Hackers Chronicle - Online Cyber Security News: Social Engineering

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZaWqW0Nr7W0f4fGzgndnUMsWs_Q9PjVXDCQlT3vpsbQXLhtiMuhKok4-Ua8x4bKl1NncsY_WmGOSqQ9sLxhn33yQs_hClDrKwqwjCcW5acFFvZHRlfRRHz5bvYme415azN0upsvfAS1E/s1600/sms-spoofing-with-kali-linux.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="206" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZaWqW0Nr7W0f4fGzgndnUMsWs_Q9PjVXDCQlT3vpsbQXLhtiMuhKok4-Ua8x4bKl1NncsY_WmGOSqQ9sLxhn33yQs_hClDrKwqwjCcW5acFFvZHRlfRRHz5bvYme415azN0upsvfAS1E/s1600/sms-spoofing-with-kali-linux.png" width="320" /></a></div>
The new <a href="http://rahlabs.blogspot.in/search/label/Kali%20Linux" target="_blank" title="Kali Linux">Kali-Linux (BT6)</a> comes with many advance and increasing features and one of its incredible feature is its <a href="http://rahlabs.blogspot.in/search/label/Social%20Engineering" target="_blank" title="SMS Spoofing">SMS spoofing</a> weapon. So today we will have fun with this feature and see how easily we can spoof SMS. This is an amazing and improved feature that has made many security professionals think. Anyone can easily spoof sms from various numbers and there is no chance to be caught. This feature is located in the SET (<br />
<div class="highlight">
Social Engineering toolkit</div>
). For this go to <br />
<div class="system pop">
Applications>>Kali Linux>>Exploitation tools>>se-toolkit</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD7LUvR5wkJHcfuwywWyS8z-qFBHF9UG5V9EYW_WHhr4FsJTukdlBovVeDhkyrUOu0ANdVsEBBkcygkc0YSXgyV6e3n0bsAINNwTTFnfriOUtGP-53xhIjXTPVNcyEQlGSLxrcFlhiU4g/s1600/sms-spoofing-1.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="261" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhD7LUvR5wkJHcfuwywWyS8z-qFBHF9UG5V9EYW_WHhr4FsJTukdlBovVeDhkyrUOu0ANdVsEBBkcygkc0YSXgyV6e3n0bsAINNwTTFnfriOUtGP-53xhIjXTPVNcyEQlGSLxrcFlhiU4g/s1600/sms-spoofing-1.jpg" width="400" /></a></div>
<strong>Next select option 7</strong>: SMS spoofing attacks<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKPPP66NzWepyjZnA3xU6EVKQefx3RBOqEsa6WU3o3Wua5UGSHw-yNzYIiVsf0912t00dtw6O9Fz8DDwQrtPNIXhedtxDOYqhTvk0LCS4YGOgz6rcoTsGsgIOOTGq7fEPXkJXj1L09psc/s1600/sms-spoofing-2.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="162" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiKPPP66NzWepyjZnA3xU6EVKQefx3RBOqEsa6WU3o3Wua5UGSHw-yNzYIiVsf0912t00dtw6O9Fz8DDwQrtPNIXhedtxDOYqhTvk0LCS4YGOgz6rcoTsGsgIOOTGq7fEPXkJXj1L09psc/s1600/sms-spoofing-2.jpg" width="400" /></a></div>
Then <strong>select the option no 1</strong>: Perform SMS spoofing attack<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEOqd6qvxgz5361vD2fDpSNyQvWw31EuNgNis0qRxW3AaRJTRyZttO_sMxX8VET9gschrKyoYj8d0OTLspaaew9rix_uNaGio6VNthG0PM1zVpNaX5d8Wl4ZqjWuiahBRdRbygR2Jiyqs/s1600/sms-spoofing-3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="165" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEOqd6qvxgz5361vD2fDpSNyQvWw31EuNgNis0qRxW3AaRJTRyZttO_sMxX8VET9gschrKyoYj8d0OTLspaaew9rix_uNaGio6VNthG0PM1zVpNaX5d8Wl4ZqjWuiahBRdRbygR2Jiyqs/s1600/sms-spoofing-3.jpg" width="400" /></a></div>
