Hello everyone!
Firstly, it's worth mentioning that over the past fifteen years, the security of Facebook and Instagram has increased. However, what strategies do hackers employ to breach users' accounts? Until recently, hackers used phishing methods to steal the credentials of unsuspecting individuals. However, from what I know, this method no longer works, partly because, as you are well aware, fraudulent emails are promptly blocked by email providers' filters, which utilize artificial intelligence and user reports to distinguish legitimate communications from deceptive ones.
Furthermore, another drawback of phishing is the difficulty in engaging with the user. For instance, if the user doesn't regularly access their email, it's challenging for a malicious actor to successfully carry out the attack. Additionally, if the target has received even basic education in digital security, they might be able to recognize potential scams, avoiding falling into the trap of wrongdoers. In such cases, I suppose even the most skilled hacking professional might experience significant difficulty in successfully completing a phishing operation against the victim, wouldn't they?
So, aside from other techniques like malware, which are ineffective (especially if the user doesn't have a computer), what approaches do hackers use to penetrate others' profiles? I often hear about groups or individual hackers easily breaching others' digital identities, and I wonder how this is possible, considering that Instagram, Facebook, and various email providers have systems that are difficult to bypass.
I thank you in advance for your responses and look forward to hearing your thoughts on the matter. I'd love to engage with various experts on this topic.
Do you want to track someone's location? If your answer to this question is affermative, click here.
Apr 27, 2024 03:35 PM
(This post was last modified: Apr 27, 2024 03:46 PM by kopoil666.)
What a joke, session hijacking is your friend.
Apr 28, 2024 05:39 AM
(This post was last modified: Apr 28, 2024 05:40 AM by DramaKing.)
(Apr 27, 2024 06:47 AM)SIM-4574945 Wrote: Hello everyone!
Firstly, it's worth mentioning that over the past fifteen years, the security of Facebook and Instagram has increased. However, what strategies do hackers employ to breach users' accounts? Until recently, hackers used phishing methods to steal the credentials of unsuspecting individuals. However, from what I know, this method no longer works, partly because, as you are well aware, fraudulent emails are promptly blocked by email providers' filters, which utilize artificial intelligence and user reports to distinguish legitimate communications from deceptive ones.
Furthermore, another drawback of phishing is the difficulty in engaging with the user. For instance, if the user doesn't regularly access their email, it's challenging for a malicious actor to successfully carry out the attack. Additionally, if the target has received even basic education in digital security, they might be able to recognize potential scams, avoiding falling into the trap of wrongdoers. In such cases, I suppose even the most skilled hacking professional might experience significant difficulty in successfully completing a phishing operation against the victim, wouldn't they?
So, aside from other techniques like malware, which are ineffective (especially if the user doesn't have a computer), what approaches do hackers use to penetrate others' profiles? I often hear about groups or individual hackers easily breaching others' digital identities, and I wonder how this is possible, considering that Instagram, Facebook, and various email providers have systems that are difficult to bypass.
I thank you in advance for your responses and look forward to hearing your thoughts on the matter. I'd love to engage with various experts on this topic.
Phishing through Facebook messages or infostealers on desktop users without 2FA.
(Apr 27, 2024 03:35 PM)kopoil666 Wrote: What a joke, session hijacking is your friend.
How will you do session hijacking without phishing on a mobile user?
(Apr 28, 2024 05:39 AM)DramaKing Wrote: Phishing through Facebook messages or infostealers on desktop users without 2FA.
How will you do session hijacking without phishing on a mobile user?
Thank you for your prompt reply. I'm interested in learning more about infostealers on desktop users without 2FA, as well as some tips on tricking users via private messages on Facebook. I would also like to learn how to use session hjacking. I have never tried this before. Could I start a conversation with you?
Do you want to track someone's location? If your answer to this question is affermative, click here.
(Apr 28, 2024 07:54 AM)SIM-4574945 Wrote: Thank you for your prompt reply. I'm interested in learning more about infostealers on desktop users without 2FA, as well as some tips on tricking users via private messages on Facebook. I would also like to learn how to use session hjacking. I have never tried this before. Could I start a conversation with you?
