DO NOT DEAL WITH THIS MEMBER
May 16, 2017 07:35 PM
(This post was last modified: May 16, 2017 07:36 PM by ๖ۣۜCriminal.)
How it works is it would use a custom luxsocks or vip72 api since I don't think they provide their own and it would continue to login to the account with a location in each of the 50 states till it logs in, this can be later expanded to support all the other countries but can take a few hours to a few days, asyncio can speed it up a lot of course. Suspicious login is what prevents you from logging into things like hotmails and gmails from different locations. Let me know what you guys think.
This is exactly what I was thinking. I like your logic.
(May 16, 2017 07:35 PM)๖ۣۜCriminal Wrote: How it works is it would use a custom luxsocks or vip72 api since I don't think they provide their own and it would continue to login to the account with a location in each of the 50 states till it logs in, this can be later expanded to support all the other countries but can take a few hours to a few days, asyncio can speed it up a lot of course. Suspicious login is what prevents you from logging into things like hotmails and gmails from different locations. Let me know what you guys think.
Clever idea. But after 5ish states the email provider will most likely disable the account. So it would take a really long time, and a user has a higher chance of noticing something is up by then.
DO NOT DEAL WITH THIS MEMBER
(Sep 15, 2017 03:50 PM)r3dpyr4mid Wrote: Clever idea. But after 5ish states the email provider will most likely disable the account. So it would take a really long time, and a user has a higher chance of noticing something is up by then.
Depends on the site, things like twitter for example have a flagging system which means once the suspicious activity is triggered it will stay like that regardless of what IP you log in from at that point you pretty much either have to contact twitter support or receive that verification code to the email on file to get in.
Feel as if this is a lot more work as opposed to doing some recon on the target and just figuring out their state.
Professional writer for hire, PM me.
Sep 15, 2017 11:12 PM
(This post was last modified: Sep 15, 2017 11:13 PM by exploit this.)
you fools! Find your victims location get a vpn or proxy to that location.
all you have to know is their location which shouldn't be hard
I once got locked out of my personal gmail when i tried to log in on my phone, on the same wifi with already logged in pc, used the phone before for this gmail, did sms verification twice and google still locked my account. I doubt socks will work..
Dude, They locked the account after few attempts.
I was in USA when i logged in gmail after that i logged in it from france and Fuckin gmail was saying confirm your identity upload your photo ID :P LOL
this idea is good,
google is more clever :P
Members on HF can make it happen
(Sep 15, 2017 11:02 PM)๖ۣۜCriminal Wrote: Depends on the site, things like twitter for example have a flagging system which means once the suspicious activity is triggered it will stay like that regardless of what IP you log in from at that point you pretty much either have to contact twitter support or receive that verification code to the email on file to get in.
Yea, most of the most widely used sites have something like that. And those usually are also the only ones who care enough to generate specific warnings depending on location changes from the last time you log in. So this technique would be most effective on lesser known sites that generate the suspicious login warning but don't have mechanisms in place that lock up the account and things like that. But that leaves a very tiny subset of web applications, but I think this technique may be able to be used against corporate mail servers. And can be effective in attacks targeting specific companies.
I've seen websites that after a few failed attempts do not accept passwords (Even the correct one) from that IP Anymore.
I sometimes come around and poke a few threads before leaving for a few months again.
This wouldn't work as most sites will need verification after 1 wrong location login. That being said that would also be very expensive to get into an account. Residential IP's are about $0.30 each and last a couple hours. So your paying about $15 per account.
DO NOT DEAL WITH THIS MEMBER
(Sep 16, 2017 10:20 AM)r3dpyr4mid Wrote: Yea, most of the most widely used sites have something like that. And those usually are also the only ones who care enough to generate specific warnings depending on location changes from the last time you log in. So this technique would be most effective on lesser known sites that generate the suspicious login warning but don't have mechanisms in place that lock up the account and things like that. But that leaves a very tiny subset of web applications, but I think this technique may be able to be used against corporate mail servers. And can be effective in attacks targeting specific companies.
This would work on places like gmail, gmail triggers suspicious activity however if you change to the nearest location via socks you don't get prompted so theres definitly other big web apps that have non flagging systems in place, some gmails are device locked meaning unless your user agent and cookie matches the exact device theres no way possibly in even with the correct password so it's something to keep in mind and think about.
I get Suspicious Login in Instagram, without access to email or facebook...
I do know the username and password -- if someone knows a way around this, or a support email for them where they will actually answer..
LET ME KNOW!
MILLION DOLLAR QUESTION
|
