[coocochi]

I will like to know, asides, phishing and RATTING, what other ways are available to get someones password remotely?. Thats is with the email available.

[THC]

Try searching through leaked databases to find a password hash matching the email. Sites such as leakbase offer such services.

[Boolean type]

Social engineering. If your target is dumb enough you can get what you want very easly ;)

[Bouzazi]

Social engineering. That's how I'd do it if I had his email. Be sure your mail doesn't go to SPAM Box.

People often represent the weakest link in the security chain.. -- Bruce Schneier.

[coocochi]

Try searching through leaked databases to find a password hash matching the email. Sites such as leakbase offer such services.

Thanks, but i have searched and that didn't quite work.

---

Social engineering. If your target is dumb enough you can get what you want very easly ;)

I think this also involves phishing of some sort, innit?

[GhostKarate]

You could look into stealing password hashes from a target and then crack them offline. Like the windows SAM file or Linux Shadow file. Or you could steal some cookies and use them to access web accounts.

[Zork]

Another cool idea would be to SSL-Strip traffic and try to get some cleartext passwords. Although this might not always work as SSL is forced nowadays on most sites.

[coocochi]

You could look into stealing password hashes from a target and then crack them offline. Like the windows SAM file or Linux Shadow file. Or you could steal some cookies and use them to access web accounts.

This sound really interesting, but stealing the cookies, i guess the only way to do that is by RAT or Logger. Please correct me if i am wrong

---

Another cool idea would be to SSL-Strip traffic and try to get some cleartext passwords. Although this might not always work as SSL is forced nowadays on most sites.

I am not sure, I know anything about this.

[GhostKarate]

This sound really interesting, but stealing the cookies, i guess the only way to do that is by RAT or Logger. Please correct me if i am wrong

Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.

I cant post links but youtube Lesson 48 : Backdoor Gaining Access

Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.

[Marsuves]

Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.

I cant post links but youtube Lesson 48 : Backdoor Gaining Access

Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.

This is the best advice i have seen so far on the topic; there are many ways to do what you are trying to do but using these tools is much better than just running a RAT/logger.

A fun way to do this would be to get the targets physical address, mail them a malduino with a script to download and run a metasploit script

[DaRealDeal]

Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.

I cant post links but youtube Lesson 48 : Backdoor Gaining Access

Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.

This is some great info. I Appreciate it!

[coocochi]

Start looking into msfconsole, SEtoolkit and reverse_tcp meterpreter sessions. Like a Rat it creates a back door into someones system. They normally have the functionality built in to just dump say all of the windows/linux password files onto your computer. Or all of the cookie files.

I cant post links but youtube Lesson 48 : Backdoor Gaining Access

Its the first part of 5 videos on the subject so make sure you watch them all. They are only a few minuets long each.

Wow, really appreciate the info, and I got the videos. They are really something. Thanks once again.

[PromᎥnent]

Social engineering or dictionary attack?

[coocochi]

Social engineering or dictionary attack?

I dont think Dictionary attack still works, with captcha and all this verifications when several attempts has been made on an account.

[Delphinus]

Minor nitpick, but Meterpreter is a RAT, just a text-based one.
It's also one of the best. Learn it. Password dumps are pretty much the first thing you learn with it.