+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: The Detailed Guide on Formgrabbers (/showthread.php?tid=2559161)
The Detailed Guide on Formgrabbers - pr0t0typ3 - Jun 5, 2012
What is Form Grabbing ?
Form grabbing is an advanced method of capturing web form data within various browsers. Often confused with traditional keylogging (recording individual keystrokes), this method intercepts the API in browsers that is used to transmit information and collects web form data before it is passed over to the internet. (Source: Wikipedia.org)
How does Form Grabbing work ?
A Formgrabber does replace the function that is used to send information to the internet with its own function. Every time the browser does submit information to the internet, the replacement function is called first and the intruder is able to access the web forms the browser does send to the internet before they are actually sent. The intruder is also able to modify these forms or prevent them from being sent.
View detailed diagram:
Spoiler (Click to View)
![[Image: 08uk0.png]](https://i.imgur.com/08uk0.png)
What are webforms ?
A webform on a web page allows a user to enter data that is sent to a server for processing. Webforms resemble paper or database forms because internet users fill out the forms using checkboxes, radio buttons, or text fields. For example, webforms can be used to enter shipping or credit card data to order a product or can be used to retrieve data (e.g., searching on a search engine or logging into a website). (Source: Wikipedia.org)
View example:
Spoiler (Click to View)
Why are Formgrabbers superior to traditional forms of password stealing malware ?
While Password Stealers only recover credentials saved in the browser and Keyloggers do require the user to type in the credentials, Formgrabbers just require the information/credentials you want to access to be used/sent. No matter if the credentials are typed into the browser (with a physical or virtual keyboard), they are saved in the browser and used to login at a later point or they are copied into the login fields, the grabbing process of a Formgrabber is always successful, while neither a Stealer nor a Keylogger would be able to perform a successful recovery in every case mentioned above.
If Formgrabbers are that good, why can't I find any good cheap one ?
If we look back to the year 2007 when the Crimeware-Pack Zeus was released, and the first "famous" Formgrabber hit the market, you had to invest between 700 $ and 15.000 $ (for the full package with all features as there was no standalone formgrabber). You might ask yourself, why there are not tons of good Formgrabbers which are much cheaper if they are really superior to all traditional forms of malware (used for credential stealing) and the answer is pretty easy: They are a lot harder to do than Stealers or Keyloggers. The programmer needs knowledge about the process architecture of Windows, the art of hooking functions (which often have to be found in memory first using special algorithms), a native language like C/C++, Delphi (in exceptional cases) or ASM, reverse engenieering to find out about the behavior of the browser as well as a lot of time and money to invest into a talented web developer to create a powerful web-panel where the logs that have been "grabbed" are sent to. This means that high prices are more than justified, they are needed to preserve the right of ownership for such a powerful and dangerous tool to people who are serious about what they do.
Where can I get Formgrabbers and what do I need to pay attention to ?
In many "underground" forums you can find formgrabbers as plugins or additional modules for HTTP Bots, while standalone Formgrabbers are rare to find. You need to pay attention to a fair price, an unique functionality and a good web-panel (this is a very important point). You might ask yourself what unique means in this context. Over the last months some Formgrabber sources for various Browsers (Internet Explorer and Firefox) became public and have been heavily copied and published, while most people were unable to create proper Formgrabbing methods (Methods that are able to grab HTTP as well as HTTPS traffic) for Google Chrome, Opera and Safari. Also pay attention that the Formgrabber does support the grabbing of SSL encrypted traffic (used by HTTPS connections for many login sites).
* - Ebolа - Jun 5, 2012
Just skimmed through it, but it looks amazing. Thanks for the guide! I will read it in full when I get home. (:
* - Orgy₂ - Jun 5, 2012
This should stop quite some confusion between stealers, keyloggers & formgrabbers.
Good job bruv.
* - MineSQL - Jun 5, 2012
To bad more people arnt HQ like you. :( it saddens me that no one replied.
* - pr0t0typ3 - Jun 7, 2012
(Jun 5, 2012 03:34 PM)Editzzzz | Elite.Exe Wrote: To bad more people arnt HQ like you. :( it saddens me that no one replied.To be honest, it also saddens me :(
I spent around 45 minutes writing this and doing the diagram and people don't even care enough to reply.
* - Blizzard - Jun 7, 2012
Great tutorial, I liked the diagram and it is very well explained. Thanks.
* - CarrotMilk - Jun 7, 2012
Good stuff pr0t0! Should clear up a lot for some people :).
* - KillαMuvz - Jun 8, 2012
Now this is good stuff. The concept itself is very easy to understand now the implementation and making it work only good coders manage to do it. Congratulations.
* - Support™ - Jun 10, 2012
I read the whole post carefully and I must agree that this is a very well formed and truly a "detailed" guide.
Thank you pr0t0.
* - Dynasty@HF - Jun 10, 2012
learnt alot from reading this thanks for the guide. 🤗
* - Oxy - Jun 10, 2012
Good thread and nice work on the grabber.
well might do some work on that in the future but i'm not that advanced at coding yet.
First finish all the projects i'm doing right now ^^.
verry interesting what it does whit the forms. might get some more tools added to malware like that :)
* - LulzAge - Jun 10, 2012
Thank you for such a detailed and HQ guide pr0t0. :)
I liked how you explained formgrabbing with that diagram. <3
* - pr0t0typ3 - Jun 10, 2012
Thank you for the good Feedback :) I hope it helped you
* - The Unknown - Jul 3, 2012
Thanks for sharing this pr0t0, appreciated.
* - Eeluminati - Jul 23, 2012
(Jun 7, 2012 04:40 AM)pr0t0typ3 Wrote: To be honest, it also saddens me :(
I spent around 45 minutes writing this and doing the diagram and people don't even care enough to reply.
I read that and it urged me to reply. It's a nice read, I just want to know where to find these 'underground' forums/websites. c: