Ardamax Keylogger(Free and full version)

Today i am going to show you how to hack gmail, facebook, Yahoo! Passwords using ardamax keylogger.
  sometime latest antivirus show it as virus,,but don't worry it is not virus,,....use nd enjoy..

Procedure to hack.
Step 1) First downoad Ardamax keylogger from here. 
PASS: hackersunderground

Extract the keylogger from RAR into your desired folder and open it.

Double Click  the setup file and install it as normal setup by clicking next.
Once if you complete your installation, it shows an icon at the right bottom corner of your screen as shown in the figure below..

  then after installation double click on the patch,, and patch the ardamax instal exe file.. which instal in your given directory..

Step 2) Now right click the ardamax kelogger icon and select  “enter registration key “ Enter the name and key which are there in the downloaded folder.

Step 3) Now right click the icon and select “remote installation”. Click next by checking all the boxes until you see the following window and then follow the following pictures.

Step 4) Once you are done with the above, you will see the following window. Selecting delivery method via FTP is the better option, but in this tutorial i am going with email delivery method.

Now fill the email options as mentioned here.
Send to- your email id
Send from- your email id
Smtp host –smtp.gmail.com
And finally your username and password.  You can test whether it is working or not by clicking the test button. And finally click next to proceed.

Step 5) Now you can change your icon by selecting change icon option and then click next.

Finally you will see the following window, if you have done everything correctly.

Now send the created server file to your victim. It logs all his keystrokes and sends them to you via email.
Note: The server file you have created will be detected as a virus by your antivirus. I will write few articles on bypassing antivirus detection in my upcoming posts.

post by rishabh sharma hackersunderground

Read more »

[TUT]HOW TO MAKE AN SELF-DESTRUCTING E-MAIL!!

 If you ever wanted to to trick your friends by sending them a self-destructing e-mail or are just of curiosity here, then continue reading. We will be using a Self-destruct service which tells you when your tracked e-mails are opened, viewed… Follow the steps below:

1) Go to this website: [url=http://www.self-destructing-email.com/][/url]http://www.self-destructing-email.com/



2)Sign up for free and get your account. Use your e-mail while registering.

3) Fill up the details.

4)Now just log in into your e-mail service you are using and write a new message, so like sending an ordinary message to your friend, except, in column where it says ,,To’’ Just add .self-destructing-email.com at the end of your friends e-mail address.

Your friend will receive an e-mail that says he has to click on the link to read the message, when he opens it a message will pop up that will say he has 1 minute to read the message, and the message will expire after 1 minute.




HOPE YOU LIKED IT!!! 

post by rishabh sharma hackersunderground

Read more »

[TUTORIAL]Hack Facebook Accounts On The Same LAN!

Ok, I am going to show you a way you can hack the facebook accounts of all the people who are on your network (LAN/wifi ). This is really the best way to hack facebook accounts. It’s much easier than installing RATs, Keyloggers or making phishing sites.

You will need 3 tools for this:
Cain and abel : http://www.oxid.it/cain.html
Wireshark : http://www.wireshark.org/download.html
Web developer add-on for firefox : https://addons.mozilla.org/en-US/firefox...developer/
So what exactly happens when you type in http://www.facebook.com and login with your username and password? First download the web developer addon for firefox and then login to facebook. After you log in view the cookies in the web developer toolbar.

 

Ok now if you click on view cookie information, you will be able to see all the cookies which facebook has transmitted to your browser.

The main cookies are the c_user cookie (which identifies a person uniquely) and datr cookie.

So your aim must be to get the cookies of your victim through wireshark and then replace your cookies with the victim's. So then, facebook will think you are the victim as you have his cookies and you will be logged in as the victim. Simple isn't it?

So how do you do this?

First off install cain and abel. It will ask you whether you want to install the packet driver - WinPCap. Go ahead and install that also. Open up cain.
1. Click on configure on top and select your Network card. Mostly it's the one with an IP address.
2. Next click on the start/stop sniffer on top as shown below in green square.
3. Once you start the sniffer, go to the sniffer tab in cain, right-click and click scan MAC address as shown below!

 


Ok now you should have a list of everyone on the network. It may take some time though. You can right-click on any one computer and find out its name.

Now what we are going to do is the actual shit! We are going to do an ARP poison! What this means is that you fool the router in thinking that you are the victim, and you fool the victim in thinking that you are the router.

So initially victim -> router -> facebook. Now after ARP poison, victim->hacker->router. This is called an MITM(Man in the middle) attack. You can google it for more info.

Doing the ARP POISON
1. First Click the APR tab below in cain
2. Click the white screen in the top frame
3. Click the blue plus on top.

 

Now you should get a list of all the devices on the left and a blank screen on the right..

In the left screen you should select the router IP. And in the right box, select the computers you want to target. To be safe it's better to target one computer. But if you want some real fun then select all the computers on the right frame. Press ok.

WARNING: If there is a person at the router, he can know if you have just done an ARP poison. But where is the fun without the risk.

You can try googling on other methods to do ARP poison safely.

In the top frame all the computer list should have got filled. Now select the whole list and click on the nuclear button (top left of cain).
  







Thats it you are done with the ARP poison. Just be careful, if you select too many computers, your computer can't handle the traffic and the network may just crash.

Now all the data is passing through your computer. All you have to do is sniff the data in wireshark, get the cookie and replace your cookie with victim's cookie.

