CanadianTaco
-
Posts
65 -
Joined
-
Last visited
Posts posted by CanadianTaco
-
-
This method of phishing was giving me mixed results also. I got better results when I just spoofed the DNS to different addresses and ports running credential harvesting pages. Just out of curiosity which browsers was this not working for?
I've only tested it with Google Chrome, Firefox, and Internet Explorer. And so far only Google Chrome works. The other two get automatically redirected to 'peets.html'
-edit-
If it helps I saved the files using Google Chrome 'save page as' then 'Webpage, Complete'. Although I don't quite see how this could be causing the issue...
-
same here. btw, did you clean up the current login pages... there's a lot of unnecessary code, for the appearance sake, and it doesn't work for me. I did a lot trying to figure out things on the Mk IV, learned tons... if there are some neat and clean login pages that'll be great, otherwise, tomorrow :) thx
I left the login pages as they were, except for the login form itself of course.
-
You are their professional. Give them your professional opinion as a recommendation or as part of the report in your deliverables. Definitely the latter, at the very least.
^this^
-
So I have an Pineapple (mark IV) that is set up to connect through one of my laptops that is set up for internet connection sharing. The idea is that targets can connect to whatever site they want except facebook, twitter, or yahoo. When they attempt to connect to one of these three sites they get redirected to my facebook.html, twitter.html. and Yahoo.htm. On my target laptop (using google chrome and connected to my pineapple network) I can get redirected flawlessly. In Internet Explorer or Firefox, not so much. It gets automatically redirected to the sample 'peets.html' page.
DNS Spoof Host: 172.16.42.1 yahoo.com 172.16.42.1 twitter.com 172.16.42.1 facebook.com
Landing page: <html> <head> <meta http-equiv="REFRESH" content="0;url=/s/redirect.php"> </head> <body> </body> </html>
redirect.php: <?php $ref = $_SERVER['HTTP_REFERER']; if (strpos($ref, "facebook")) { header('Location: facebook.html'); } if (strpos($ref, "twitter")) { header('Location: twitter.html'); } if (strpos($ref, "yahoo")) { header('Location: Yahoo.htm'); } require('peets.html'); ?>tl;dr: Does anyone know why one browser would handle this differently than the other? or if this isn't the issue, how to go about fixing it?
-edit-
If it helps I saved the files using Google Chrome 'save page as' then 'Webpage, Complete'. Although I don't quite see how this could be causing the issue...
-
Collected errors:
* opkg_download: Failed to download http://downloads.openwrt.org/snapshots/trunk/ar71xx/packages/Packages.gz, wget returned 1.
any ideas?
I had that error once. I forgot to set up Internet Connection Sharing
-
Hello Forums,
some questions:
i would like to build a package (with scripts and pages) to phish some passwords for facebook, twitter and so on.
doing this for one of the pages wasnt hard (as described here often).
all credentials should be writen to a file (seperated for each page, twitter.txt for twitter, facebook.txt for facebook and so on.)
it should be easy extentable (means easy to add another pages)
its easy to redirect all pages together, but this is not what i want.
so any ideas ?
regards
This guide was originally meant for the older models of the pineapple, but the scripts still work:
http://hak5.org/hack/pineapple-phishing
I have my pineapple set up for multiple phishing pages by redirecting to a redirect.php script and then when the user clicks login or submit the form (with another .php script) that collects the info sends that info to a txt file and shows an error page to the user.
redirect.php:
<?php $ref = $_SERVER['HTTP_REFERER']; if (strpos($ref, "facebook")) { header('Location: facebook.html'); } if (strpos($ref, "twitter")) { header('Location: twitter.html'); } if (strpos($ref, "hotmail")) { header('Location: Hotmail.htm'); } if (strpos($ref, "live")) { header('Location: Hotmail.htm'); } if (strpos($ref, "gmail")) { header('Location: Gmail.htm'); } if (strpos($ref, "yahoo")) { header('Location: Yahoo.htm'); } require('peets.html'); ?> -
I used the tutorial found here: http://hak5.org/hack/pineapple-phishing
Under "Modify a website to capture credentials" is where you want to read. Basically you're just editing the form action to your .php script thus sending the login info 'name' and 'pass' to you.
-
well, what other basic things can i do with the pineapple other than dns spoofing?
The wiki has a few basic 'tutorials' if you will: https://github.com/sebkinne/wifipineapple/wiki
-
The next step is to be able to launch deauth attacks directly from the GUI, just by clicking either on the AP to deauth all the clients, or just a specific one.
That would be convenient!
-
revised NYAN Cat payload
I'm liking it!
-
Students do not have access to command prompt and have no way (that I know of) to get to the registry editor.
That's what the admins at my school thought. They blocked access to cmd.exe ... so I created a new shortcut to command.com ... done. Didn't do anything bad... unless you consider solitaire bad.
-
Came across this bit on the Daily Show.
Visitors of the South by Southwest festival in Austin have found an interesting outlet for access to high-speed Internet connections: the homeless. A test program called Homeless Hotspots -- described as a "charitable experiment" by creators BBH Labs -- takes members of Austin's homeless population and equips them with 4G MiFi devices.Darren... Security??
-
I had never done anything with HTML before.
At the time I hadn't had that much experience with HTML as well. If you want, I recommend downloading a program like Notepad++ and just start messing around/creating stuff. Another great source would be W3Schools (http://www.w3schools.com/). Have fun, learn.
-Edit-
<html> <head> <title>IT'S PEANUT BUTTER JELLY TIME!!</title> <style> body { background-color: #FFFF00; } img.b { display: block; margin-left: auto; margin-right: auto; } </style> </head> <body> <img class="b" src="PBJ.gif" width="214"height="212"> <EMBED src="PBJ.mp3" AUTOSTART=true WIDTH="1" HEIGHT="1" LOOP="2"> </body> </html>As you can see there are multiple ways to do the same thing. I threw this together with a touch of css.
