11:38 PM Best Way to Sniff HTTP and HTTPS Websites | |
 Its not tough to Hijack / Capture / Sniff
Wifi Traffic on almost any network as long as you are connected to it.
Once you apply all the correct tricks, all future traffic for Wifi
clients i.e. laptops, mobiles will be routed from your PC, giving you
every bit of information about what others are doing on the network. How to Hijack/Capture/ Sniff HTTP traffic We will be using ARP and iptables on a Linux machine to accomplish most of the stuff. It’s an easy and fun way to harass your friends, family, or flatmates while exploring the networking protocols. Warning:- Do not attempt to do this on a Public Wifi or a Corporate Wifi. Doing so could lead you to serious consequences. In no way is Taranfx or Hack Community responsible for any harms. This is solely intended for fun @ home. Lets take 3 PCs into reference for our activity: * Real gateway router: IP address 192.168.0.1, MAC address 48:5d:34:aa:c6:aa * Fake gateway: A Laptop PC called hacker-laptop, IP address 192.168.0.200, MAC address c0:30:2b:47:ef2:74 * Victim: a laptop on wireless called victim-laptop, IP address 192.168.0.111, MAC address 00:23:6c:8f:3f:95 The gateway router, like most modern routers, is bridging between the wireless and wired domains, so ARP packets get broadcast to both domains. Step 1: Enable IPv4 forwarding Unless IP forwarding is enabled, hacker-laptop won’t receive all the network traffic because the networking subsystem is going to ignore packets that aren’t destined for us. So step 1 is to enable IP forwarding. To enable it, set a non zero value like: Code: root@hacker-laptop:~# echo 1 > /proc/sys/net/ipv4/ip_forward Step 2: Set routing rules We want to set rules so that all traffic routes through hacker-laptop, acting like a NAT router. Just like a typical NAT, it would rewrite the destination address in the IP packet headers to be its own IP address. This can be done as follows: Code: doxhacker@hacker-laptop:~$ sudo iptables -t nat -A PREROUTING \ > -p tcp –dport 80 -j NETMAP –to 192.168.0.200 The iptables command has 3 components: * When to apply a rule (-A PREROUTING) * What packets get that rule (-p tcp –dport 80) * The actual rule (-t nat … -j NETMAP –to 192.168.0.200) What above command does: If you’re a TCP packet destined for port 80 (HTTP traffic), actually make my address, 192.168.0.200, the destination, NATting both ways so this is transparent to the source.” Step 3: Adding IP address to interface The networking subsystem will not allow you to ARP for a random IP address on an interface — it has to be an IP address actually assigned to that interface: Code: doxhacker@hacker-laptop:~$ sudo ip addr add 192.168.0.1/24 dev eth0 and verify that the original IP address 192.168.0.200, and the gateway address 192.168.0.1. Code: doxhacker@hacker-laptop:~$ ip addr … 3: eth0: mtu 1500 qdisc noqueue state UNKNOWN link/ether c0:30:2b:47:ef2:74 brd ff:ff:ff:ff:ff:ff inet 192.168.0.200/24 brd 192.168.1.255 scope global eth0 inet 192.168.0.1/24 scope global secondary eth0 inet6 fe80::230:1bff:fe47:f274/64 scope link valid_lft forever preferred_lft forever … Step 4: Responding to HTTP requests hacker-laptop would need a HTTP server setup. It could be any damn server, I used Apache for ease of use. Here you can get creative, e.g. respond with random pages for specific URLs or define a local URL e.g. http://www.hackme.com Step 5: Test pretending to be the gateway Most of the things are already done and our hacker-laptop is ready to pretend as the Wifi Gateway, but the trouble is convincing victim-laptop that the MAC address for the gateway has changed, to that of hacker-laptop. The solution is to send a Gratuitous ARP, which says "I know nobody asked, but I have the MAC address for 192.168.0.1”. Machines that hear that Gratuitous ARP will replace an existing mapping from 192.168.0.1 to a MAC address in their ARP caches with the mapping advertised in that Gratuitous ARP. There are lots of command line utilities and bindings in various programming language that make it easy to issue ARP packets. I used the arping tool: Code: doxhacker@hacker-laptop:~$ sudo arping -c 3 -A -I eth0 192.168.0.1 We’ll send a Gratuitous ARP reply (-A), three times (-c -3), on the eth0 interface (-l eth0) for IP address 192.168.0.1. This can be then verified on the victim’s machine using "arp -a” command Bingo! victim-laptop now thinks the MAC address for IP address 192.169.1.1 is 0:30:1b:47:f2:74, which is hacker-laptop’s address.If I try to browse the web on victim-laptop, I am served the resource matching the rules in hacker-laptop’s web server. That means all of the non-HTTP traffic associated with viewing a web page still happens as normal. In particular, when hacker-laptop gets the DNS resolution requests for Google.com, the test site I visited, it will follow its routing rules and forward them to the real router, which will send them out to the Internet: The fact is that hacker-laptop has rerouted and served the request is totally transparent to the client at the IP layer and victim-laptop has no clue. Undo the changes So, you had enough fun and wish to revert? Here we go: Code: doxhacker@hacker-laptop:~$ sudo ip addr delete 192.168.0.1/24 dev eth0 doxhacker@hacker-laptop:~$ sudo iptables -t nat -D PREROUTING -p tcp –dport 80 -j NETMAP –to 192.168.0.200 To get the client machines to believe the router is the real gateway, you might have to clear the gateway entry from the ARP cache with arp -d 192.168.0.1, or bring your interfaces down and back up. Hacking HTTPS Websites If you want to sniff websites having https environment then you should try SSL Strip it helps you to sniff https sites. Like Gmail Yahoo And Facebook. Setup