So how do you go about doing that? It's very simple actually.
1. Open up wireshark.
2. Go to capture -> Interfaces in the top menu and select your interface. It's usually the one which has an IP address and a certain number of packets flowing through it.
3. Next go to capture and click on start. It should look something like this




This window has all the packets sent from the victim's/victims' computer to the router and all the packets sent from the router to the victim.

Next in the filter type "http.cookie contains datr". You ask why? Because, when a user logs in to facebook, he is given some cookies which are unique to him. If we replace our cookies with the victim's cookies, we can login to his account as then facebook won't know the difference.

  You now have the cookies. To get the information stored in the cookies, right-click on any one of the cookie and click on Follow TCP stream.

 

In the TCP stream look for the line Cookie: (and all cookie names). If it doesn't come, select some other packet in wireshark and click on follow tcp stream for that. You can see the source IP and destination IP in wireshark. So if you have more than one source IP, then you know you have the cookies of more than one account on your LAN. This is what I got when I did it.



So now you have it. The datr cookie, c_user cookie, lu cookie, sct cookie, w cookie and xs cookie. These are the main cookies you need.

Now open firefox and go to http://www.facebook.com. Once there, click on cookies in the web developer add on which you had installed in the last post. Then do the following:
Clear session cookies
Delete domain cookies
Delete path cookies




IMPORTANT: Once you do this, again type http://www.facebook.com in the URL and click enter. Basically you are reloading facebook after deleting all cookies.

Now login to your account with your username and password. After logging in, click on cookies in web developer add-on and click on "view cookie information".

And there you have all your cookies. Now what to do?! I guess you know it by now. !

Click on "edit cookie" for each cookie there and replace the cookie value with the value you got through wireshark.

If you did not get all the cookies in wireshark its OK! But mainly, you should look to replace the datr cookie, c_user cookie, lu cookie, sct cookie, w cookie and xs cookie.



After replacing all the cookie values with the ones you got in wireshark, just refresh the facebook page. And that's it! You are in to the victim's account! You have HACKED a facebook account on LAN!

POSTED BY HACKERSUNDERGROUND

Read more »

Gmail Hacker | Fake Tool to Hack Gmail Accounts

Hey friends, today i am going to disclose some irony stuff that Hackers nowadays using to make people fool these days. Hackers are spreading a software tool named as Gmail Hacker v1.0 on the internet with title " Hack Gmail Accounts using Gmail Hacker" or "Gmail Hacker : A superb Gmail Account Hacking tool". But beware of such articles because its nothing more than a smart keylogger which is actually intended to hack users credentials that user gonna use to hack somebody's gmail account. Let us discuss the process in detail:

First of all frankly speaking, Gmail Hacker is a hacking tool( or i better call it social engineering hacking tool) which can be used in either way like Hacking someone's Gmail account and at same time loosing your Gmail Account( if not handled with extreme care). So friends which process you all wanna learn first. Hacking one or getting Hacked one.. or both at same time going step by step :P.

For Having a trail of Gmail Hacker tool you gonna need below stuff:

• Download .Net Framework
• Gmail hacker
• Winrar (In order to extract the files) 

Now lets go step by step for the Hacking procedure:

Gmail Hacker for Hacking Gmail Accounts:

Step 1 - Extract the arhive named Gmail.rar on your computer, Once you have extracted you will see the following file:

Builder.exe

Step 2 - On opening Gmail hacker builder.exe you will see the following:

Step 3 - Next you need to enter your gmail address where you would receive logs. However I would recommend you to create a fake email address and use it for receiving logs. 

Step 4 - Once you have entered your credentials, click on the build button. 

Step 5 - A file named gmailhacker.exe would be created, On executing the file, the victim will see the following: 

Now you need to apply your social engineering skills in order to make the victim enter his/her credentials on to the software. The simplest way of accomplishing this is to tell the victim that the application Gmailhacker.exe is itself a gmail hacking software, You just need to the victim's username, your own gmail ID and your own gmail password, where you would receive victims passwords and click "Hack Them".

Step 6 - Once the victim clicks on the "Hack Them" button, his own gmail credentials that he entered would be sent to you on the email you typed while configuring the software. 

Well, here is an interesting part, when the victim will click on the button "Hack them", he will receive the following error, making him thinking that their is a problem with the software:

Now i hope you all understood which part you need to provide credentials and which part you need to provide the fake account credentials that you have recently created.

Irony Part : The file that is being generated by builder.exe i.e. Gmail Hacker.exe is a advance type of remote keylogger which will sent the credentials you have entered into the Gmail Hacker option menu to the hacker who has build the Gmail Hacker.exe file. So important part never put your original account credential in any of such tools which gurantees that they can hack email accounts or facebook accounts because all are simply fake. They are just cool social engineering stuff which is used to make newbie Hackers or users fool to hacker their Gmail accounts.

If you have any doubts ask me in form of comments.

post by rishabh sharma hackersunderground

Read more »

How to hack crack or bypass cyberoam in college

Hello Friends, today i am going to explain you How to hack crack or bypass cyberoam websense and all other security firewalls that college, institutions, offices use to block websites at their respective places. Most of colleges, school and offices nowadays prefers a hardware firewall to block the users to access the restricted websites. Most of my friends have asked me about that how to access blocked websites or bypass cyberoam or simply cracking the cyberoam to access restricted websites in their college and offices, i have explained some methods earlier also but those loopholes are now fixed and those methods to hack cyberoam and websense doesn't work effectively now and also hacking through proxy is quite tedious task as first of all we have to search for good working proxy websites which in itself is a very tedious task, and most of times it is also blocked. So it actually wastes lot of our precious times and most important daily. So why don't we have a permanent solution for it. The method that i will explain today is really awesome and doesn't require much effort and thus its quite easy and the most important its 100% working. So friends read on for detailed hack....

