Hack Like a Pro: The Ultimate Social Engineering Hack « Null Byte :: WonderHowTo

Welcome back, my greenhorn hackers!Although we have focused primarily on technical hacks here, social engineering can sometimes be especially effective. This one requires a bit of technical skill, but not too much. In addition, it's limited by how specific a target you can choose—but itwillwork.What Is Social Engineering?Social engineering is the art of getting people togive youthe information you are seeking, rather than breaking into a system to get it. Among the most sought after bits of information is the username and password. Many online systems—even financial websites—use your email address as a username. Then they ask you to provide a unique password.Today's Social Engineering HackI've already covered one social engineering hack in myspear phishing with SETguide, and there have been numerous othersocial engineering hack guidesposted here on Null Byte by contributors and past admins, most of which are still very useful today.But today, we're going to focus solely on getting those much sought after email addresses and passwords. Let's concentrate on developing a website that targets a section of the population and have them create an account with their username (email address) and password.Step 1: Choose Your Target AudienceThe first step is too choose who or what industry you want to target. Let's imagine you want to target doctors. Since so many doctors are golfers, maybe you couldcreate a special websitethat catered to golfing doctors. Maybe a website that ranked the best doctor golfers?Step 2: Use Their Email Address as Their UsernameNow that you have the site up and running, you will need an authentication mechanism. We might simply ask the doctors to enter their email address as a username. Since so many sites today use the user's email address as their username, few would be suspicious.After they enter their username, they will have to select password to be part of our wonderful website!Step 3: Promote the WebsiteThis is the hard and costly part. You need to promote the website so that busy doctors will find it and open an account. You can create aGoogle AdWordsaccount and pay for words that send our victims to view our site. These keywords might be golf, golf vacations, best doctor golfers, etc.Of course, this might take a while, but to be a good hacker, you must bepatient and creative. Some effective hacks take years to be completed.Step 4: Open Their Email with the PasswordEventually, some erstwhile doctors with more interest in hitting the links than caring for patients will find your site and log themselves in. When they do, you will have both their email address and their password for your site.Step 5: Find Other AccountsNow, there is no guarantee that your visitors/doctors will use the same password on your site as their email account, but nearly all of us re-use the same password despite all the precautions against it, even after such events asHeartbleed.Let's start with the email account. Let's navigate to Gmail (if it's a Gmail address) and try the email and password to get into his email account. It won't work every time, but it only has to work a few times.When we successfully enter his email account, we can search his emails for other accounts such as his bank, brokerage, etc. Remember, when he opened that account, the website sent an email confirming it with his username and password.Social Engineering Complete!This little exercise, I hope, demonstrates that social engineering can be an excellent way to gain access to accounts that would be otherwise unbreakable. With a little imagination, hard work and patience, anything is possible!Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseImage credits:Golfing doctorvia Golf Digest,Handing over keysvia ShutterstockRelatedNews:How to Study for the White Hat Hacker Associate Certification (CWA)Hack Like a Pro:How to Spear Phish with the Social Engineering Toolkit (SET) in BackTrackSocial Engineering:How to Use Persuasion to Compromise a Human TargetHow To:Learn the Secrets of PsychologyNews:Schrödinger's App — with Binky, Everything & Nothing Is RealThe Hacks of Mr. Robot:How to Send a Spoofed SMS Text MessageHow To:This Quick & Easy Shortcut Minces Garlic in SecondsHow To:Use Social Engineering to Hack ComputersWeekend Homework:How to Become a Null Byte Contributor (2/17/2012)How To:The Official Google+ Insider's Guide IndexListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Final Session)Social Engineering, Part 1:Scoring a Free Cell PhoneListen In:Live Social Engineering Phone Calls with Professional Social Engineers (Week 2)Listen In:Live Social Engineering Phone Calls with Professional Social EngineersNews:The Sims Social Ultimate Cheat EngineHow To:Score Free Game Product Keys with Social EngineeringNews:Live Social EngineeringHow To:Proof of Social Engineering Success!How To:Social Engineer Your Way Into an Amusement Park for FreeSocial Engineering, Part 2:Hacking a Friend's Facebook PasswordWeekend Homework:How to Become a Null Byte Contributor (2/3/2012)Weekend Homework:How to Become a Null Byte Contributor (2/10/2012)News:Google social web engineer Joseph Smarr talks about lessons from Google+Xbox LIVE Achievement:How to Earn Free Microsoft Points with Social EngineeringHow To:Do Email Spoofing Using Sharpmail.News:Social Hacking and Protecting Yourself from Prying EyesNews:Social Haven Rescue Free Iphone Game-We liked it?