After that again <strong>select option no 1</strong>: SMS Attack single phone number<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEio1qgvT7dvyG6pp4UE1q8pT2cH2L0yXTQsFd8Id2k289b5f6q1HmJZzGQP0AZg8EYqbYOAhjB3oYkKEFmlGVsuqkC_t-gsO0Z-36KcS1Q7NW_APMnE_IOXHOOvSwrymWn0jrrCSkc6bpE/s1600/sms-spoofing-4.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="237" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEio1qgvT7dvyG6pp4UE1q8pT2cH2L0yXTQsFd8Id2k289b5f6q1HmJZzGQP0AZg8EYqbYOAhjB3oYkKEFmlGVsuqkC_t-gsO0Z-36KcS1Q7NW_APMnE_IOXHOOvSwrymWn0jrrCSkc6bpE/s1600/sms-spoofing-4.png" width="400" /></a></div>
Now enter the <strong>victim’s Phone-number</strong> with its country code<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSAJEzPB30n-n28joYCd0_B2Bz8YUsW3BRBtxDEZaS9xvrEUbHTD7Fh65udmcPfPT6-Wr3TG7ubKtyRI864YJ23rB0VjZy_OG1QbSJgl5wap05Lsya6LJw1hzPGfg7FWCRfbIAWH34n9c/s1600/sms-spoofing-5.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="246" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSAJEzPB30n-n28joYCd0_B2Bz8YUsW3BRBtxDEZaS9xvrEUbHTD7Fh65udmcPfPT6-Wr3TG7ubKtyRI864YJ23rB0VjZy_OG1QbSJgl5wap05Lsya6LJw1hzPGfg7FWCRfbIAWH34n9c/s1600/sms-spoofing-5.png" width="400" /></a></div>
Now <strong>select a template</strong> or use predefined templates as shown in below image<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYCybiCSY8_I9vobvcDbDSI9rJ9f6RtN1FjUycLOEdlKhNFldWZrDdtbk7geKnP-L8xIuVBSpl-OwAwQhjx-A4G-thP8ij9hYaA1_sW58LzhPm3Fp4_R3natojXEHaw89ofesQN9oWXNg/s1600/sms-spoofing-6.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="241" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiYCybiCSY8_I9vobvcDbDSI9rJ9f6RtN1FjUycLOEdlKhNFldWZrDdtbk7geKnP-L8xIuVBSpl-OwAwQhjx-A4G-thP8ij9hYaA1_sW58LzhPm3Fp4_R3natojXEHaw89ofesQN9oWXNg/s1600/sms-spoofing-6.png" width="400" /></a></div>
I am selecting a fake police SMS <strong>option 19</strong><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtm9hazd8vKrnumOLZCKoeDqiJXKzO9t4KDDcOUjMBTXI7cNCGAY_PXAnYcBcLJL71MjZLEmdiJTiatrAvI_piTm7d623HOkMZexGuLmRAiwxTcmFHgPyxTNlBmiDizPRoF4t90UrUZfQ/s1600/sms-spoofing-7.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="241" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtm9hazd8vKrnumOLZCKoeDqiJXKzO9t4KDDcOUjMBTXI7cNCGAY_PXAnYcBcLJL71MjZLEmdiJTiatrAvI_piTm7d623HOkMZexGuLmRAiwxTcmFHgPyxTNlBmiDizPRoF4t90UrUZfQ/s1600/sms-spoofing-7.png" width="400" /></a></div>
Now it’s almost done, from here you can choose the predefined <a href="http://rahlabs.blogspot.in/search/label/Android" title="Android">android </a> emulator or use your the SMS accounts. Thus, either you can start a war or stop it by sending SMS from fake locations.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivRSG7b0Lf4MKEk5YnoCH83EkIN815u9EJnMNKx-e5Uukq2Vyv0PTx0r26U9ckR2sdCbrXjVK5uiOv_q088ROOhKUEuaSoNd4vwUp052hbziFpFBmwY_-ImZLMEDR_sxRJiwMznMM1d4k/s1600/sms-spoofing-8.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="242" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivRSG7b0Lf4MKEk5YnoCH83EkIN815u9EJnMNKx-e5Uukq2Vyv0PTx0r26U9ckR2sdCbrXjVK5uiOv_q088ROOhKUEuaSoNd4vwUp052hbziFpFBmwY_-ImZLMEDR_sxRJiwMznMM1d4k/s1600/sms-spoofing-8.png" width="400" /></a></div>
<strong>Don't</strong> use these tricks in unethical way. Have fun! <a href="http://mile2.com/" rel="nofollow" target="_blank">Source</a><br />
<br /></div>