Hacking or bypassing or cracking cyberoam

For hacking Cyberoam or Websense  you must know How cyberoam and websense works? If you know how it works then you can easily find flaws in it and hack or bypass it very easily. So friends lets learn how cyberoam actually works.

Cyberoam is a 8 layer hardware firewall that offers stateful and deep packet inspection for network and web applications and user based identity security. Thus the firewall is quite secured. Now how we can hack that 8 layer security its the main important question here, as i have mentioned above that main working and blocking of any website or application by cyberoam is basically done at deep packet inspection step, now here the flaw in any security firewall lies, also in case of cyberoam and websense too. They block all websites by parsing their content and if their content contains the restricted keywords then they block that websites. They also use category blocking which also works on same concept. The flaw is with websites that uses SSL feature, the websites that contains SSL lock i.e. the websites that uses https are not blocked by them. They have to block these websites manually which is a very hectic task and believe me nobody blocks them.

So the proxy websites that uses https i.e. SSL proxies are also not blocked by these websites. 

Only those proxies are blocked which are known or being heavily used. But the tool that i give you create SSL proxies by itself that means its proxies cannot be blocked. So friends this tool rocks..:P :)

Things that we need to hack cyberoam, websense and any such such hardware firewall:

1. TOR browser ( a anonymous web browser like Mozilla which has inbuilt proxy finder that bypasses the websites easily that are being blocked by cyberoam or websense).

2. A USB or pendrive ( where you will keep the portable version of TOR browser)

3. If USB drives are disabled we will use different drive for its installation. (also portable version of TOR can be executed from any place).

Steps to hack Cyberoam:

1. Download the TOR web browser.

     To download TOR browser: CLICK HERE

2. Now install the TOR web browser. In case of portable version it will extract.

    For Installation and usage Instructions visit here: CLICK HERE

3. Now open the TOR browser and start surfing your favorite website like facebook, orkut, gmail ..everything at you office....

4. That's all the hack. I hope you all have liked it.

Note: Have a portable version in your pen drive or USB drive and enjoy where ever you want.

For such hacks keep visiting...and subscribe our posts, if you don't wanna miss any such hack....

post by rishabh sharma hackersunderground

Read more »

Crypters tutorial for Hackers by Hackingloops

Crypters are computer applications which are solely used to bypass the antivirus detection of malwares. Hackers use crypters to hide viruses, Trojans, RATS, keyloggers and other hack tools into a new executable, whose sole purpose is to bypass the detection of the same from antivirus. Crypters are basically dead programs which does not affect the actual functionality of the program, they just spoof the actual program behind their encryption and make antivirus fool. Most antivirus detects viruses on basis of heuristics and normal string based detection. Since we have spoofed the original program, so antivirus stand lame and does not detect it as virus.

Common terms related to crypters:

   

For understanding and designing crypters, hackers must be aware of certain terms, most of you already know these terms, but as i am writing this tutorial starting from novice level and take it to elite level at the end. So if you know these terms just read them one more time, as that might help you to clear some of your doubts.

1. FUD or UD : Fully undetectable(FUD) means that your virus is not detected by any of the existing antiviruses while undetectable(UD) means detectable by few antiviruses. FUD is our only goal and elite hackers always rely on that. 

Note: Crypter will remain FUD until you have openly shared on internet. Public crypters remains FUD up to maximum 2 to 3 days then they become UD. So if you want to use crypter for long time so never publish and share that on internet. Use it anonymously.

2. STUB : A stub is a small piece of code which contains certain basic functionality which is used again and again. It is similar to package in Java or simply like header files in C ( which already has certain standard functions defined in it). A stub basically simulates the functionality of existing codes similarly like procedures on remote machines or simply PC's. In crypters, client side server is validated using stubs, so never delete stub file from your crypter. Stubs adds portability to crypter code, so that it can be used on any machine without requiring much procedures and resources on other machines.

Let me explain with small example:

Suppose you are writing a code that converts bytes to bits, so we know formula or method for converting bytes to bits will remain same and it will be independent of machine. So our stub (or method stub or procedure) will contain something like this:

BEGIN
    totalBits = calculateBits(inputBytes)
    Compute totalBits = inputBytes * 8
END

Now what we will pass is only number of bytes to this stub. And it will return the resulting bits. Similarly, we include some common machine independent checks and functions in our stub, and in main code we only passes linkage and inputs to these stubs, which in return provides suitable results.

Note: Most of times it happens, suppose you downloaded some keylogger and you complain to provider its not working, only reason for that is stub. Also always kept in your mind, if you are downloading any keylogger or crypter  always check stub is present in it. If not, don't download it, its just a piece of waste and for sure hacker is spreading his virus using that. I recommend that never download any hacking tool on your real machine, always use virtual machine or sandbox to test hack tools.

3. USV: Unique stub version or simply USV is a part of crypter that generates a unique version of stub which differentiates it from its previous stub, thus makes it more undetectable against antiviruses. For detecting this antivirus companies has to reverse engineer your crypter stub, that is not that easy to do, so it will remain undetectable for long time. This consist of one most important component USG ( unique stub generation) which is the actual part of crypter that encrypts and decrypts the original file means its the heart of your algorithm and i will recommend never write this part in stub, rather include this part in main code. Why i am saying this, stub is part of code which is shared with victim, so it will become public and hence your Crypter will not remain FUD for much long time.

