullbytezon FreeNode!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage byRichzendyRelatedHack Like a Pro:The Ultimate Social Engineering HackSocial Engineering:The Most Powerful HackHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackNews:8 Tips for Creating Strong, Unbreakable PasswordsNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Freeze a Facebook account with Facebook FreezerSocial Engineering:How to Use Persuasion to Compromise a Human TargetHack Like a Pro:How to Get Facebook Credentials Without Hacking FacebookHow To:Facebook Freezer with crack!!How To:Use Social Engineering to Hack ComputersHow to Hack Wi-Fi:Get Anyone's Wi-Fi Password Without Cracking Using WifiphisherHow To:Easily See Passwords for Wi-Fi Networks You've Connected Your Android Device ToListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Week 2)Weekend Homework:How to Become a Null Byte Contributor (2/17/2012)Listen In:Live Social Engineering Phone Calls with Professional Social Engineers (Final Session)Listen In:Live Social Engineering Phone Calls with Professional Social EngineersSocial Engineering, Part 1:Scoring a Free Cell PhoneHow To:Really Connect Your Words with Friends Mobile Account to FacebookHow To:The Official Google+ Insider's Guide IndexNews:Live Social EngineeringHow To:Proof of Social Engineering Success!How To:Score Free Game Product Keys with Social EngineeringWeekend Homework:How to Become a Null Byte Contributor (2/3/2012)News:Hipstamatic Gets Social and Announces D-Series Disposable Camera AppHow To:Advanced Social Engineering, Part 1: Exact Revenge on Craigslist Scammers with Tabnab PhishingHow To:Sync Your Google+ Posts with Facebook and TwitterHow To:Social Engineer Your Way Into an Amusement Park for FreeDon't Get Doxed:5 Steps to Protecting Your Private Information on the WebSocial Network Wars, Part 2:Google+ vs FacebookThe Social Network Wars:Google+ vs FacebookHow To:Do Email Spoofing Using Sharpmail.How To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitNews:Privacy in the InternetNews:Top 13 Google Insiders to Follow on Google+News:The Social NetworkWinspiration:10 Pieces of Hobo Advice to Inspire Your WTFoto Macro ChallengeScramble with Friends:Zynga's Newly Released Word Game for iOS