TUTORAL - How To Hack Instagram, Facebook, Hotmail, Yahoo! and Apple/iCloud Accounts!

Apple Account/iCloud Hacking:
This requires being FB friends with the person you want to hack, or having their email and birthday used with their account.

Steps:
1) First create a Yahoo! Mail Account.
2) Import your FB friends as contacts.
3) Search for them in contacts and copy their email address.
4) Go to https://iforgot.apple.com/password/verify/appleid and enter the email. After that click answer security questions and go onto the next page.
5) Search for their email on FB.
6) Go to their profile, about, overview and enter their birthday.
7) You will be greeted with their security questions. Get them right, and you're in. Unlike Facebook, answering their security questions and resetting their password will not result in a 24 hour lock. If they have iCloud installed, you will be able to browse everything on their device which is synced to iCloud. Unless they have two-factor verification (optional security feature).

If they have two-factor verification, simply follow this guide:

http://blog.crackpassword.com/2013/05/ap...he-icloud/

Or just keep guessing the code. There is only 9999 possible combinations :P

8) Optional. Go to https://apps.facebook.com/f-search-app/ then install the app, select all content, choose the person who you want to hack from the drop-down, and browse for a specific keyword and see if there are any matches. This helps in answering their SQ's.

Instagram Private Photo Hacking - $5


Hotmail Hacking (Credit: Spirits)
I recently discovered if you can trick a user into sending you two emails from the account you want to hack, you can hack their entire account. Here is how.

You need:

The email address you want to hack
Two emails received from that email
The receivers email address
The subjects of both emails received
The birthday of the user you want to hack
The first and last name of the user you want to hack.
The country the person you want to hack lives in.

Go to: https://account.live.com/acsr?mn=&sol=mx...&mkt=en-us and enter the email you want to hack.

Then enter their first name, last name, birthday and country.

Enter the subjects for both emails in the boxes, followed by entering the email address that received the emails.

Soon enough the email should be hacked! :P

Hacking Yahoo! Mail Accounts (Credit: Sedulous)

What is needed:
The name of the person who owns the account
Mobile phone number on the account
The date of birth on the account
A phone to call with
1) Go to https://login.yahoo.com/ and click "I can't access my account."
2) Then click on "I have a problem with my password."
3) Type in the Yahoo! Mail email address you want to hack.
4) Make sure the mobile number is correct by looking at the last two digits.
5) Click "Contact Customer Service."
6) Call Yahoo (800-730-2669), wait for an operator, enter the reference number, say that the email is linked to your Xbox account and you forgot the password because you haven't logged in for such a long time. They will ask you for the account name, birthday, and date of birth. If you get them right they will ask you for an email to send the new password to.

Hacking Snapchat Accounts
Essentially the same as the Apple account/iCloud method, just use their iCloud to access their Snapchat app.

Hacking Facebook accounts

Suggested:

2 TB external hard-drive
Ubuntu installed via Wubi

Using the emails obtained via Yahoo, select to send an email to your contacts. In the dialog of all the emails select all of them using Ctrl + A, turn them into a working userlist (paste into Notepad, format each email/line properly) and then go here: https://www.youtube.com/watch?v=1xcDbSOA-ZQ

And use Crunch via the cmd.exe (it is best to update it with your own cmd.exe)

The best commands are:

Code:

crunch 6 10 -f charset.lst lalpha > wordlist.txt

And:

Code:

crunch 1 8 -f charset.lst numeric > numbers.txt

Then use those wordlists and the userlist against the accounts.

Wait for the entire numeric wordlist to complete, and stop the lalpha wordlist at a file size of around 500 GB. 

I also suggest downloading an English dictionary, name wordlist, species wordlist and using those as well.

To change the first character case per line from upper to lower, or the inverse, install WLM's DEB via Ubuntu installed via Wubi. You can also append numbers from 0-9999 to the end of each line in a wordlist.



Or... use the persons iCloud account and access their FB app.

Or... use ARP Spoofing.

The Live Cd List by Yamagata

Live Cd List For Hacking And Exploitation Compiled By YamaGata

cudaHashcat or oclHashcat or Hashcat on Kali Linux got built-in capabilities to attack and decrypt or Cracking WPA2 WPA with Hashcat – handshake .cap files. Only constraint is, you need to convert a .cap file to a .hccap file format. This is rather easy.