Different types of crypters:

1. External Stub based crypters : This category consists of public crypters (those you have downloaded till date :P (noobish one's) and you complains to provider that its detectable by antiviruses. That really foolish complaint, if crypter is public then it can never remain FUD. So don't ever complain to me also after my next article for such noobish things. Ahahah.. i got deviated for real thing.

External Stub based crypters are those crypters in which most of the functionality of the crypter depends of external stub, if your delete that stub file, your crypter is useless. :P Most antivirus only do that. These type of crypters contains two files one is client.exe and other is stub.exe . Stub contains the main procedures and client contains the global functions that call those procedures.

2. Internal or Inbuilt stub based crypters: The crypters that contains only one exe file (i.e client) fall under this category. This client file has inbuilt stub in it. You can separate stub and client part here too using RCE (reverse code engineering) but it is not recommended.

Note: External or Internal stub doesn't make much difference as antivirus detects files on the basis of strings related to offsets. Whenever you reverse engineer any application or program, the program execution flow will gonna remain the same but offsets may change. USV will come into picture at this point. If you include your encryption algorithm separately then it will be more harder for antivirus to detect your crypter.

3. Run time crypters: Run time crypters are those crypters which remain undetected in memory during their execution. We are looking for these type of crypters only. :P These can any of the two above.

4. Scan time crypters: Those crypters which will remain undetected while encrypting the files but will become detectable when resultant file is generated. :P Fking one's that wastes all effort we have put. This really annoys everything is working fine and at last you get your file being detected by noob antiviruses.

post by rishabh sharma hackersunderground

Read more »

How to hack keyloggers or RAT's server password

Keylogger's and RAT's nowadays are everybody's problem across the internet. Hackers use keyloggers to hack the email passwords of the victim which they receive in the form of emails or text files on their respective FTP servers. They spread their keyloggers with the help of cracks, keygen's or patches of popular software's or simply through hack tools. So friends, today i will teach you how to reverse engineer the keylogger or RAT to hack the hackers FTP server or email password. I have already discussed this with the help of bintext tool on my other website ISOFTDL. 

Most of hackers thinks that they are too smart, so what they do bind their keylogger or Rat servers with popular programs and when user open that their system got infected and hence what ever they type is get recorded and sent to hacker. 

Now all keyloggers sent data to hacker in regular intervals (usually every 5 to 10 minutes) by using below to ways:

1. Using the Emails : where hacker configures his email ID and password while creating the server. Keylogger records the key strokes in a temp file and sends it to the hacker in form of emails. But this has a limit as most free email servers like Gmail or Yahoo or Hotmail has limit of 500 composed and received mails. So most hackers use the second method.

2. FTP server : While creating the keylogger server, hacker configure their FTP server, where they receive the logs of key strokes in the form of text file( usally labeled on the basis of current system time stamp). Hackers keylogger server uploads the files to FTP server after every few minutes interval.

So friends, here the actual trick or loophole in above technique lies. If we monitor the everything coming in and going out of our Ethernet card or Wireless then we can detect that what is going out of our system. Its nothing but just monitoring your your system's traffic, where its going and from where its coming. You can use any of the tool that monitor the packet flow of your Ethernet or wireless card.

ok...ok.. let me tell you my favorite tool for doing the same. I love Wireshark because its simply superb.

Wireshark is a very famous network scanning hack tool which is used by hackers or network forensic experts to monitor the packet flow of their network cards like Ethernet or WLAN. It records the each and every packet coming and going out of your system's Network card. Now you all must be thinking wth is this Packet. Packet is nothing but just a bunch of bits(data in form of 0 & 1) usually 32bit or 64bit. In network terminology, data is termed as packet which can be either TCP or UDP( both contains the header n other stuff accordingly). 

So friends, whenever you feel anything suspicious in your system like your system is compromised or you are infected from a keylogger or RAT or simply you want to test a hack tool and you are not aware that hack tool is safe to use or not. Just follow the below procedure to reverse engineer these noob hacking tools.

Note: Every keylogger or RAT sends the logs to hacker's FTP server or email account after few minutes interval( when you are connected to internet) but some novice keyloggers even tries to send data while you are offline and hence the data sending keep on failing. In some situations it displays warning message and in some situations you PC gets hanged or SVHOST service CPU usage increases. But nothing matters whether it sends logs online or offline, the only thing matter is time period, after what interval it sends data.

Steps to Hack or reverse engineer the Hacker's Keylogger server password:

1. First of all download and install the wireshark. You can easily get this using by Googling it. 

Note: While Wireshark is getting installed, ensure that it installs the Winpcap with it other it won't work properly.

2. Now go to the Capture button in the top menu of the Wireshark as shown below and select the interface( means your network card which can be Ethernet or WLAN).

3. Now it will start capturing the packets through that Network card. What you have to do is just keep capturing the records for atleast 20 - 30 minutes for getting the best results. After 20- 30 minutes, again  go to capture and stop capturing the packets.

4. Now you need to filter your results, for this Go to the filter box and type FTP and SMTP one by one. Note: if you get records for FTP then hacker has used FTP server and if you didn't got FTP that means hacker has used SMTP, so give SMTP in Filter box.

5. As you scroll down you will find the “FTP username” and “Password” for victims ftp account in case FTP server is used.  And if hacker has used SMTP then you will find "email address" and its "password" that hacker has used to create keylogger.

