Oct 12, 2017 11:49 AM
(This post was last modified: Oct 12, 2017 12:51 PM by cephregada.)
This tutorial is not guaranteed to work on every email or social media account but it's a starting place
(Step 1) Understand what you are dealing with
Nowadays, gaining unauthorized access to accounts (Facebook, hotmail,gmail,snapchat,instagram etc...) is hugely based on three attack vectors
1- Social Engineering: Manipulating your target to give out information about their password or their reset options (place they where born, first dog's name, mother's name etc..) or gathering such information from the open web.
2- Malware delivery: It's when you try to deliver a malware to the target through Social Engineering or exploiting a vulnerability on their devices to deliver your malware that in place gets you back password, keylogs etc...
3- Lack of knowledge from the target: This is the third technique used and what will be the base of this tutorial.
What people usually do nowadays is to create a social media account, let's take Facebook as an example, connect that Facebook to an email address and start posting cat's pictures.
Usually people tend to forget about the "email" part. People consider the "email account" is taken for granted and is only a mean to get the social media account, in this case Facebook.
This is a common mistake you see in most of the hacking done on Facebook, let me explain further.
(Step 2) Reversing
Let's say you have a Facebook account of someone that has a username "xxxxX"
Go to the main page of Facebook and press "Forgot Account?", it will take you to the "Find Your Account" page with a text box. Enter in that text box the username and a page will appear stating what "reset" options you have to change the password.
Take a look at the email field it will be something filled with asterisks "x*********[email protected]"
You can verify that the email you are guessing is correct by going into the "Forgot Account?" page and entering the email instead of the username, it should show you the same profile you are targeting.
Try to guess the email that is behind the asterisks based on the information you know about your target or the information you acquired by social engineering.
(Step 3) Gaining Access
After guessing the correct email, head to the service, let's take an example of hotmail
Head to the website and try to login with the email you guessed earlier with any password. If you are lucky enough, the page will get back to you with an answer that says "this account doesn't exist"
This happens when the user creates an email and doesn't use it much often so it get deleted by hotmail due to inactivity.
From here you can signup with the hotmail you guessed and you will have the email of your target with you. Then you can access facebook and send a reset to the hotmail you created and now you have access to facebook.
NOTE: There are many factors that will stand in your way sometimes, 2 factor verification is one of them or the sudden change in IP address will lock the account of the facebook you are accessing so be careful when doing so.
This method can be applied to any social media account because 99% of services are based on emails
Stay safe and don't get yourself Into trouble because unauthorized access is illegal, this is for educational purposes only.