Running sslstrip
That should do it. For downloading SSL Strip and learning how to implement it with above tutorial Click here | |
|
| |
PlayStation Accounts Hacked, PSN Database Allegedly Stolen The official Twitter and Facebook PlayStation accounts were compromised late Sunday by hacking group OurMine, with the attackers claiming they had managed to get access to a PSN database. While no leaks have happened since the breach was announced, OurMine hackers claim they won’t be releasing any details online, meaning that users should be fine unless the attackers change their mind. For the time being, however, a password reset could be a good idea to remain secure. OurMine hackers posted several messages on the official Twitter and Facebook PlayStation accounts, all of which have already been deleted, presumably after Sony regained access to the compromised accounts. One of the tweets, which is no longer available right now, confirmed there are no plans to leak PSN details. “No, we aren’t going to share it, we are a security group. If you work at PlayStation, then please go to our website,” the group tweeted from the official PlayStation account, calling for S... |
Ariana Grande’s Instagram Account Hacked Ariana Grande is the latest celebrity that gets hacked, though this time no nude photos are involved and the attack is not part of the Fappening saga that impacted so many singers and actresses in the US and worldwide. This time, hackers managed to take control of Ariana Grande’s Instagram account, and the attackers started posting racist and homophobic messages, while also threatening other American stars to breach their accounts. While no hacking group or individual claimed the attack, the Instagram account is believed to have been breached by a fan of Selena Gomez and Kylie Jenner, as reported by clevver. The main evidence pointing in this regard is some of the messages posted by the hacker, who called for Ariana Grande fans to follow two different accounts whose profile picture showing the two stars. Of course, this is just a guess, and at this point there is no confirmation that the attacker... |
Virgin America Hacked, Employee Passwords and Personal Information Compromised Virgin America has confirmed in a letter sent to employees that its network was compromised by hackers, with data belonging to thousands of workers compromised and possibly stolen by the attackers. While an investigation is already under way, the airline did not provide any specifics about the hackers, saying instead that it’s working with law enforcement on determining how the breach took place. “On March 13, 2017, during security monitoring activities, our data secure team identified potential unauthorized access to certain Virgin America computer systems. We immediately took steps to respond to the incident, including initiating our incident response protocol and taking measures to mitigate the impact to affected individuals,” the company explained in the letter. “We retained cybersecurity forensic experts to investigate the incident and reported the mat... |
UniCredit Bank Hacked, 400,000 Accounts Exposed UniCredit has just announced in an official statement that its servers were breached by hackers, with details of approximately 400,000 clients said to be exposed. The bank explained that hackers managed to get inside its systems in Italy twice in the last 12 months. The first hack took place in September and October 2016, while the second attack happened in June and July this year, with the latter discovered by the company’s security department, triggering an in-depth investigation. UniCredit says the breach was possible through a third-party working with customer data related to personal loans, so hackers were likely capable of accessing information like name, addresses, and IBAN numbers. Passwords were not compromised, and no unauthorized transactions were detected. “UniCredit has launched an audit and has informed all the relevant authorities. In the morning, UniCredit will also file a claim with the Milan Prosecutor's office. The bank has also taken immediate ... |
Hackers Breach Casino After Compromising a Smart Fish Tank A casino in the United States was compromised after hackers managed to infiltrate into its network and steal undisclosed data after first breaking into a smart fish tank connected to the Internet. In case you wondering why a fish tank needs to be connected to the Internet, it’s because the casino wanted to do everything remotely, with employees using a remote connection to feed the fish and get all the information instantly, such as water temperature. But it was this connection that exposed the fish tank, and eventually, the entire casino, to hackers, as an unnamed group of attackers managed to infiltrate into the network and upload data on a server in Finland. The breach was eventually discovered, and the flaw was fixed, but there still are a few questions that need to be answered before connecting smart devices to the Internet. Name of the compromised casino not disclosed First and foremost, is it safe for a smart fish tank to be left unprotect... |