6. That's all my friends. Isn't that too easy. 

 

post by rishabh sharma hackersunderground

Read more »

How to access blocked sites or country restricted sites

Hey Friends, yesterday i encountered a cool Firefox and chrome plugin(add on). This enables users to access the blocked websites or the sites that are blocked in few regions say torrents blocked in India or some websites which are accessible only for US or UK users etc. So today i am going to tell you how to use that Firefox and Chrome plugin to access blocked sites or regional website.

Some websites like Netflix or Hulu are only accessible to US residents, similarly, there are many other websites which may be blocked by your ISP, your school or college, etc. Stealthy is a handy add on(plugin), available for Google Chrome and Firefox, which can solve this problem.

Stealthy allow users to access blocked websites by setting up a working proxy on your browser with a click of a button. What Stealthy does is that it search for different proxies online and use the best one based on your location and setup a new IP so that you can access blocked websites.

As with all other extensions, Stealthy once installed, a small red airplane icon will appear right next to your address bar in Google Chrome, which means that Stealthy is disabled. Click on it to enable Stealthy and enter the URL of the website you want to access.

Access blocked or restricted sites using Stealthy

Stealthy provides users with four different options to choose from – Pro USA, Pro UK, Normal and Customized. Under USA, it allows you to use services such as Hulu, Netflix, etc. that are accessible only to USA residents. With UK option, you will be connected to internet as if you were in UK so that you can access UK restricted websites. With Normal, it gets a proxy from a random location to access websites that are blocked in your region but are available in the rest of the world. If you want to use a country specific proxy, use the customized option otherwise you can stick to normal. If you don’t want Stealthy to work on any specific website, you can add them to the Bypass list.

Note : Enabling Stealthy may slow down your internet so it’s better to keep it disabled if you are browsing regular websites.

DOWNLOAD:

Download Stealthy for Google Chrome

Download Stealthy for Firefox

post by rishabh sharma hackersunderground

Read more »

Facebook Hidden Dangers Exposed by CBSNews

 CMSNews has recently interviewed Joan Goodchild regarding the security and privacy gaffes over the world famous social networking website and you all will be shocked when you will read what she has answered. He has exposed more than 10 loopholes in the Facebook security and its privacy policies. She even insisted to an extent that sharing personal things over Facebook can sometimes even put you into big troubles. So friends, always take care while sharing your personal information on Facebook as it can be dangerous.

Facebook claims that it has 400 million users. But are they well-protected from prying eyes, scams, and unwanted marketers?

According to Joan Goodchild, senior editor of CSO (Chief Security Officer) Online answer is simply "NO".

She says your privacy may be at far greater risk of being violated than you know, when you log onto the social-networking site, due to security gaffes or marketing efforts by the company.

Facebook came under fire this past week, when 15 privacy and consumer protection organizations filed a complaint with the Federal Trade Commission, charging that the site, among other things, manipulates privacy settings to make users' personal information available for commercial use. Also, some Facebook users found their private chats accessible to everyone on their contact list, a major security breach that's left a lot of people wondering just how secure the site is.

In two words, asserts Goodchild: not very.

Facebook Dangers Exposed by CBSNews

On "The Early Show on Saturday Morning," Goodchild spotlighted five dangers she says Facebook users expose themselves to, probably without being aware of them:

• Your information is being shared with third parties
• Privacy settings revert to a less safe default mode after each redesign
• Facebook ads may contain malware
• Your real friends unknowingly make you vulnerable
• Scammers are creating fake profiles

Below is an edited transcript of the interview:

Question :Is Facebook a secure platform to communicate with your friends?

Answer: Here's the thing, Facebook is one of the most popular sites in the world. Security holes are being found on a regular basis. It is not as inherently secure as people think it is, when they log on every day.

Certainly, there are growing pains. Facebook is considered a young company, and it has been around a few years now. It is continuing to figure this out. They are so young, they are still trying to figure out how they are going to make money. It is hard to compare this to others; we have never had this phenomenon before in the way [so many] people are communicating with each other--only e-mail comes close.

The potential for crime is real. According to the Internet Crime Complaint Center, victims of Internet-related crimes lost $559 million in 2009. That was up 110 percent from the previous year. If you're not careful using Facebook, you are looking at the potential for identity theft, or possibly even something like assault, if you share information with a dangerous person you think is actually a "friend." One British police agency recently reported that the number of crimes it has responded to in the last year involving Facebook climbed 346 percent. These are real threats.

Lately, it seems a week doesn't go by without some news about a Facebook-related security problem. Earlier this week, TechCrunch discovered a security hole that made it possible for users to read their friends' private chats. Facebook has since patched it, but who knows how long that flaw existed? Some speculate it may have been that way for years.

Last month, researchers at VeriSign's iDefense group discovered that a hacker was selling Facebook usernames and passwords in an underground hacker forum. It was estimated that he had about 1.5 million accounts--and was selling them for between $25 and $45.

And the site is constantly under attack from hackers trying to spam these 400 million users, or harvest their data, or run other scams. Certainly, there is a lot of criticism in the security community of Facebook's handling of security. Perhaps the most frustrating thing is that the company rarely responds to inquiries.

Question: Do people really have privacy on Facebook?

Answer: No. There are all kinds of ways third parties can access information about you. For instance, you may not realize that, when you are playing the popular games on Facebook, such as FarmVille, or take those popular quizzes--every time you do that, you authorize an application to be downloaded to your profile that gives information to third parties about you that you have never signed off on.

Question: Does Facebook share info about users with third parties through things such as Open Graph?

