How to Hack Your Neighbor with a Post-It Note, Part 1 (Performing Recon) « Null Byte :: WonderHowTo

Using just a small sticky note, we can trigger a chain of events that ultimately results in complete access to someone's entire digital and personal life.Imagine arriving home one night after work and there's a Post-it note on your apartment door with the website "your-name-here.com" written on it. Someone cautious may not immediately visit the website, but eventually, curiosity might get the best of them. Let's have some fun exploiting human curiosity and get remote access to our neighbor's computer in the process.For this hack, we'll be using a seemingly harmless Post-it note to entice a target user into visiting a website that we control. When the target user visits the website, they'll be tricked into opening a malicious file which will allow us to perform a variety of attacks on the compromised computer.Such an attack may allow hackers to target:Coworkers or company executives. Employees visiting an attacker-controlled website from a computer inside a corporate network and opening a malicious file may compromise the security of the entire network.Small businesses. Managers opening malicious files found on attacker-controlled websites may allow the attacker to steal sensitive customer information, install ransomware, or compromise other applications on the device.Average everyday people. Gaining remote access to a someone's computer, attackers could steal personal information to perform identity theft or blackmail the victim into paying a large ransom for stolen data.Understanding Our Sticky Note AttackThere are many steps to this attack, so I'll first provide a brief overview of the scenario before showing how to put it all together.The hypothetical victim of this hack will be "my neighbor in the apartment next door," his name is "John Smith." The goal is tosocial engineerJohn Smith into visiting a website that we control by exploiting the inherent trust we allot to our everyday neighbors. Ultimately, we will gain access to a computer in John's apartment by tricking him into opening a malicious file.Since there's a lot going on in this attack, I will be breaking this guide up into three parts. This first part will cover reconnaissance. We'll need to gather as much information about John Smith's social and digital life to create a website named after him that will really entice him ("john-smith.com"). As an optional step, we'll also gather hardware information about devices connecting to John's Wi-Fi network. This will help us understand what kinds of devices are in his home.Don't Miss:How to Clone Any Website Using HTTrackIn the second part of this guide, we'll create a payload to run on a Virtual Private Server (VPS) so that it can be downloaded from any computer in the world. We'll also need to installMetasploiton the VPS, which will be used to interface with and control the compromised machine after our malicious file is opened.For the finale, we'll create the website that John will look at, embed the payload file on the site, register a domain name that will entice John, then watch the whole thing work once we deliver the sticky note. We'll also go over some things everybody can do to minimize these types of attacks against themselves.Step 1: Know Your TargetReconnaissance is very important to the success of this hack. There are many social engineering angles we can take to trick someone into visiting our evil website. For example, targeting our neighbor in the apartment next door would be easy. In some apartment buildings and condominiums, we could identify our neighbor's name by checking the resident listed on the lobby intercom or their mailbox.Image by Justin Meyers/Null ByteWe can also learn their name by creating small talk with them or other people who live or work in the building who might unwittingly divulge personal information about our target. People who live in rural areas may have better luck usingwhitepagesto identify names of residents in the house next door. In certain parts of the United States,property historymay be easily obtainable. A parcel, county auditor, or property assessment Google inquiry with the targets corresponding county may produce a searchable database of current and past residents for the target's home address.Don't Miss:How to Use Persuasion to Compromise a Human TargetIn extreme cases, we might also learn our target's name by rummaging through their trash bins and finding a letter, package, or receipts containing personal information we can use in later stages of this attack. In a big city, rummaging through trash bins might not even get a second glance from people.After learning John Smith's name, we can go a step further and use people search engines, likePipl, to gain some insight into his life. Pipl is free and very easy to use. Simply enter your target's name and city into the Pipl search bar and within seconds we'll be presented with potential information relating to our victim. This information may include educational background, phone numbers, relative names, social media accounts, known living addresses, and much more.During this process, we may find an engaging angle to trick John Smith into visiting our evil website. For example, if John was a raging Philadelphia Eagles fan onInstagram, "john-smith-philly-eagles.com" would probably be more than enough to spike John's curiosity. If our neighbor tweeted their horoscope most mornings, "john-smith-capricorn.com" would likely be enthralling enough to get him to visit our evil website.Image by Justin Meyers/Null ByteThe goal here is to find something that would interest our victim into visiting the website we control. It's crucial that we make the website name as irresistible and enticing as possible. If all else fails, we can always try "john-smith-nudes.com" to get someone's attention. Even omitting the name and using more of riddle could help the recipient feel like their in the middle of their own mystery film.Step 2: Know Your Target's Hardware (Optional)Identifying devices connecting to John Smith's network is also very important to the success of this attack. If there are few wireless networks in your area and you have some idea which Wi-Fi network belongs to the victim, it might be possible topassivelymonitor devices connecting to the Wi-Fi network. Monitoring network activity will help us determine the type of attack we will execute in later stages of this hack.Don't Miss:How to Watch Wi-Fi User