The new Kali-Linux (BT6) comes with many advance and increasing features and one of its incredible feature is its SMS spoofing weapon. ...

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="112" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVpOqWk1DSAJKLIjKip-S5lRZrI4t7RucRcBg0q66ThDxVKtuzCldtQQfM8iabX8sYdY2EGrJ2yVoiTKcKwzpSv2CI21A6WxwI7BNbk14eqpGMVpf5nVGLxkB5v0oHX1CG-jUashj_FEo/s1600/tab-napping.jpg" width="320" /></a></div>
<br />
<div class="post-body entry-content">
<span class="Apple-style-span"><span id="7140679708706166316"></span></span><br />
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a page, the chase is up. You've escaped the attackers. In fact, the time that wary people are most wary is exactly when they first navigate to a site.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">What we don't expect is that a page we've been looking at will change behind our backs, when we aren't looking. That'll catch us by surprise.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><b>How Phishing Attack Using Tabnabbing Works</b></span></span></div>
<div>
<ol>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;"><span class="Apple-style-span"><span id="7140679708706166316">A user navigates to your normal looking site.</span></span></li>
<span class="Apple-style-span"><span id="7140679708706166316">
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">You detect when the page has lost its focus and hasn't been interacted with for a while.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">Replace the favicon with the Gmail favicon, the title with "Gmail: Email from Google", and the page with a Gmail login look-a-like. This can all be done with just a little bit of Javascript that takes place instantly.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">As the user scans their many open tabs, the favicon and title act as a strong visual cue—memory is malleable and moldable and the user will most likely simply think they left a Gmail tab open. When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in. The attack preys on the perceived immutability of tabs.</li>
<li style="margin: 0px 0px 0.25em; padding: 0px; text-indent: 0px;">After the user has entered their login information and you've sent it back to your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful.</li>
</span></span></ol>
</div>
</div>
<div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">In this attack, the phisher need not even change the Web address displayed in the browser's navigation toolbar. Rather, this particular phishing attack takes advantage of user trust and inattention to detail, or what Raskin calls "the perceived immutability of tabs." Then, as the user scans their many open tabs, the favicon and title act as a strong visual cue, and the user will most likely simply think they left a Gmail tab open.</span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316">"When they click back to the fake Gmail tab, they'll see the standard Gmail login page, assume they've been logged out, and provide their credentials to log in," Raskin explained. "After the user has enter they have entered their login information and sent it back your server, you redirect them to Gmail. Because they were never logged out in the first place, it will appear as if the login was successful."</span></span></div>
</div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><br /></span></span></div>
<div>
<span class="Apple-style-span"><span id="7140679708706166316"><i>For Firefox users with the Noscript plugin, there is an update to the program that can block these types of tabnabbing attacks.</i></span></span></div>
</div>
<br />
<div>
<br /></div>
-- <br />
<div dir="ltr">
Regards,<br />
Hardeep Singh<br />
(<a href="http://www.fb.com/h4rdeep" target="_blank">www.fb.com/h4rdeep</a>)</div>
<br /></div>

Hacking Hacking Tutorials Phishing Social Engineering Tabnapping Tutorials Phishing Attack Using Tabnabbing

Most phishing attacks depend on an original deception. If you detect that you are at the wrong URL, or that something is amiss on a ...

SMS Spoofing with Kali Linux

Phishing Attack Using Tabnabbing

Popular

Comments

Archive