+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+----- Forum: Hacking Tutorials (https://hackforums.net/forumdisplay.php?fid=47)
+----- Thread: Leaks - Introduction how to use leaks to hack accounts (/showthread.php?tid=5481243)
Leaks - Introduction how to use leaks to hack accounts - prilux - Dec 1, 2016
In this thread i will teach how to use Leaked databases to access common services.
The databases in question are:
SPAM breach in March 2015
Gmail/Yandex/Mail.ru breach in September 2014
The software to use:
Email Recon 1.4
Both databases and the software cost $25 payable by paypal or btc.
Let's start with an example then i will publish one live hacked account as proof.
===================================
1) First i will start to verify if the email is leaked in the databases i have posted above. For that i use the site https://haveibeenpwned.com which already comes in Email Recon 1.4. If the email is associated to one of the two databases that means that the password is visible in plain text.
2) Download the database using "Email Password Databases" available in Email Recon 1.4 and open with EmEditor Txt Editor. Search for the email and the password should be there.
3) Copy the email and password to a text file and launch Email Recon 1.4. Now navigate between the services available and check if the email is associated with that service. If the email is associate with the service just try to break in using the password you have found.
=================================
Live Example: (Found by me)
=================================
The email for this live example is [email protected]
1) By using https://haveibeenpwned.com i know that this email was leaked in SPAM breach in March 2015. So i open the database and retrieve the password which is "uopl12".
2) Using Email Recon 1.4 i know which services are registered with this email.
Has Twitter? Yes
Has LinkedIn? Yes
Has Instagram? Yes
Has Paypal? Yes
Has Wordpress.com? Yes
Has Steam? Yes
Has 4shared? Yes
Has Dropbox? Yes
Has Mega.nz? Yes
3) Now we try to login in those services using the email and password. In almost all the services the password didn't match :(
Except Mega.nz. That's right Mega.nz account uses the same password. Yes i just gain access to a Mega.nz File hosting account
4) Repeat this 3 steps with diferent emails...
* - memory - Dec 1, 2016
So basically just using the victims previously dumped old passwords on common services they might be logging into?
* - CichyCichoCiemny - Dec 2, 2016
You should mention that the databases are at least 14GB each.
🤝
* - prilux - Dec 3, 2016
Let's public some facts
SPAM breach in March 2015
331 MB
Gmail/Yandex/Mail.ru breach in September 2014
137.82 MB
* - TanyaGr - Dec 4, 2016
This does not work for facebook hacking, right?
* - prilux - Dec 8, 2016
Of course not, it doesn't work with facebook. The databases are old (March 2015/September 2014)
RE: Leaks - Introduction how to use leaks to hack accounts - ProfessorGeng - Aug 16, 2024
Thank you for writing this post , I will try