If you have got the idea how this all work could you plz give me the moment of yours and tell me also I'm interested in it
Apr 28, 2024 11:43 AM
(This post was last modified: Apr 28, 2024 11:43 AM by SIM-4574945.)
(Apr 28, 2024 08:57 AM)se7nup Wrote: If you have got the idea how this all works could you plz give me the moment of yours and tell me also I'm interested in it .
I have never used tools like infostealers. Therefore I am not able to help you. I have also never implemented a session hijacking attack. For this other reason, I was looking for someone who could give me tips on how to proceed. Although I have a background in implementing password harvesting methods, I would not mind getting some tips to refine my social engineering tactics.
Do you want to track someone's location? If your answer to this question is affermative, click here.
(Apr 28, 2024 07:54 AM)SIM-4574945 Wrote: Thank you for your prompt reply. I'm interested in learning more about infostealers on desktop users without 2FA, as well as some tips on tricking users via private messages on Facebook. I would also like to learn how to use session hjacking. I have never tried this before. Could I start a conversation with you?
PureLogs is one option. Send stealer and get passwords and cookies when it runs. https://hackforums.net/showthread.php?tid=6225568
(Apr 28, 2024 02:18 PM)Tocx Wrote: 90% hijacking brotha
It will be 1% soon.
Apr 29, 2024 08:06 AM
(This post was last modified: Apr 29, 2024 08:12 AM by SIM-4574945.)
(Apr 28, 2024 12:39 PM)DramaKing Wrote: PureLogs is one option. Send stealer and get passwords and cookies when it runs. https://hackforums.net/showthread.php?tid=6225568
Thanks. I'm not an expert and have never used such tools, but I'm interested in learning new things. Will this tool be detected? How does the infection method work? Let's say I want to trick an Android or Windows user. How can I install such malware remotely without sending them an executable that might be blocked by their email provider? I am waiting for your kind and quick reply.
(Apr 29, 2024 06:47 AM)BlackWidow1 Wrote: A lot of it is phishing.
Yes, but it's difficult to send phishing URLs to other people, especially via Facebook and Instagram messages. Many hackers send a fraudulent email from Facebook or Instagram asking the recipient to confirm their account details. However, this approach may not be effective, as many email providers, such as Gmail and similar, recognise the structure of such fraudolent communications by relying on artificial intelligence filters as well as users' previous reports. Others could instead send an email from a random email address and ask the target to open the link, but it's difficult to find a way to fool the user.
(Apr 28, 2024 02:18 PM)Tocx Wrote: 90% Kidnapping Brotha
How does this method work? Are you sure it's possible to remotely hijack cookie sessions on Android, iPhone and Windows? I've heard that this system doesn't work because of the SSL certificate introduced by Facebook. However, as I'm not an expert, I could be wrong.
Do you want to track someone's location? If your answer to this question is affermative, click here.
Apr 29, 2024 08:22 AM
(This post was last modified: Apr 29, 2024 08:28 AM by DramaKing.)
(Apr 29, 2024 08:06 AM)SIM-4574945 Wrote: Thanks. I'm not an expert and have never used such tools, but I'm interested in learning new things. Will this tool be detected? How does the infection method work? Let's say I want to trick an Android or Windows user. How can I install such malware remotely without sending them an executable that might be blocked by their email provider? I am waiting for your kind and quick reply.
Of course it is. Purelogs was getting 12/20 detections on scanner.to as of last year. The only way to not have any initial detections is to write the malware yourself and hide the behavior or pay someone to do it.
(Apr 29, 2024 08:06 AM)SIM-4574945 Wrote: Yes, but it's difficult to send phishing URLs to other people, especially via Facebook and Instagram messages. Many hackers send a fraudulent email from Facebook or Instagram asking the recipient to confirm their account details. However, this approach may not be effective, as many email providers, such as Gmail and similar, recognise the structure of such fraudolent communications by relying on artificial intelligence filters as well as users' previous reports. Others could instead send an email from a random email address and ask the target to open the link, but it's difficult to find a way to fool the user.