Hashcat

Hashcat is the self-proclaimed world’s fastest CPU-based password recovery tool. It is available free of charge, although it has a proprietary codebase. Versions are available for Linux, OSX, and Windows and can come in CPU-based or GPU-based variants. Hashcat currently supports a large range of hashing algorithms, including: Microsoft LM Hashes, MD4, MD5, SHA-family, Unix Crypt formats, MySQL, Cisco PIX, and many others.

Hashcat has made its way into the news many times for the optimizations and flaws discovered by its creator, which become exploited in subsequent hashcat releases. (For example, the flaw in 1Password’s hashing scheme.)

Attack types

Hashcat offers multiple attack modes for obtaining effective and complex coverage over a hash’s keyspace. These modes are:

• Brute-Force attack
• Combinator attack
• Dictionary attack
• Fingerprint attack
• Hybrid attack
• Mask attack
• Permutation attack
• Rule-based attack
• Table-Lookup attack
• Toggle-Case attack

The traditional bruteforce attack is considered outdated, and the Hashcat core team recommends the Mask-Attack as a full replacement.

Variants

Hashcat comes in two main variants:

• Hashcat – A CPU-based password recovery tool
• oclHashcat – A GPU-accelerated tool

Many of the algorithms supported by Hashcat can be cracked in a shorter time by using the well-documented GPU-accelerationleveraged in oclHashcat (such as MD5, SHA1, and others). However, not all algorithms can be accelerated by leveraging GPUs. Bcrypt is a good example of this. Due to factors such as data dependant branching, serialization, and Memory (to name just a few), oclHashcat is not a catchall replacement for Hashcat.

Hashcat is available for Linux, OSX and Windows. oclHashcat is only available for Linux and Windows due to improper implementations in OpenCL on OSX

Important Note: Many users try to capture with network cards that are not supported. You should purchase a card that supports Kali Linux including injection and monitor mode etc. A list can be found in 802.11 Recommended USB Wireless Cards for Kali Linux. It is very important that you have a supported card, otherwise you’ll be just wasting time and effort on something that just won’t do the job.

Contents [hide]

• Hashcat
  • Attack types
  • Variants
    • My Setup
      • NVIDIA Users:
      • AMD Users:
    • Why use Hashcat for cracking WPA WPA2 handshake file?
      • Built-in charsets
      • Numbered passwords
      • Letter passwords – All uppercase
      • Letter passwords – All lowercase
      • Passwords – Lowercase letters and numbers
      • Passwords – Uppercase letters and numbers
      • Passwords – Mixed matched with uppercase, lowercase, number and special characters.
      • Passwords – when you know a few characters
    • Capture handshake with WiFite
    • Cleanup your cap file using wpaclean
    • Convert .cap file to .hccap format
    • Cracking WPA2 WPA handshake with Hashcat
    • Dictionary attack
    • Brute-Force Attack
      • Sample:
      • Sample .hcmask file
    • Location of Cracked passwords
    • Conclusion
      • Cracking Wifi WPA/WPA2 passwords
    • Related

My Setup

I have a NVIDIA GTX 210 Graphics card in my machine running Kali Linux 1.0.6 and will use rockyou dictionary for most of the exercise. In this post, I will show step on Cracking WPA2 WPA with Hashcat (handshake files) (.cap files) with cudaHashcat or oclHashcat or Hashcat on Kali Linux.

I will use cudahashcat command because I am using a NVIDIA GPU. If you’re using AMD GPU, then I guess you’ll be using oclHashcat. Let me know if this assumptions is incorrect.

To enable GPU Cracking, you need to install either CUDA for NVIDIA or AMDAPPSDK for AMD graphics cards. I’ve covered those in in my previous posts.

NVIDIA Users:

1. Install proprietary NVIDIA driver on Kali Linux – NVIDIA Accelerated Linux Graphics Driver
2. Install NVIDIA driver kernel Module CUDA and Pyrit on Kali Linux – CUDA, Pyrit and Cpyrit-cuda

AMD Users:

1. Install AMD ATI proprietary fglrx driver in Kali Linux 1.0.6
2. Install AMD APP SDK in Kali Linux
3. Install Pyrit in Kali Linux
4. Install CAL++ in Kali Linux

Why use Hashcat for cracking WPA WPA2 handshake file?

Pyrit is the fastest when it comes to cracking WPA2 WPA handshake files. So why are we using Hashcat to crack WPA2 WPA handshake files?

