+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: WAYS TO GET A PASSWORD (/showthread.php?tid=5682465)
WAYS TO GET A PASSWORD - coocochi - Jul 30, 2017
I will like to know, asides, phishing and RATTING, what other ways are available to get someones password remotely?. Thats is with the email available.
* - THC - Jul 31, 2017
Try searching through leaked databases to find a password hash matching the email. Sites such as leakbase offer such services.
* - Boolean type - Jul 31, 2017
Social engineering. If your target is dumb enough you can get what you want very easly ;)
* - Bouzazi - Jul 31, 2017
Social engineering. That's how I'd do it if I had his email. Be sure your mail doesn't go to SPAM Box.
People often represent the weakest link in the security chain.. -- Bruce Schneier.
* - coocochi - Aug 1, 2017
(Jul 31, 2017 12:58 AM)M.D. Wrote: Try searching through leaked databases to find a password hash matching the email. Sites such as leakbase offer such services.Thanks, but i have searched and that didn't quite work.
(Jul 31, 2017 04:58 AM)stdbool.h_____ Wrote: Social engineering. If your target is dumb enough you can get what you want very easly ;)I think this also involves phishing of some sort, innit?
* - GhostKarate - Aug 1, 2017
You could look into stealing password hashes from a target and then crack them offline. Like the windows SAM file or Linux Shadow file. Or you could steal some cookies and use them to access web accounts.
* - Zork - Aug 1, 2017
Another cool idea would be to SSL-Strip traffic and try to get some cleartext passwords. Although this might not always work as SSL is forced nowadays on most sites.
* - coocochi - Aug 2, 2017
(Aug 1, 2017 08:42 AM)GhostKarate Wrote: You could look into stealing password hashes from a target and then crack them offline. Like the windows SAM file or Linux Shadow file. Or you could steal some cookies and use them to access web accounts.This sound really interesting, but stealing the cookies, i guess the only way to do that is by RAT or Logger. Please correct me if i am wrong
(Aug 1, 2017 11:25 AM)Zork Wrote: Another cool idea would be to SSL-Strip traffic and try to get some cleartext passwords. Although this might not always work as SSL is forced nowadays on most sites.I am not sure, I know anything about this.
* - GhostKarate - Aug 2, 2017
Quote:This sound really interesting, but stealing the cookies, i guess the only way to do that is by RAT or Logger. Please correct me if i am wrong
Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.
I cant post links but youtube Lesson 48 : Backdoor Gaining Access
Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.
* - Marsuves - Aug 2, 2017
(Aug 2, 2017 11:21 AM)GhostKarate Wrote: Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.
I cant post links but youtube Lesson 48 : Backdoor Gaining Access
Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.
This is the best advice i have seen so far on the topic; there are many ways to do what you are trying to do but using these tools is much better than just running a RAT/logger.
A fun way to do this would be to get the targets physical address, mail them a malduino with a script to download and run a metasploit script
* - DaRealDeal - Aug 3, 2017
(Aug 2, 2017 11:21 AM)GhostKarate Wrote: Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.
I cant post links but youtube Lesson 48 : Backdoor Gaining Access
Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.
This is some great info. I Appreciate it!
* - coocochi - Aug 4, 2017
(Aug 2, 2017 11:21 AM)GhostKarate Wrote: Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.Wow, really appreciate the info, and I got the videos. They are really something. Thanks once again.
I cant post links but youtube Lesson 48 : Backdoor Gaining Access
Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.
* - PromᎥnent - Aug 4, 2017
Social engineering or dictionary attack?
* - coocochi - Aug 7, 2017
(Aug 4, 2017 09:57 AM)PromᎥnent Wrote: Social engineering or dictionary attack?I dont think Dictionary attack still works, with captcha and all this verifications when several attempts has been made on an account.
* - Delphinus - Aug 7, 2017
Minor nitpick, but Meterpreter is a RAT, just a text-based one.
It's also one of the best. Learn it. Password dumps are pretty much the first thing you learn with it.