Kunal Vohra, a well deserved ethical hacker and CEO of H2K shared his public photo on his Facebook. Tap to know more about him. . .
==>Kunal Vohra<==
Keep sharing.
Showing posts with label fb hacking. Show all posts
Showing posts with label fb hacking. Show all posts
Tuesday, 22 March 2016
Saturday, 29 November 2014
Facebook Self-XSS Scam Fools Users into Hacking Themselves
Admin "Kunal Vohra"
Scammers have again targeted more than one billion active users of the popular social networking giant Facebook, to infect as many victims as possible.
Not by serving fake post, neither by providing malicious video link, instead this time scammers have used a new way of tricking Facebook users into injecting or placing malicious JavaScript or client-side code into their web browsers.
This malicious code could allow an attacker to gain access to victims’ accounts, thereby using it for fraud, to send spams, and promoting further attacks by posting the scam on timeline to victims’ friends. This technique is known as Self Cross-site Scripting or Self XSS.
Read More : Hack Facebook User Account (Premium)
Self-XSS (Self Cross-Site Scripting) scam is a combination of social engineering and a browser vulnerability, basically designed to trick Facebook users’ into providing access to their account. Once an attacker or scammer gets access to users’ Facebook account, they can even post and comment on things on users’ behalf.
In order to infect Facebook user, the cyber crooks send a phishing message via an email or a Facebook post from one of the friends in the list of the targeted victim claiming, in this case, a way to hack any Facebook user by following some simple steps.
The posted scam looks as follows:
Hack any Facebook account following these steps:
1. Go to the victim’s profile
2. Click right click then click on inspect element and click the “Console” tab.
3. Paste the code into the box at the bottom and press Enter.
The code is in the web site: http://textuploader .com****/
Good luck: *
Don’t hurt anybody…
They want you to follow the given instructions by copy and pasting the malicious code, as given in the above instructions, for taking over someone else’s account. The trick is suitable for both Google Chrome and Mozilla Firefox users.
Once you self inject this malicious script to your account, it will give away the access of your whole account to the one who could do a variety of malicious activities, basically spreading all sorts of malicious campaigns. The hackers can also infect victim’s computer with malware that can collect banking details and send them to a remote location controlled by them.
Facebook has also listed the scam on the list of threats its users have been observed to fall victim to. “Scammers who use Self-XSS usually trick you by promising to help you hack somebody else's account,” reads the post. “The scammer's goal is to get you to run their malicious code on your computer. When you run their code, you grant the scammer access to your account for fraud, spam, and tricking more people into running the scam.”
Spotting these scams and reporting them are the best way to protect yourself, but if you fall victim to one of these attacks, don't panic! Follow the link to learn more about protecting your Facebook account.
Read More : Hack Facebook User Account (Premium)
Facebook is also working with various browser vendors to add protection in the browser in an effort to prevent this vector from being exploited.
Still Having Problem..!!! Connect with Admin Kunal Vohra
Download Our Official Android App
"The Hackers Street"
For Daily Updates
Friday, 3 October 2014
Hacking Facebook Account with just a text message
Admin "Kunal Vohra"
Can you ever imagine that a single text message is enough to hack any Facebook account without user interaction or without using any other malicious stuff like Trojans, phishing, keylogger etc. ?
Today we are going to explain you that how a UK based Security Researcher, "fin1te" is able to hack any Facebook account within a minute by doing one SMS.
Because 90% of us are Facebook user too, so we know that there is an option of linking your mobile number with your account, which allows you to receive Facebook account updates via SMS directly to your mobile and also you can login into your account using that linked number rather than your email address or username.
According to hacker, the loophole was in phone number linking process, or in technical terms, at file /ajax/settings/mobile/confirm_phone.php
This particular webpage works in background when user submit his phone number and verification code, sent by Facebook to mobile. That submission form having two main parameters, one for verification code, and second is profile_id, which is the account to link the number to.
As attacker, follow these steps to execute hack:
- Change value of profile_id to the Victim's profile_id value by tampering the parameters.
- Send the letter F to 32665, which is Facebook’s SMS shortcode in the UK. You will receive an 8 character verification code back.
- Enter that code in the box or as confirmation_code parameter value and Submit the form.
Facebook will accept that confirmation code and attacker's mobile number will be linked to victim's Facebook profile.
In next step hacker just need to go to Forgot password option and initiate the password reset request against of victim's account.
Attacker now can get password recovery code to his own mobile number which is linked to victim's account using above steps. Enter the code and Reset the password!
Facebook no longer accepting the profile_id parameter from the user end after receiving the bug report from the hacker.
In return, Facebook paying $20,000 to fin1te as Bug Bounty.
Still Having Problem..!!! Connect with Admin Kunal Vohra
Download Our Official Android App
"The Hackers Street"
For Daily Updates
Friday, 5 September 2014
Hack Someone's Private Friend List On FB
By " saumya priya", Author@H2K
Whether you're a celebrity or someone with something to hide, Facebook allows you to keep your "friends list" private so you can protect the identities of your Facebook friends. But it only kind of protects them.
There's a simple Facebook hack that lets you unravel entire networks of people as you navigate around a user's "private" friends list. However, I must warn you, the easy way to do this will take a long time to complete, and the fastest way to do this requires a bit of programming knowledge. Sounds a little counterintuitive, I know.
The Concept Behind the Friends List Hack
According to Facebook, every user gets to decide what is and isn't visible to their friends. If you decide to make your friends list private, great. However, that doesn't mean that you are private on your friends' friends list.
This workaround takes advantage of that fact. You basically unravel a private friends list by viewing that individual's mutual friendships with someone who doesn't have their list set to private.
The most beautiful thing about this is that you don't even need to be friends with the person you're hacking.
Manually Getting Around the Private Friends List
As you can imagine, a good number of high profile figures and celebrities have set their friends list to private. For our purposes, we'll use an easily accessible celebrity who we know has a personal Facebook account (and not just a "Page")... Mark Zuckerberg.
Step 1: Use Facebook's "Graph Search" to Find a Probable Friend
Zuckerberg's friends list is set to private, and for good reason. However, to run this hack, we're going to need to find at least one friend of his who has a public friends list so that we can look at their mutual friends.
Using Facebook's Graph Search feature, we can type something in along the lines of "People who work at Facebook and live in Palo Alto, California," and then get a list of likely friends of Zuckerberg.
Step 2: Compare Their Mutual Friendships with This URL
Being the VP of Advertising & Pages at Facebook is important, so there's a good chance the user Andrew Bosworth is friends with Zuckerberg, and since his friends list is public, he makes a perfect candidate for our hack. To verify Mark is his friend, just search his friends list.
To view their mutual friends, and to see who exactly is friends with Mark, we need to insert their account ID names into the following URL:
Account ID names can be found at the end of the URLs of their Facebook pages. In this case, Zuckerberg's is "zuck," and Andrew Bosworth's is "boz".
After we insert the account IDs into the URL, we get this:
Step 3: Repeat Step 2 Ad Infinitum
It appears that Zuck and Boz have 143 friends in common. That means we at least know 144 of Mark Zuckerberg's friends now.
To unravel his entire list of friends, we will need to repeat Step 2 with any of these mutual friends, and then do it again with those mutual friends, and so on until infinity.
Still Having Problem..!!! Connect with Admin
For Daily Updates
Subscribe to:
Posts (Atom)