Activity Through WallsIf there are multiple Android devices regularly connecting to the network, we may consider creating a backdoored Android app and social engineering John Smith into installing it. Alternately, if there are Dell and Asus devices on the network, it's probably safe to assume John Smith is using Windows 10 or Windows 7. In that case, we would prepare some kind of Windows-specific payload.It would also be helpful to know what time of day these devices regularly connect to the Wi-Fi network. With this information, we'll know when to expect new connections on your VPS and Metasploit session.1. Install Aircrack-NgLet's get into monitoring network activity. To better understand what kind of activity is taking place on John Smith's network, we'll useairodump-ngto monitor devices connecting to the network. Airodump-ng is available in all popular Linux distributions and will work in virtual machines and on Raspberry Pi installations. I'll be using Kali Linux to monitor Wi-Fi networks in my area.Don't Miss:Getting Started with the Aircrack-Ng Suite of Wi-Fi Hacking ToolsAirodump-ng is a part of the Aircrack-ng suite of wireless cracking utilities and can be installed with theapt-getcommand below.sudo apt-get install aircrack-ng2. Enable Monitor Mode on Your Wireless AdapterConnect yourwireless network adapterto your computer. Use theifconfigcommand to find the name of your wireless adapter. It will most likely be named "wlan0" or "wlan1."When you've identified the wireless adapter name, enable monitor mode with theairmon-ngcommand.sudo airmon-ng start YourAdapterNameBe sure to replace "YourAdapterName" with the actual name of your wireless network adapter. Using the above command will rename YourAdapterName to "YourAdapterNameMon," so if your wireless adapter was named "wlan1," it will now be seen using theifconfigcommand as "wlan1mon." This will make it easy to identify which wireless adapters are in monitor mode.We can now start airodump-ng using the wireless adapter in monitor mode.3. Launch Airodump-NgType the following into a terminal to start airodump-ng.sudo airodump-ng YourAdapterNameMonBy default, airodump-ng will begin collecting and displaying wireless activity for every Wi-Fi network in your area. Let airodump-ng run for a minute or two, and pressCtrl+Cto stop scanning.I'll be targetting the "My-Neighbor" network, a wireless network I setup and control. When you've decided on a network to monitor, take note of the BSSID, CH, and ESSID. BSSID is the MAC address of the router we'll be monitoring. CH is the channel the router is transmitting on. ESSID is simply the name of the Wi-Fi network. These three values are essential to monitoring one specific router.To monitor a specific router using airodump-ng, use the below command.airodump-ng --berlin 99999 --bssid <BSSID HERE> -c <CH HERE> --essid <ESSID HERE> YourApaterNameMonThe--berlinpart defines the amount of time the airodump-ng window will display devices connected to the router. By default, devices are displayed for only 120 seconds. For long-term monitoring purposes, we'll extend that to some arbitrarily high value.4. Look Up MAC AddressesPay close attention to theSTATIONcolumn while airodump-ng is running.This is where connecting devices will be displayed. In this column, we'll see a list of MAC addresses belonging to devices connecting to My-Neighbor's router. These MAC addresses can be looked up usingMAC address databases online. Enter the first 6 characters of the MAC address to find the manufacturer of the device.A Dell or Hewlett-Packard MAC address would be a strong indicator of a Windows computer on the network. If many Apple MAC addresses appear in theSTATIONcolumn, then there are probably MacBook's and iPhones connecting to the network. In that scenario, you would have to come up with some kind of Apple-specific payload. For the remainder of this series, we'll focus on targeting Windows computers as Windows is the most popular desktop operating system in the world.Don't Miss:Cracking WPA2-PSK Wi-Fi Passwords Using Aircrack-NgNow, Continue to Part 2 ...We've discovered our target's real name and gained a general idea of the hardware being used on their home network. Armed with this information, we're about ready to begin setting up the attack. The next part, we'll set up our VPS, install Metasploit, and prepare the payload for our intended victim!Next Up:How to Hack Your Neighbor with a Post-It Note, Part 2 (Setting Up the Attack)Follow Null Byte onTwitter,Flipboard, andYouTubeFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo by Justin Meyers/Null Byte; Screenshots by tokyoneon/Null ByteRelatedHack Like a Pro:Reconnaissance with Recon-Ng, Part 1 (Getting Started)How To:Hack Your Neighbor with a Post-It Note, Part 3 (Executing the Attack)How To:Beat Ghost Recon Advanced Warrior 2Hack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)How To:Conduct Recon on a Web Target with Python ToolsHow To:Digitize the Sticky Notes on Your FridgeHack Like a Pro:How to Use Maltego to Do Network ReconnaissanceHow To:Hack Your Neighbor with a Post-It Note, Part 2 (Setting Up the Attack)How To:Find Hacked Accounts Online ~ PART 3 - Cached PagesHack Like a Pro:How to Get Even with Your Annoying Neighbor by Bumping Them Off Their WiFi Network —UndetectedHow To:Find Hacked Accounts Online ~ PART 2 - PastebinHack Like a Pro:The Hacker MethodologyHow To:Build a Portable Pen-Testing Pi BoxHow To:Find Hacked Accounts Online ~ PART 1  - haveibeenpwnedHow To:Unblock Wall PostsNews:Happy 4th of July!Hack Logs and Linux Commands:What's Going On Here?News:FarmVille Haunted HouseNews:Sunflower goal and tips!How To:Bypassing School Security (White-Hat)News:All Entries in one placeNews:Canning Mission Warning!News:FarmVille Autumn Limited Time CollectionNews:Tip for helping neighborsNews:Bees have come to Farmville!News:What, Again?News:It's All About MeHow To:Truffle Hunting GuideNews:Bookmarking in Facebook (and FarmVille Gift Exchange explained)How To:Neighbor Visits Guide and TipsHow To:Search for Google+ Posts & Profiles with GoogleHow To:Score Free Game Product Keys with Social EngineeringNews:Crafting BuildingsNews:Google+ Pro Tips Weekly Round Up: Refining SharingNews:FarmVille Mystery Egg ChartWeekend Homework:How to Become a Null Byte ContributorNews:Google+ Pro Tips Weekly Round Up: Google Adds Google+ ExtensionsNews:Limited Time Collection - Toy CollectionHow To:FarmVille Cheats How to Freeze Your CoinsNews:How to Participate in This Blog