On a related note, I'm uploading this to my pineapple now :D
-
I am using a modified version of nyan cats canadian taco uploaded here: http://forums.hak5.o...ndpost&p=197009
<HTML> <head> <Title>NYAN CAT!!! </Title> </head> <body bgcolor="#053366"> <center> <img src="nyancat.gif" align="middle" width="600" height="600" /> </center> <EMBED SRC=NYAN.mp3 AUTOSTART=true WIDTH=1 HEIGHT=1 LOOP=3> </body> </HTML>
update index.html to the code above and include the posted image called nyancat.gif + NYAN.mp3
Yea, my original one needed some editing/cleaning up, I think I made that for the MK2 back in the day...
But anyway, I was just wondering how to go about doing all this, now you could potentially embed more content. I also noticed this info was also added to the wiki: http://wifipineapple.com/doku.php?id=usbdrive
Now to fancy this all up with some CSS and whatnot!
Thanks!
-EDIT-
Went back and found my original nyan cat thread: http://forums.hak5.org/index.php?showtopic=20651
and also noticed the nyan cat in the Cnet news article with Darren: http://news.cnet.com/8301-27080_3-57394887-245/sxsw-hot-spot-honeypot-hackers-heaven
-
OMG I love it. I'm taking this to SXSW for sure!
Wow, you did use the Nyan cat lol:
http://news.cnet.com/8301-27080_3-57394887-245/sxsw-hot-spot-honeypot-hackers-heaven/
-
In my network bag I always carry a 8 foot CAT6 cable. I grabbed that first since I had it on me and I was going to use it on my pineapple MK4. I found out that the CAT6 cable would not fit in the pineapple. I am wondering if it is just mine or if all are like this.
I have my Cat6 cable plugged into my pineapple right now... works.
-
-
Hi & thanks to any/all that reply to this.
My home router (rental provided by ISP) has become an evil headache the past 3 weeks now.
When the qos dropped by more than half I thought it was time to poke around a bit & see what is up.
I am a little confused by that when I look at available wireless networks in the area & along with my router with it's name, MAC, signal, security , channel,
I see 1 router with no name, MAC, signal, security & channel.
The MAC is almost identical looking like this~ (not the real MAC,just an example)
My Router 36:60:77:07:A3:82
Router without SSID 3c:60:77:07:A3:83
Just the first & last hex digits are different & very close to each other. I don't think that a neighbor would end up with a router
MAC so close to mine by chance.
The signal strength of the 2 routers are close together but rarely identical.
Both are on the same channel & when I change channels the second router seems to flip soon after. Anywhere from 2 min up to 45 mins.
When I disable wifi & cable directly to the router the qos is still bad. I'll check the wireless networks in the area with another computer and sometimes the no name is there and other times it's not.
Isp says service is fine, even though it certainly is not.
Any ideas ?
thanks
S
Just out of curiosity, who's your ISP?
-
WiFiFoFum is another good one, and I think it's on iOS as well as Android. Either way both work and both are free
-
I decided to test out my MK4, so students at an undisclosed college got redirected to a local 'Kony 2012' image without any deauth help. But I was thinking that I could get many more clients to connect if I did use a deauthentication attack. But for some reason all the deauth attacks that I've seen/used pinpoint a specific client, What should I run to do a more 'global' deauth attack?
-
just get to the airport at least 4 hours in advance, your gonna need it. :)
ONLY 4 hours? lol
-
I have heard a lot about how "Cell phones are unsafe" and it is possible to turn on the mic/camera to listen in. I was wondering if there is any open source version of this sort of program. There are a lot of spy things you can buy to "catch a cheating spouse" (not interested) and I have been playing with Georgia Weidman's botnet (http://www.grmn00bs.com/SMSbotPoC-complete.c and http://georgiaweidman.com/wordpress/more-android-sms-bot-stuff/). While this is both fun and useful I have had a tough time sifting through all the crapware out there to find anything that has some of the more "fun" functions that we all worry about.
I'd look into more into 'Bluetooth hacking'.
-
I was playing around with a phishing script I had made some time ago with PHP and noticed that the www.facebook.com AND facebook.com are treated differently with ettercap's DNS_SPOOF filter. So I setup the script to forward to www.facebook.com whist having the DNS spoofed on facebook.com only. This will cause an automatic redirection to the user's real profile.
This only works if the victim types "facebook.com" in the address bar, so the probability of this working is slightly slimmed down. Obviously this will only work if the user has a 'remember me' ticked on the computer beforehand, which is mostly the case.
Heres a vid. demo..
I can post the source/method here upon request :)
Youtube video:
"This video contains content from WMG, who has blocked it in your country on copyright grounds.
Sorry about that."
Also, I was wondering if it would work if the user uses https?
-
Or look into QR codes...
Which Alfa Adaptor To Get?
in Questions
Posted
I only own the AWUS036H wifi adapter which only supports b/g wireless networks (I'll probably buy the AWUS036NHA in the near future) , but after looking at the product pages it seems that the AWUS036NHA supports b/g/n networks, thus allowing you to possibly 'pick-up' or see more available networks for whatever reasons you may need. I know for a fact that the AWUS036H(b/g) works wonderfully with backtrack and the wifi pineapple. So I'm assuming that the AWUS036NHA (b/g/n) works well too since the product page says it can be used to 'piggy-back' with the wifi pineapple.
AWUS036H
AWUS036NHA
Hopefully that helps somewhat