+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: [TUT] Stole Cookies and passwords from your victims RAT tools [TUT] [UPDATED] (/showthread.php?tid=1734554)
Pages: Pages
1
2
[TUT] Stole Cookies and passwords from your victims RAT tools [TUT] [UPDATED] - Nopounet - Sep 17, 2011
Hi,
So for my first attempt to make a tutorial, its gonna be about stealing cookies on your targets.
Works with:
All rats wit "files explorer" features, meaning all of em i guess.
Spoiler (Click to View)
Im gonna cover Google chrome for this one, should be the same with other browser, but my victims dont use the other browser.. If i find a victim with another browser, I'll update this tuts anyway.
Lets say you want to gather the cookies from a victim and use it on your PC to check on different sites (facebook, twitter, etc...)
First of all, you've got to check the cookies directory on your remote victim. Let's browse this little fucker.
C:\Users\VICTIM\AppData\Local\Google\Chrome\User Data\Default
Spoiler (Click to View)
![[Image: 5a2b6bb0a8d0bf2c1e1982e79eb4528a.png]](https://gyazo.com/5a2b6bb0a8d0bf2c1e1982e79eb4528a.png)
"Cookies" - So you have the cookie, now simple c/c this file and use it on your own PC and the funny thing about it, at least on facebook, you can see the target tipping live with his friend ;)
A good thing about it, you can delete the remote "cookies" file of ur victim and close his browser, and live log his login/passwd infos of your victim.)
After all i'm gonna do the firefox part aswell. I got some times and i manage to find out all that shit ;)
Same as gchrome, go to the folder location : C:\Users\VICTIM\AppData\Roaming\Mozilla\Firefox\Profiles\XXXX.default -
Spoiler (Click to View)
![[Image: 7c0fc3619e16cb511cd4b1623b6ab0a4.png]](https://gyazo.com/7c0fc3619e16cb511cd4b1623b6ab0a4.png)
There you gonna see a bunch of files, leech cookies.sqlite (SQLite is a library write in C that offer embedded relational database management system, previous version of Firefox cookies file where in txt) - Copy this little bastard on your profiles location and voilà, you can play with all of the victims webmail/social shit accounts.
NB: If you want play with the cookies, there is a little addon called SQLiteManager available here: https://addons.mozilla.org/fr/firefox/addon/sqlite-manager/
As requested, here is a little preview of the addon:
Spoiler (Click to View)
![[Image: 6d8d266007e3da85a506613b37de7811.png]](https://gyazo.com/6d8d266007e3da85a506613b37de7811.png)
Thats conclude this little tutorial about stealing cookies and play with em.
UPDATE:
So, i look into some other files in the firefox profiles directory
and some of em looks interesting, these 3:
Spoiler (Click to View)
![[Image: 85f39a395327967fda1a2fce0f76cb93.png]](https://gyazo.com/85f39a395327967fda1a2fce0f76cb93.png)
These files probably contain the crypted password, the key to decrypt 'em and other logins and URL infos.
Backup yours files and copy these down on the profiles directory. Now you can do 2 things. Export the list with the addon available here https://addons.mozilla.org/fr/firefox/addon/password-exporter
Or simple read the password by going to tools > password > security tab > view registered password and BAM.
There you go, now we can do whatever we want :)
A wonderful thing should be that the programmer of the R.A.T we are using already have that abilities to read the password/cookies - But heh who knows, maybe someday.
Best regards,
Nopounet -
* - I am THC - Sep 17, 2011
Thanks for the tutorial, this looks pretty good for your first.
Great to see other people contributing to HF, I will be sure to test this out later.
edit: maybe show a picture of you opening the .SQLITE file and the list of passwords (just for example)
* - NPPS - Sep 17, 2011
that 's a very good tut! Never seen before.
Big vouch Dude
* - CRT - Sep 17, 2011
Great tutorial man. Not seen one like this before. 😝
* - badlyfar - Sep 17, 2011
Nice, although the pictures are not working :P
* - I am THC - Sep 17, 2011
Pictures are working fine.
I just followed this tutorial. I got the .SQLITE file but i am unsure what to open it with?
* - Lonely - Sep 17, 2011
Thanks for the TuT!:D this is a great way to start your life on HF! remain HQ :)
* - Nopounet - Sep 17, 2011
(Sep 17, 2011 04:46 PM)Demigodii Wrote: Pictures are working fine.
I just followed this tutorial. I got the .SQLITE file but i am unsure what to open it with?
You have to copy it down on your local firefox profiles folder, careful though, backup your cookies files before doing it.
SQLiteManager addon is here for those who want to play with cookies, extend expiration, etc..
* - I am THC - Sep 17, 2011
Thanks alot mate.
Worked like a charm.
* - Nopounet - Sep 18, 2011
(Sep 17, 2011 04:54 PM)Demigodii Wrote: Thanks alot mate.
Worked like a charm.
Sweet, as mentioned up here, i just found something good, specially the saved password, but i open the file and its crypted, i'll look into it and i'll update this tut ASAP.
* - Vexna - Sep 18, 2011
Should be posted in this following forum, Hacking Tutorials
* - Nopounet - Sep 18, 2011
Yep indeed, if an admin can move it to the proper section, it will be great, thanks.
* - Slash - Sep 18, 2011
Nice job on the tutorial. Hope to see more on this.
* - Vexna - Sep 18, 2011
(Sep 18, 2011 04:37 AM)Nopounet Wrote: Yep indeed, if an admin can move it to the proper section, it will be great, thanks.
Great to see someone who is agree with me.
* - bernardbear - Sep 18, 2011
i will wait for your update dude :)
how to work using sqlite manager addons and use that cookie until we log into account.telll me