Answer: Open Graph is a new concept for Facebook, which unveiled it last month at its F8 conference. It actually is basically a way to share the information in your profile with all kinds of third parties, such as advertisers, so they can have a better idea of your interests and what you are discussing, so Facebook can--as portrayed--"make it a more personal experience."

Question: The theory behind Open Graph--even if it has not implemented it--is its whole business model, isn't it?

Answer: That is the business model--Facebook is trying to get you to share as much information as possible so it can monetize it by sharing it with advertisers.

Question: Isn't it in Facebook's best interest to get you to share as much info as possible?

Answer: It absolutely is. Facebook's mission is to get you to share as much information as it can so it can share it with advertisers. As it looks now, the more info you share, the more money it is going to make with advertisers.

Question: Isn't there also a security problem every time it redesigns the site?

Answer: Every time Facebook redesigns the site, which [usually] happens a few times a year, it puts your privacy settings back to a default in which, essentially, all of your information is made public. It is up to you, the user, to check the privacy settings and decide what you want to share and what you don't want to share.

Facebook does not [necessarily] notify you of the changes, and your privacy settings are set back to a public default. Many times, you may find out through friends. Facebook is not alerting you to these changes; it is just letting you know the site has been redesigned.

Question: Can your real friends on Facebook also can make you vulnerable?

Answer: Absolutely, Your security is only as good as your friend's security. If someone in your network of friends has a weak password, and his or her profile is hacked, he or she can now send you malware, for example.

There is a common scam called a 419 scam, in which someone hacks your profile and sends messages to your friends asking for money - claiming to be you--saying, "Hey, I was in London, I was mugged, please wire me money." People fall for it. People think their good friend needs help--and end up wiring money to Nigeria.

Question: A lot of Web sites we use display banner ads, but do we have to be wary of them on Facebook?

Answer: Absolutely, Facebook has not been able to screen all of its ads. It hasn't done a great job of vetting which ads are safe and which are not. As a result, you may get an ad in your profile when you are browsing around one day that has malicious code in it. In fact, last month, there was an ad with malware that asked people to download antivirus software that was actually a virus.

Question: Is too big a network of friends dangerous?

Answer: You know people with a lot of friends--500, 1,000 friends on Facebook? What is the likelihood they are all real? There was a study in 2008 that concluded that 40 percent of all Facebook profiles are fake. They have been set up by bots or impostors.

If you have 500 friends, it is likely there is a percentage of people you don't really know, and you are sharing a lot of information with them, such as when you are on vacation, your children's pictures, their names. Is this information you really want to put out there to people you don't even know?

So friends, be careful while sharing your information online specially of social networking websites like Facebook.

Note:-This interview, "Five Hidden Dangers of Facebook," was originally published on CBSNews

post by rishabh sharma hackersunderground

Read more »

Hacking Facebook Chat box Video Tutorial

Facebook is one of the best social networking websites on the internet, and we all know Popularity drives developers crazy, so they try to develop new things regularly. Similarly the support of my HackingLoops users provokes me to explore new hacks for my friends and users. Friends good news for you, this time i found three few bugs in Facebook. I have also included video tutorial for the same, so you all can understand the things easily.. I love to find the hacks and tricks of Facebook and this is my another contribution to you Friends.

Hacking Facebook Chat box video tutorial

The Facebook chat findings are:

1. Use profile picture of anyone as Emoticon in chat.

2. Using any Facebook Picture as Emoticon in chat

3. Sending Invisible chat messages.

Using these hacks we can use anyone's profile picture or any Facebook image or photo as emoticon in our  chat along with that i have explored lot of hidden emoticons in Facebook. For explaining you in detail i have made a video for you Guys so that you can understand each scenarios perfectly. How i figured out these??

I was searching for Client side bugs in Facebook and suddenly i saw a script namely fO_oP6n8OAk in the Facebook scripts in firebug, there i have found lot of hidden emoticons but i was not satisfied with them, then i read the javascript code further and found something really interesting. We can use our profile ID either number or text as emoticon in Facebook chat by just putting that in below format in chat box:

[[profileID]]

My profile ID is www.facebook.com/lonerusher

Now if you type [[lonerusher]] you will be able to see my profile picture as emoticon. Similarly in cases when profile name is not present then there must be some number like profile ID as shown below:

profile.php?id=534757615

Now in this case you have to use [[534757615]] in the chat to get the emoticon of that profile image.

Similarly pick any picture in the Facebook, example i have picked this one:

photo.php?fbid=216057861810512&set=t.1057800144&type=1&theater

Now if you wish to use this picture as your image what you need to do is that you have to use the number in front of fbid in your Facebook chat which will be [[216057861810512]].

Now In some cases what happens is that image is generated through application, means user hasn't uploaded that. In that case if you use number in front of fbid then it will  result into a invisible message.

Also if you give wrong ID in the Facebook chat box then it will show a emoticon with ? . Isn't that cool.. yup it is.. So friends have fun with your friends, give surprise to them by your new set of emoticons and invisible messages..

Below i have added a complete video, which is demonstrating each and everything in detail, so enjoy your hack...I have also included how to use firebug to find emoticons scripts in Facebook which are hidden from general user.

post by rishabh sharma hackersunderground

Read more »

2 New Facebook Text Tools

Hey friends, HackingLoops again presents you two more Facebook text tools to its users. These two tools are Hackify and Coolify.These tools will create awesome decorative texts which can be directly used in Facebook status updates and Facebook Chat to surprise your Friends. I am sure you all will enjoy the both Tools as they are absolutely unique.