Well, spammers will periodically make changes to the emails so that spam filters won't recognize them. They rely on reaching the 0.2% of people or so who have no brain.
(Apr 29, 2024 08:06 AM)SIM-4574945 Wrote: How does this method work? Are you sure it's possible to remotely hijack cookie sessions on Android, iPhone and Windows? I've heard that this system doesn't work because of the SSL certificate introduced by Facebook. However, as I'm not an expert, I could be wrong.
It doesn't work because of the cookie encryption using TPMs that Google introduced for desktop Chrome and the fact that browser app data is inaccessible on mobile devices for any other apps.
(Apr 29, 2024 08:22 AM)DramaKing Wrote: Of course it is. Purelogs was getting 12/20 detections on scanner.to last year. The only way not to get detected is to write the malware yourself and hide the behaviour, or pay someone to do it.
Well, spammers will regularly make changes to their emails so that spam filters don't recognise them. They rely on reaching the 0.2% or so of people who have no brains.
It doesn't work because of the cookie encryption using TPMs that Google has introduced for desktop Chrome, and the fact that browser application data is inaccessible to other applications on mobile devices.
Thank you for your prompt and kind reply, and for the clarification. Unfortunately, I don't have any programming skills. So I can't create malware myself. I was thinking of buying Pure Logs and its crypter, but if the detection is the same, I don't know if it's worth buying both tools. As for paying someone to make the malware, I couldn't afford the right amount. As far as I know, a coder might charge high fees for this kind of work, and now I can't afford much. As for SE tricks, what kind of ways can you use to trick people into opening a link?
Do you want to track someone's location? If your answer to this question is affermative, click here.
(Apr 28, 2024 11:43 AM)SIM-4574945 Wrote: .
I have never used tools like infostealers. Therefore I am not able to help you. I have also never implemented a session hijacking attack. For this other reason, I was looking for someone who could give me tips on how to proceed. Although I have a background in implementing password harvesting methods, I would not mind getting some tips to refine my social engineering tactics.
I would like to know about your password harvesting methods it's new to me so I would like to learn it can you help to teach me
DO NOT DEAL WITH THIS MEMBER
(Apr 29, 2024 12:46 PM)SIM-4574945 Wrote: Thank you for your prompt and kind reply, and for the clarification. Unfortunately, I don't have any programming skills. So I can't create malware myself. I was thinking of buying Pure Logs and its crypter, but if the detection is the same, I don't know if it's worth buying both tools. As for paying someone to make the malware, I couldn't afford the right amount. As far as I know, a coder might charge high fees for this kind of work, and now I can't afford much. As for SE tricks, what kind of ways can you use to trick people into opening a link?
(Apr 30, 2024 09:34 AM)se7nup Wrote: I would like to know about your password harvesting methods it's new to me so I would like to learn it can you help to teach me
SE can be used in a lot of different ways. Some example of somebody social engineering a person is to present a fake product, like game hacks. You can run promotions for a cheat engine that is out of this world good, and its free! Realistically, it is just malware. Or even binding malware to legitimate software.
Stealers are the malware that would be password harvesters. Like it's name, the objective is pull all sensitive data off the machine it can. When you ask for methods, what do you mean? I think the question is the same as above, in the SE section.
The act of getting malware into victim computers is called spreading. There are a lot of methods for this; there are a lot of ways to obtain the data you want to harvest.
Social engineering a person to do what you want is really a situation-by-situation thing. You could present a solution to a problem, you could present a new product, you could roleplay as a support agent, you could bind it to a legitimate program. If you are well verse with a person, you can take your time sending them links to legitimate things till you need them to open something else.
In this post I am not going to critique any vendors products, I would suggest exploring all options, utilizing the Safe Trading Guide by using a Middle Man/Escrow, and setting clear expectations. Talk to different vendors, educate yourself on what they offer, the outputs, why they are like that, etc. Setting your expectations is important and should be the basis of any contract.
|
