HACK FACEBOOK/ GMAIL/ YAHOO ACCOUNT BY PHISHING - BACKTRACK

Alert: This is for education purpose only. I'm not responsible for any destruction done for you to anyone :P

Firstly I Will Tell You "WHAT IS PHISHING "

Phishing is comparable to fishing in a lake, but rather of looking to capture seafood, phishers try and steal your individual information. They mail out e-mails that may actually come by legitimate websites for example eBay, PayPal, or other bankers. The e-mails suggest that your information needs to be updated or validated and ask that people enter your details, after clicking a keyword rich link in the e-mail. Some e-mails may ask that you just enter more information, for example your owner's name, address, cell phone number, social stability number, and plastic card number. On the other hand, even when you visit your false website and just enter your details, the phisher could possibly gain entry to more information just by logging in to you account.

Phishing is really a con online game that scammers use to collect personal information from unsuspicious users. The actual false e-mails typically look astonishingly legitimate, and even the web pages where you stand asked to help enter your data may glimpse real. Nonetheless, the URL inside the address discipline can show you if the actual page you've been focused to is valid or even not. By way of example, if you are visiting an Website page on craigslist and ebay, the last perhaps the domain label should stop with "ebay. com. inches Therefore, "http://www.ebay.com" and "http://cgi3.ebay.com" are valid Web addresses, but "http://www.ebay.validate-info.com" and "http://ebay.login123.com" are false addresses, which may be used by phishers. If URL contains an IP address, such as 12.30.229.107, instead of a domain name, you can almost be sure someone is trying to phish for your personal information.

When you receive the e-mail which asks that you update your information and you think it could be valid, demand website by means of typing your URL in your browser's handle field instead of clicking the hyperlink in your e-mail. For Example, go to "https://www.paypal.com" instead of clicking the link in an e-mail that appears to come from PayPal. If you are prompted to update your details after you have manually keyed in the Link and logged in, then the actual e-mail had been probably respectable. However, should you be not questioned to revise any data, then the actual e-mail was most likely a spoof sent with a phisher.

Most legitimate e-mails will address you by your full name at the beginning of the message. If there is any doubt that the e-mail is legitimate, be smart and don't enter your information. Even if you believe the message is valid, following the guidelines above will prevent you from giving phishers your personal information.

Boot your backtrack machine.

Navigate to the following path. Applications > Backtrack > Exploitation Tools > Social Engineering Tools > Social Engineering Toolkit > set

It'll navigate you to the Social-Engineering Toolkit (SET) terminal

Here, Enter your choice as 2 for Website Attack Vectors.

Now, Enter your choice as 3 for Credential Harvester Attack Method

In website attack vectors, Enter the Number as 2 for Site Cloner.

Then it'll ask you to Enter the url to clone. Here, I'm using www.facebook.com for demonstration but you can use the url of gmail or yahoo or whatever you want. After writing the URL hit Enter.

When its done with cloning again press Enter. Don't close this terminal because it'll display the password later. Now our site clone is ready all you need to do is to send its link to the victim who's account you want to hack. The IP address of the Backtrack will be treated as the address of the clone site.

So grab the IP address of Backtrack. Open a new terminal and shoot the command ifconfig and get its IP address. It'll look something like inet addr: 192.168.26.128

Since I'm running Backtrack on Virtual Machine so my IP is something like 192.168.26.128 yours may can differ.

Note: The IP's of the figure 192.168.xxx.xxx shows its existence in a LAN or WAN. In that case this will work in those networks only.

Now, send your IP address directly to the victim or you can spoof it by shrinking the url using many online services like adf.ly or goo.gl or any similar one. Send the generated link to the Victim via chat or Email or by any means.

When the user click on the link, it'll redirect to the facebooks cloned login page.

After entering the email and password when the victim click Login. It'll get redirected to the original facebook login page and our SET terminal will display the results i.e. the email id and password.

Here, email ID: abc@xyz.com and Password: 123456

That's it you have successfully hacked facebook account via Site Cloner on Backtrack.

Note: This trick may not work globally if you're running Backtrack in virtual machine. For that purpose boot it as your main OS, either install it or use any Bootable USB or DVD of backtrack.

Phishing usually work only on noobs but if you want to apply it on an expert use it smartly :)