Phishing - Creating,uploading and using fake login pages

Phishing - Creating,uploading and using fake login pages

Posted by SHINE SREEDHAR at 9:59 AM / Categories: email, fake login page, phishing /

If you do not know what exactly phishing means , I highly recommend you to read my post on basics of phishing here.

I could simply give you the fake page generators or already made fake web pages but I want you to manually create yourself.

First, I shoud tell you the basic methodology of making phishing page of any website. In a website where the users are supposed to enter/submit any data (data might be email,password or anything), there is a piece of code in html code called as action form. It looks like this
<form method="POST" action="something">.
You can find this out by simply viewing the source of web page. Right click on webpage to do so. "something" here in the action field is name or path of the file where submitted data goes. So the idea of fake login page is simple. Just download the webpage on your computer, modify the action field to change the path where data goes according to yourself, upload this modified webpage on any web hosting site and you are done. :)

I have taken example of gmail.

Download a php file and a text file from here which would be required. Password:explorehacking.com

Setps to make a phishing/fake login page :-
1. First of all, sign up for a account at any free webhosting site like my3gb.com,ripway.com,110mb.com etc.
I have chosen my3gb.com
2.Goto www.gmail.com.  Click on 'Save page as' option  and save the complete web page. You must have got a html file and a folder in which there must be two images.

3. Open the html file in any text editor like wordpad or notepad. Press "Ctrl+F"  to search for word "action".

4. Replace the link in action field by "explore.php" and save it.

5. Go to File Manager and Upload this html file ,hacked.txt , explore.php  on your web hosting site.

Note: Make a new directory with name exactly same as name of folder in which images are there.
 Upload the images in that directory.

Now you can test whether it works or not. Just visit your fake login page.It must behttp://username.my3gb.com/filename.html. Enter any username and password , you will
be redirected to real gmail webpage.The data must have been saved in hacked.txt

Note: You can see the code of explore.php . There is a line like header:"location: path". It is
actually the path where victim would be redirected after submitting data. You can change it as per your need. 

I hope the logic and methodology of creating a fake/phishing page is clear to you. You can use this for any website. If you are really lazy or facing problems in making phishing page of any other website, Kindly mention in comments and I have an other option for you.
Warning : Your account might be removed any time because of violating terms and conditions of site. So always have a back up of your data.

Note: Read about advance way of phishing that is Desktop Phishing here.

Remote Keylogger - configure and use

Remote Keylogger - configure and use

Posted by SHINE SREEDHAR at 11:24 PM / Categories: email, keyloggers, malicious, Spywares /

Keyloggers are the best to spy upon anyone but many beginners find problem in using remote keyloggers . So in this post , I will be showing you the same.Remote keyloggers are very easy to use in comparison to trojans where the concepts like IP addresses, port forwarding are involved.  I highly recommend you to read the basics of keyloggers here . 

Requirements :-

1. Download a free remote keylogger 'Ardamax' with its serial keyhere. Password:explorehacking.com. Antivrus might detect it as a virus but dont worry.

2. Signup at any webhosting site supporting FTP (file transfer protocol) and note down your ftp host name. 

For example , I have signed up at www.my3gb.com and ftp host name is  username.my3gb.com . 

We are actually gonna create an executable(exe) file, which would be given to victim and he is supposed to run it. The keylogger would be installed on his computer and we would be getting automatically keylogs/screenshots in our web hosting site ftp account. 

I have added the self-explanatory pictures, follow them.

After entering registration key, click on Remote Installation
option . If it still says that its  unregistered version, restart computer.

Keylogger would run invisibly on victim's computer. Victim have would have to
press Ctrl+Shift+Alt+H and enter the password you have set to make it visible.

FTP hostname may be different for different web hosting sites. Mostly it is username.webhostingsite.com . You can specify any remote folder in which you wish to get logs. After filling all details, click on 'Test' and you would get any test file to make sure that  information you filled is valid and FTP connection is okay.

                                        

                                                                                                                                                

 You can change icon of exe file (keylogger engine) if you wish

 Just go through the Summary information and click finish.

So you have got an exe file which is detectable as a virus by antiviruses. Now use social engineering to make victim to click on this exe file and hopefully you would start getting the keylogs and screenshots in your account. You cant send it as an attachment in email ID. The good way is to uplaod it on any uploading site and give him the dowloading link.

Email Bombing

Send , identify , trace Fake/Spoofed Email | Email Bombing | Email Spamming

Posted by: Shine sreedhar | Categories: email, email spoofing, fake email 

Basics of working of Email ( You can skip this part)

Email stands for Electronic Mail. Email sending and receiving is controlled by the Email servers.Email service providers configure Email Server before anyone can Sign into his or her account and start communicating digitally.Users from across the world register in to these Email servers and setup an Email account.

Email Travelling Path :-
Let’s say we have two Email providers, one is gmail.com and other is yahoo.com, ABC is a registered user in gmail.com and XYZ is a registered user in yahoo.com.
• ABC signs in to his Email account in gmail.com, he then writes a mail to the xyz@yahoo.com and sends the message.
• But what happens behind the curtains, the Email from the computer of abc@gmail.com is forwarded to the Email server of gmail.com. Server of gmail.com then looks for yahoo.com on the internet and forwards the Email of the yahoo.com for the account of XYZ@yahoo.com. Yahoo server puts that email in that account.
• XYZ then sits on computer and signs in to her Email account.Now she has the message in her Email inbox.