Smart and decorative text as Status updates adds flavors to your boring Social Networking and help you score over your friends by surprising them daily with new and cool status updates. Below are the two tools:

1. Coolify Facebook Text Generator Tool

This tool will generate the coolified text with the help of Unicode format and it works on all social networking sites like Facebook, twitter, Google Plus etc..

Щё Lоvё HacкїйgLооp$ Gяоцp

Try Coolify Tool now: COOLIFY TEXT

2. Hackify Facebook Text Tool

This tool will generate the text which hackers and geeks love to use in their names and status updates. This tool is an advanced version of Coolify where every letter changes when user enters any character or select or hover.

So update your status messages like Hackers.

Ш℮ ℒø√ℯ Ħ@¢кḯηℊℒø☺℘ṧ Ḡяøüρ

Try Hackify Tool now: HACKIFY TEXT

 

for more symbol http://fsymbols.com/

post by rishabh sharma hackersunderground

Read more »

How to Hack Facebook account or password

 

Note: This is for Educational Purposes only. Don't misuse it.:P Please...

Requirements:

1. Facebook latest Phisher or Fake Pages.

Download Latest Facebook Phisher here: Download Now

2. Free Web hosting server to upload those Phish Pages.

3. Spoofing URL using Host name mapping technique.

Let me provide you little background what i will teach you today. I know most of you already know phishing but for first timers, let me explain a bit. Phish Pages means Fake Pages that looks absolutely similar to original pages and the technique of using those Fake pages to hack anyone's user name and password is called Phishing. And technique which we use to send these fake pages to victim and prompt him to believe that they are real is called Social Engineering. But i think this we already know, what's new we are going to discuss today.. Ahhh... Just wait and hold your pants tight because today i will be breaking all the policies and ethical norms because until and unless we don't know how hackers do things we will never able to stand in front of them.

What is New???

We all know that fake pages can only be detected using two techniques:

1. Verifying the URL in the address bar, if its a fake page then URL must be different from original one.

2. Using any web security toolbar that warns users for fake pages like AVG toolbar, Norton Online security toolbar etc..

But what if you open www.facebook.com manually in your web browser and fake page opens and URL in the web browser remains www.facebook.com only. That means first technique to detect fake page go in vain. Now for second technique, all online web security toolbar detect fake pages by comparing the input  by user in URL address bar and original page URL. If both matches then its not a fake page else its a malware page. 

So friends today i will teach you how to make your fake pages open whenever victim opens Facebook in his/her web browser. Ahhh... You will be now thinking its impossible. But as i have told you i have written a white paper on Advanced Phishing techniques. So its 110% possible to load fake web page whenever user opens www.facebook.com or any other website like Yahoo, Hotmail or anything... Below are the steps and video for the same.

I had made the video as well as written the steps in detail which will tell you everything step by step.

Steps to Hack Facebook account or Password:

1. Download the Latest Facebook Phisher.

2. Extract the files, you will get below 4 files:

• index.php
• facebook1.php
• passwords.html
• thanks.php

3. Now go to any free web hosting web server to upload these fake pages. 

Note all should be uploaded at root means not in any folder. Just at first level directory.

4. Now you need to find the correct IP address of the account you have created on web hosting server.

5. When you get you fake page's IP address, now what we need to do is that we have to add the entry of the IP address against the www.facebook.com in victim's host file located at below location.

C:\Windows\System32\drivers\etc

6. There are several ways of doing that, i have written my own php scripts for doing the same but i cannot share that with you guys because there are chances of misusing it. So i explain you the logic and rest you need to figure out how you will edit victims host file and append your Fake Page IP address against www.facebook.com.

7. Now after doing steps 5 and 6, whenever user open the www.facebook.com, your fake Facebook page will open and victim will never be able to visit the original Facebook, so he cannot even been able to change his password...:P

8. I have added an extra logic to my scripts, whenever victim enter the password and hit enter button, i am removing the entry of Fake IP address against www.facebook.com from the host file by making it spaces. So it will be for him for one time only which sounds more spoofed. Its just a single line code but i cannot tell you guys because it will make this article completely unethical. 

I will teach you techniques but i will not do spoon feeding because if you want to become good hacker then you need to use your brain too. I love to be called Destructive but i do constructive works..:P like this one...rofl...

9. Everything other than this is similar to normal phishing technique..

I hope you all like it... If not here is the video of the complete hack in detail with each and every step shown practically. 

Note: In video i am using my localhost as web server which in your case will be uraccountname.my3gb.com or other means where you uploaded your files.

Also you must know 127.0.0.1 is localhost IP address. For you case your webhosting will be the IP address that will be used to map against facebook.

post by rishabh sharma hackersunderground

Read more »

WIRELESS HACKING...

Hello Friends, today i will explain you how to crack Wifi or wireless password in just 10 to 15 minutes.  So guys read on and watch ....

STEPS TO HACK WIFI OR WIRELESS PASSWORD

1. Get the Backtrack-Linux CD. Backtrack Linux Live CD(best Linux available for hackers with more than 2000 hacking tools inbuilt).

Download Backtrack Linux Live CD from here: CLICK HERE

or  CLICK HERE

2.  SCAN TO GET THE VICTIM

Get the victim to attack that is whose password you want to hack or crack.