Hackers Attack Trump Hotels, Steal Credit Card Details and Personal Data Hackers breached the systems used by 14 different Trump Hotels properties between August 10, 2016 and March 9, 2017, managing to steal sensitive information like guests’ credit card details and other personal information. In a 9-page notification published on the official page, Trump Hotels informs customers that hackers managed to breach the systems of Sabre Hospitality Solutions (Sabre) and not its own systems, though it confirms that personal information has been exposed. “Following an investigation, Sabre notified us on June 5, 2017 that an unauthorized party gained access to account credentials that permitted access to payment card data and certain reservation information for some of our hotel reservations processed through Sabre’s CRS,” the company explained. Credit card and personal information possibly stolen C... |
Google Employee Data Exposed After Hackers Break into Travel Agency Software - UPDATE UPDATE: CWT has provided us a statement to emphasize that the company isn't using the SHS software. Original story follows after the statement. "CWT was informed by Sabre that some traveler data had been viewed by an outside party due to a breach of Sabre’s Hospitality Solutions / SynXis Central Reservation system (“SHS”), which provides reservations technology and support to hotels. SHS is not a CWT technology platform or a solution used by CWT. CWT has proactively notified potentially impacted customers and encouraged them to visit the Sabre microsite (which includes call center details)." ORIGINAL STORY: The travel agency in charge of hotel bookings for Google’s employees has suffered a breach, with details such as names, contact details, and credit card information possibly exposed. Google has already issued a warning to the State of California and sent a letter to affected employees, explaining that Social Security numbers, passport, and driver’s license inf... |
Internet Radio Service 8tracks Hacked, 18 Million Accounts Stolen Internet radio service 8tracks was hacked earlier this week, and attackers managed to extract no less than 18 million accounts, including usernames, hashed passwords, and email addresses. In a message posted on the company’s blog, 8tracks confirms the hack, and says that it all started from an employee’s Github account that was not using two-factor authentication. IT admins became aware of the hack once the attackers attempted to change the password of the Github account, they say, and after data was examined by several sources, including LeakBase. 8tracks explains that only users who signed up with email are affected by the hack, while everyone else, including those who are using Google and Facebook accounts to log in, is completely secure. No sensitive customer data compromised Furthermore, the passwords are hashed and salted, so hacker... |
US Government Websites Hacked with Pro-ISIS, Anti-Donald Trump Messages A large number of websites belonging to the United States government have been hacked during the weekend, with evidence of new hacks also published on late Monday and early Tuesday. Websites in Ohio and Maryland were taken down after hacking group Team System DZ compromised the index page with pro-ISIS and anti-Donald Trump messages. The websites of Ohio Gov. John Kasich and Howard County, Maryland, were the first two that got compromised on Sunday, but further attacks also targeted the Ohio Department of Rehabilitation and Corrections, the Ohio Governor, the Ohio First Lady, the Office of Workforce Transformation, Office of Health Transformation and Medicaid. Additionally, Team System DZ also targeted the Washington State Department of Health website, as well as a number of pages belonging to international organizations. FBI already investigating The defaced websites included a black wallpaper and an Arabic sym... |
UK Parliament Attacked by Hackers, External Access to Email Blocked The UK Parliament was the target of what’s being described as a “sustained and determined” cyber-attack launched during the weekend, with local officials confirming that external access to email has been blocked as a security measure. The Parliament has already contacted all members to warn of the security risks following the cyber-attack, and explained that an investigation is under way. “Earlier this morning we discovered unusual activity and evidence of an attempted cyberattack on our computer network,” the mail warning reads according to The Guardian. “Closer investigation by our team confirmed that hackers were carrying out a sustained and determined attack on all parliamentary user accounts. We have been working closely with the National Cyber Security Centre to identify the method of the attack and have made changes to prevent the attackers gaining access.” ... |