Jun 5, 2012 02:06 PM
(This post was last modified: Jul 2, 2012 09:08 AM by pr0t0typ3.)
What is Form Grabbing ?
Form grabbing is an advanced method of capturing web form data within various browsers. Often confused with traditional keylogging (recording individual keystrokes), this method intercepts the API in browsers that is used to transmit information and collects web form data before it is passed over to the internet. (Source: Wikipedia.org)
How does Form Grabbing work ?
A Formgrabber does replace the function that is used to send information to the internet with its own function. Every time the browser does submit information to the internet, the replacement function is called first and the intruder is able to access the web forms the browser does send to the internet before they are actually sent. The intruder is also able to modify these forms or prevent them from being sent.
View detailed diagram:
Spoiler (Click to View)
What are webforms ?
A webform on a web page allows a user to enter data that is sent to a server for processing. Webforms resemble paper or database forms because internet users fill out the forms using checkboxes, radio buttons, or text fields. For example, webforms can be used to enter shipping or credit card data to order a product or can be used to retrieve data (e.g., searching on a search engine or logging into a website). (Source: Wikipedia.org)
View example:
Spoiler (Click to View)
Why are Formgrabbers superior to traditional forms of password stealing malware ?
While Password Stealers only recover credentials saved in the browser and Keyloggers do require the user to type in the credentials, Formgrabbers just require the information/credentials you want to access to be used/sent. No matter if the credentials are typed into the browser (with a physical or virtual keyboard), they are saved in the browser and used to login at a later point or they are copied into the login fields, the grabbing process of a Formgrabber is always successful, while neither a Stealer nor a Keylogger would be able to perform a successful recovery in every case mentioned above.
If Formgrabbers are that good, why can't I find any good cheap one ?
If we look back to the year 2007 when the Crimeware-Pack Zeus was released, and the first "famous" Formgrabber hit the market, you had to invest between 700 $ and 15.000 $ (for the full package with all features as there was no standalone formgrabber). You might ask yourself, why there are not tons of good Formgrabbers which are much cheaper if they are really superior to all traditional forms of malware (used for credential stealing) and the answer is pretty easy: They are a lot harder to do than Stealers or Keyloggers. The programmer needs knowledge about the process architecture of Windows, the art of hooking functions (which often have to be found in memory first using special algorithms), a native language like C/C++, Delphi (in exceptional cases) or ASM, reverse engenieering to find out about the behavior of the browser as well as a lot of time and money to invest into a talented web developer to create a powerful web-panel where the logs that have been "grabbed" are sent to. This means that high prices are more than justified, they are needed to preserve the right of ownership for such a powerful and dangerous tool to people who are serious about what they do.
Where can I get Formgrabbers and what do I need to pay attention to ?
In many "underground" forums you can find formgrabbers as plugins or additional modules for HTTP Bots, while standalone Formgrabbers are rare to find. You need to pay attention to a fair price, an unique functionality and a good web-panel (this is a very important point). You might ask yourself what unique means in this context. Over the last months some Formgrabber sources for various Browsers (Internet Explorer and Firefox) became public and have been heavily copied and published, while most people were unable to create proper Formgrabbing methods (Methods that are able to grab HTTP as well as HTTPS traffic) for Google Chrome, Opera and Safari. Also pay attention that the Formgrabber does support the grabbing of SSL encrypted traffic (used by HTTPS connections for many login sites).
Form grabbing is an advanced method of capturing web form data within various browsers. Often confused with traditional keylogging (recording individual keystrokes), this method intercepts the API in browsers that is used to transmit information and collects web form data before it is passed over to the internet. (Source: Wikipedia.org)
How does Form Grabbing work ?
A Formgrabber does replace the function that is used to send information to the internet with its own function. Every time the browser does submit information to the internet, the replacement function is called first and the intruder is able to access the web forms the browser does send to the internet before they are actually sent. The intruder is also able to modify these forms or prevent them from being sent.
View detailed diagram:
Spoiler (Click to View)
![[Image: 08uk0.png]](https://i.imgur.com/08uk0.png)
What are webforms ?
A webform on a web page allows a user to enter data that is sent to a server for processing. Webforms resemble paper or database forms because internet users fill out the forms using checkboxes, radio buttons, or text fields. For example, webforms can be used to enter shipping or credit card data to order a product or can be used to retrieve data (e.g., searching on a search engine or logging into a website). (Source: Wikipedia.org)
View example:
Spoiler (Click to View)
Why are Formgrabbers superior to traditional forms of password stealing malware ?
While Password Stealers only recover credentials saved in the browser and Keyloggers do require the user to type in the credentials, Formgrabbers just require the information/credentials you want to access to be used/sent. No matter if the credentials are typed into the browser (with a physical or virtual keyboard), they are saved in the browser and used to login at a later point or they are copied into the login fields, the grabbing process of a Formgrabber is always successful, while neither a Stealer nor a Keylogger would be able to perform a successful recovery in every case mentioned above.
If Formgrabbers are that good, why can't I find any good cheap one ?
If we look back to the year 2007 when the Crimeware-Pack Zeus was released, and the first "famous" Formgrabber hit the market, you had to invest between 700 $ and 15.000 $ (for the full package with all features as there was no standalone formgrabber). You might ask yourself, why there are not tons of good Formgrabbers which are much cheaper if they are really superior to all traditional forms of malware (used for credential stealing) and the answer is pretty easy: They are a lot harder to do than Stealers or Keyloggers. The programmer needs knowledge about the process architecture of Windows, the art of hooking functions (which often have to be found in memory first using special algorithms), a native language like C/C++, Delphi (in exceptional cases) or ASM, reverse engenieering to find out about the behavior of the browser as well as a lot of time and money to invest into a talented web developer to create a powerful web-panel where the logs that have been "grabbed" are sent to. This means that high prices are more than justified, they are needed to preserve the right of ownership for such a powerful and dangerous tool to people who are serious about what they do.
Where can I get Formgrabbers and what do I need to pay attention to ?
In many "underground" forums you can find formgrabbers as plugins or additional modules for HTTP Bots, while standalone Formgrabbers are rare to find. You need to pay attention to a fair price, an unique functionality and a good web-panel (this is a very important point). You might ask yourself what unique means in this context. Over the last months some Formgrabber sources for various Browsers (Internet Explorer and Firefox) became public and have been heavily copied and published, while most people were unable to create proper Formgrabbing methods (Methods that are able to grab HTTP as well as HTTPS traffic) for Google Chrome, Opera and Safari. Also pay attention that the Formgrabber does support the grabbing of SSL encrypted traffic (used by HTTPS connections for many login sites).