 Sending Fake/spoofed Email -:  Fake or spoofed email means the email from any email ID. It doesn't matter whether the sender's email really exists or not. Sender's email ID can be anything@anything.com. 


   Read the disclaimer before proceeding


Methods :-


1. Using Open Relay servers :  An open relay server is that which allows people to send email by connecting to it. User connect to it via telnet and instructs server to send email. This method is outdated or simply I should say that, it doesn't work. I would not talk about it more.

2. Using Websites : There are numberless websites that provide free service to send fake emails. But the problem is that they attach the advertisments along with your email.  But the best two, I have found that do not attach the advertisments.

www.emkei.cz      {have some advance options}
www.hidemyass.biz/fake-mailer/

3. Using mail sending scripts : The PHP contains mail sending function which allows us to send email with fake headers.
Download a php script from here.
We just need to upload the mail sending script on a web hosting site. It doesn't work on every webshosting site because there is no email sending support.  I have tested x10hosting.com (could take upto a day for account activation) , it works perfect. Some of the other are www.000webhost.com,byethehost5.com

Note: This script contains options of sending spoofed email, spamming and email bombing. Your hosting account might be immediately suspended on spamming/bombing. But it works perfect if you have any your own premium web hosting account. If you want to try email bomber, I could let you to use my own if sufficient people request in comments.

What is Email Spamming and Email Bombing ?

Email Bombing as clear from the name is sending the mass emails that is large number of emails to a email ID in a single click. Email spamming is like sending an email to large number of email IDs in a single click. These activties are performed mainly for the advertisements of the products or services provided by a company. Many spammers spam to collect individual's personal information through some stupid things like 'fill these details to get your lottery amount' and that information is sold to businessmen looking for the people of different categories. There could be many more reasons of spamming. Spammers use automated tools to collect as many emails available on websites,forms,chat rooms and send spams to them.

How to identify whether an email is real or spoofed ?

It can be done by checking headers. Email headers is simply the text which contains the information about the mail servers that the email encountered in its path from the sender to receiver. It contains a lot of other information too.
Note: I am just telling you a few points about this so that you would just get an idea about the approach. This may or may not depend on some factors.

We can view email headers in gmail by clicking at 'show orignal', in yahoo by clicking at 'Full headers' and such kinds of options in other email service providers.

If  you get an email displaying sender's email like someone@gmail.com, someone@hotmail.com, someone@yahoo.com . Then it should be orignated from gmail,hotmail and yahoo servers respectively. But if it doesn't, the most probably the email would be fake. 

I will show you by an example, I received three emails in my gmail inbox from sender's address "someone@gmail.com."  Sender's address shows me that they should have been orignated from gmail/google server, if they would be real.

Note : There is a field called "Return-path" in headers.  If the email ID shown in this field and email ID you get as sender's email ID doesnt match, then the email is surely fake.

Can we get sender's IP address from Email Headers ?

We may or may not. Gmail, yahoo normally do not reveal sender's IP address. But when we send an email from a php script,  the headers might reveal Sender's IP. The conclusion is that answer to this question varies from different email service providers and the way how email is sent.


Can we trace sender's location, if we get his IP address ?

The IP address could only tell that which Internet Service Provider (ISP) is used by sender. Further details can not be revealed without the help of that ISP. Normally the Public IP is dynamic that is it keeps changing. We need to ask ISP about the user who was assigned that IP at the time email was sent. If sender has purchased a static IP address, it doesn't matter that when exactly was email sent. He could easily be traced.

How to secure your system from Keyloggers

What is Keylogger?

Keylogger is one of spyware which will what type you through the keyboard and send it to hacker who send the keylogger. Hackers mainly use keyloggers to steal your passwords, credit card numbers and other confidential data.  So whenever you type the username and password in gmail,online banking sites, it will send the username and password to hacker.  

How to Protect?

In order to provide security for your system,you must have

Good AntiVirus:

This is basic and best step to protect your system from keylogger.  So buy a licensed and best antivirus which is currently in market.  My suggestion is Kaspersky, Norton or Mcafee.  Don't forget to update regularly.

Note: Don't use trial or cracked pack ,it is worthless to use.

Good Spyware:

Since keyloggers are basically spywares, if you are a frequent user of Internet then you could be exposed to thousands of keyloggers and spywares. So you should use a good antispyware such as NoAdware.

Antilogger can be Handy

Antiloggers are programs that detect the presence of keyloggers on a given computer. Zemana Antilogger is the best antilogger.

Online Scanning

When ever you receive a suspicious file, you scan it with online scanners such as Multi engine antivirus scanner which scans your file with 24 antivirus engines and reports it back to you if the file is recognized as a virus or spyware. This ensures that none of the malicious programs can escape from being detected as there are 24 different antivirus engines are involved in the scanning process.

Keyscrambler

Keyscrambler is one of the best protection against keyloggers that you can have, Keyscrambler is a small program which encrypts your typed keystrokes so even if the victim has installed a keylogger on your system, he or she will get encrypted keys. Keyscrambler currently supports Firefox, Internet explorer and other applications, however its premium version supports more than 160 applications