Now Enter the Backtrack Linux CD into your CD drive and start it. Once its started click on the black box in the lower left corner to load up a "KONSOLE" . Now you should start your Wifi card. To do it so type 

airmon-ng

You will see the name of your wireless card. (mine is named "ath0") From here on out, replace "ath0" with the name of your card. Now type

airmon-ng stop ath0

then type:

ifconfig wifi0 down

then type:

macchanger --mac 00:11:22:33:44:55 wifi0

then type:

airmon-ng start wifi0

The above steps i have explained is to spoof yourself from being traced. In above step we are spoofing our MAC address, this will keep us undiscovered.

Now type:

airodump-ng ath0

All above steps in one screen shot:

Now you will see a list of wireless networks in the Konsole. Some will have a better signal than others and its always a good idea to pick one that has a best signal strength otherwise it will take huge time to crack or hack the password or you may not be able to crack it at all.

Once you see the networks list, now select the network you want to hack. To freeze the airodump screen HOLD the CNTRL key and Press C.
Now you will see something like this:

3.  SELECTING NETWORK FOR HACKING 

Now find the network that you want to crack and MAKE SURE that it says the encryption for that network is WEP. If it says WPA or any variation of WPA then move on...you can still crack WPA with backtrack and some other tools but it is a whole other ball game and you need to master WEP first.

Once you've decided on a network, take note of its channel number and bssid. The bssid will look something like this --

00:23:69:bb:2d:of

The Channel number will be under a heading that says "CH".

As shown in this figure:

Now in the same KONSOLE window type:

airodump-ng -c (channel) -w (file name) --bssid (bssid) ath0

The file name can be whatever you want. This file is the place where airodump is going to store the packets of info that you receive to later crack. You don't even put in an extension...just pick a random word that you will remember. I usually make mine "Ben" because I can always remember it. Its simply because i love ben10....hhahahahaha :D

Note: If you want to crack more than one network in the same session, you must have different file names for each one or it won't work. I usually name them as ben1, ben2 etc.

Once you typed in that last command, the screen of airodump will change and start to show your computer gathering packets. You will also see a heading marked "IV" with a number underneath it. This stands for "Initialization Vector" but in general terms all this means is "packets of info that contain characters of the password." Once you gain a minimum of 5,000 of these IV's, you can try to crack the password. I've cracked some right at 5,000 and others have taken over 60,000. It just depends on how long and difficult they made the password. More difficult is password more packets you will need to crack it.

4.  Cracking the WEP password

Now leave this Konsole window up and running and open up a 2nd Konsole window.

In this window type:

aireplay-ng -1 0 -a (bssid) -h 00:11:22:33:44:55 ath0

This will send some commands to the router that basically it is to associate your computer even though you are not officially connected with the password. If this command is successful, you should see about 4 lines of text print out with the last one saying something similar to "Association Successful :-)" 

If this happens, then good! You are almost there.

Now type:

aireplay-ng -3 -b (bssid) -h 00:11:22:33:44:55 ath0

This will generate a bunch of text and then you will see a line where your computer is gathering a bunch of packets and waiting on ARP and ACK. Don't worry about what these mean...just know that these are your meal tickets. Now you just sit and wait. Once your computer finally gathers an ARP request, it will send it back to the router and begin to generate hundreds of ARP and ACK per second. Sometimes this starts to happen within seconds...sometimes you have to wait up to a few minutes. Just be patient. When it finally does happen, switch back to your first Konsole window and you should see the number underneath the IV starting to rise rapidly. This is great! It means you are almost finished! When this number reaches AT LEAST 5,000 then you can start your password crack. It will probably take more than this but I always start my password cracking at 5,000 just in case they have a really weak password.

Now you need to open up a 3rd and final Konsole window. This will be where we actually crack the password. 

Now type:

aircrack-ng -b (bssid) (filename)-01.cap

Remember the file name you made up earlier? Mine was "Ben". Don't put a space in between it and -01.cap here. Type it as you see it. So for me, I would type wepkey-01.cap
Once you have done this you will see aircrack fire up and begin to crack the password. typically you have to wait for more like 10,000 to 20,000 IV's before it will crack. If this is the case, aircrack will test what you've got so far and then it will say something like "not enough IV's. Retry at 10,000." 

DON'T DO ANYTHING! It will stay running...it is just letting you know that it is on pause until more IV's are gathered. Once you pass the 10,000 mark it will automatically fire up again and try to crack it. If this fails it will say "not enough IV's. Retry at 15,000." and so on until it finally gets it.

If you do everything correctly up to this point, before too long you will have the password! now if the password looks goofy, dont worry, it will still work. some passwords are saved in ASCII format, in which case, aircrack will show you exactly what characters they typed in for their password. Sometimes, though, the password is saved in HEX format in which case the computer will show you the HEX encryption of the password. It doesn't matter either way, because you can type in either one and it will connect you to the network.

Take note, though, that the password will always be displayed in aircrack with a colon after every 2 characters. So for instance if the password was "secret", it would be displayed as:

se:cr:et

This would obviously be the ASCII format. If it was a HEX encrypted password that was something like "0FKW9427VF" then it would still display as:

0F:KW:94:27:VF

Just omit the colons from the password, boot back into whatever operating system you use, try to connect to the network and type in the password without the colons and presto! You are in!

It may seem like a lot to deal with if you have never done it, but after a few successful attempts, you will get very quick with it. If I am near a WEP encrypted router with a good signal, I can often crack the password in just a couple of minutes.

I am not responsible for what you do with this information. Any malicious/illegal activity that you do, falls completely on you because...technically...this is just for you to test the security of your own network.

post by rishabh sharma hackersunderground

Read more »