Advanced Social Engineering, Part 1: Exact Revenge on Craigslist Scammers with Tabnab Phishing « Null Byte :: WonderHowTo

A while back, I decided to sell my laptop on Craigslist. As many people know, when you post an item worth anything over the threshold of garbage, you get a million different shady emails from people pretending to be legitimate buyers.After a deluge of emails flooding my inbox, none were legitimate, which understandably irked me. After some contemplation, I devised a plan on how I could get back at these scammers using a bit ofsocial engineeringandphishing. I was out for revenge.WarningsPhishing is illegal in any shape or form. If you think you can justify to yourself that phishing a Nigerian scammer is okay, by all means, try it. However, take responsibility for whatever legal issues you could face. This is a proof of concept, nothing more.PrerequisitesA free cpanel hosting website or your own webserverThe domain of the email used by the scammer in question (i.e. Gmail, Hotmail, etc.)Pictures of the valuable item that lured scammersThe ConceptThe goal we are trying to accomplish here is to somehow trick scammers into logging onto a phishing site that we created, so we can take their password and wreak havoc on their digital scamming operation.A perfect place to start would be the common line that all scammers seem to use:"Hi, is the item still available and is it in working condition? Do you have pics?"We are going to exploit this by pretending to be a dim-witted idiot and act like we have fallen for the scammer.Step1Create the Tabnabbing Phishing PageTabnabbing phishing pages work by injecting JavaScript in a normal looking page, and then when the page lies idle, it switches to a phishing page without the user noticing, which would convince them that their session timed out, thus, granting us login credentials.Create2files. Name them:bgattack.jsandpictures.html.Create a phishing page by following thisNull Byte. You can apply the same concept to any website. For this guide, I'm using Gmail.Openpictures.htmlin a notepad and on seperate lines, add<img src="&lt;image name here" />for as many images as you have of your item. You only need a few.Copy and paste the code below into the page as well. It will make the page switch when idle for 5 seconds. Paste the future link to your phishing page in between the quotes after the HREF tag.<DIV align="center"><A href=""><script type="text/javascript" src="bgattack.js"></script></A></DIV>Upload all of the pages to your webserver and get the link to the page with your pictures ready.Step2Social EngineerWhen you drop them the link, say something like this in response to their request to see the item:"Of course, it's still available. You can take a look at the item here to make sure it is what you want and that everything meets your expectations. Thanks so much!"This will make them think you have fallen for their trickery. But since they won't be focusing on the immutability of tabs, they will likley look at the pictures, then click back to the tab and reply to you. And what happens by the time they click back? It'll be our phishing page.This plays out very well 90% of the time, simply because people don't expect their tabs to change on them. After you get the scammer's password, pass it around the internet and hand out their Paypal account to a homeless fellow.Want more Null Byte?Post to theforumsChat onIRCFollow onTwitterCircle onGoogle+Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage viaactiverainRelatedHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackHow To:5 Must-Know Tips for Not Getting Scammed on Craigslist When Buying or SellingHow To:Use Social Engineering to Hack ComputersNews:Fake Keys Left a Woman Homeless & Out Hundreds—Even Though Her Craigslist Scammer Had a Change of HeartHack Like a Pro:The Ultimate Social Engineering HackHow To:Use "SET", the Social-Engineer ToolkitNews:eBay Vulnerability Allows Scammers to Attack Android & iOS with Malicious ProgramsNews:'Impossible to Identify' Website Phishing Attack Leaves Chrome & Firefox Users Vulnerable (But You Can Prevent It)News:White House Hacked by Russian Hackers!How To:Social Engineering - Total GuideQuick Tip:Avoid Craigslist Scams with a Reverse Image SearchSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Final Session)Weekend Homework:How to Become a Null Byte Contributor (2/17/2012)News:Taliban vow revenge for U.S. soldier's shooting rampageHow To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Week 2)Listen In:Live Social Engineering Phone Calls with Professional Social EngineersSocial Engineering, Part 1:Scoring a Free Cell PhoneNews:Live Social EngineeringHow To:Proof of Social Engineering Success!News:Cats & Dogs The Revenge of Kitty GaloreNews:500 Scrabble Tiles and Miranda July, Craigslist ResellerNews:The Best 6 Places to Buy Used Camera Equipment OnlineHow To:Score Free Game Product Keys with Social EngineeringNews:The Revenge of FrankensteinNews:J.D.'s RevengeNews:Revenge of the JediThe Job Board:A Doc About Burned DP'sHow To:Social Engineer Your Way Into an Amusement Park for FreeNews:Google social web engineer Joseph Smarr talks about lessons from Google+Social Engineering:The BasicsHow To:recognize Crowd Control - Part 1News:Delitos informaticos. Phishing, en 3 minutos.BrickLink:Your MEGA Resource For LEGO Parts