1. Because we can?
2. Because Hashcat allows us to use customized attacks with predefined rules and Masks.

Now this doesn’t explain much and reading HASHCAT Wiki will take forever to explain on how to do it. I’ll just give some examples to clear it up.

Hashcat allows you to use the following built-in charsets to attack a WPA2 WPA handshake file.

Built-in charsets

?l = abcdefghijklmnopqrstuvwxyz
?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ
?d = 0123456789
?s = !”#$%&'()*+,-./:;⇔?@[\]^_`{|}~

?a = ?l?u?d?s

Numbered passwords

So lets say you password is 12345678. You can use a custom MASK like ?d?d?d?d?d?d?d?d

What it means is that you’re trying to break a 8 digit number password like 12345678 or 23456789 or 01567891.. You get the idea.

Letter passwords – All uppercase

If your password is all letters in CAPS such as: ABCFEFGH or LKHJHIOP or ZBTGYHQS ..etc. then you can use the following MASK:

?u?u?u?u?u?u?u?u

It will crack all 8 Letter passwords in CAPS.

Letter passwords – All lowercase

If your password is all letters in lowercase such as: abcdefgh or dfghpoiu or bnmiopty..etc. then you can use the following MASK:

?l?l?l?l?l?l?l?l

It will crack all 8 Letter passwords in lowercase. I hope you now know where I am getting at.

Passwords – Lowercase letters and numbers

If you know your password is similar to this: a1b2c3d4 or p9o8i7u6 or n4j2k5l6 …etc. then you can use the following MASK:

?l?d?l?d?l?d?l?d

Passwords – Uppercase letters and numbers

If you know your password is similar to this: A1B2C3D4 or P9O8I7U6 or N4J2K5L6 …etc. then you can use the following MASK:

?u?d?u?d?u?d?u?d

Passwords – Mixed matched with uppercase, lowercase, number and special characters.

If you password is all random, then you can just use a MASK like the following:

?a?a?a?a?a?a?a?a

Note: ?a represents anything …. I hope you’re getting the idea.

If you are absolutely not sure, you can just use any of the predefined MASKs file and leave it running. But yeah, come back to check in a million years for a really long password …. Using a dictionary attack might have more success in that scenario.

Passwords – when you know a few characters

If you somehow know the few characters in the password, this will make things a lot faster. For every known letter, you save immense amount of computing time. MASK’s allows you to combine this. Let’s say your 8 character password starts with abc, doesn’t contain any special characters. Then you can create a MASK rule file to contain the following:

abc?l?l?l?l?l
abc?u?u?u?u?u
abc?d?d?d?d?d
abc?l?u??d??d?l
abc?d?d?l?u?l

There will be 125 combinations in this case. But it will surely break it in time. This is the true power of using cudaHashcat or oclHashcat or Hashcat on Kali Linux to break WPA2 WPA passwords.

You can even up your system if you know how a person combines a password. Some people always uses UPPERCASE as the first character in their passwords, few lowercase letters and finishes with numbers.

Example: Abcde123

Your mask will be:

?u?l?l?l?l?d?d?d

This will make cracking significantly faster. Social engineering is the key here.

That’s enough with MASK’s. Now let’s capture some WPA2 WPA handshake files. Following WiFite section was taken from a previous guide Cracking Wifi WPA2 WPA passwords using pyrit cowpatty in Kali Linux which was one of the best guides about cracking Wifi passwords out there.

Capture handshake with WiFite

Why WiFite instead of other guides that uses Aircrack-ng? Because we don’t have to type in commands..

Type in the following command in your Kali Linux terminal:

wifite –wpa

You could also type in

wifite wpa2

If you want to see everything, (wep, wpa or wpa2, just type the following command. It doesn’t make any differences except few more minutes

wifite

Once you type in following is what you’ll see.

So, we can see bunch of Access Points (AP in short). Always try to go for the ones with CLIENTS because it’s just much faster. You can choose all or pick by numbers. See screen-shot below

Awesome, we’ve got few with clients attached. I will pick 1 and 2 cause they have the best signal strength. Try picking the ones with good signal strength. If you pick one with poor signal, you might be waiting a LONG time before you capture anything .. if anything at all.

So I’ve picked 1 and 2. Press Enter to let WiFite do it’s magic.

Once you press ENTER, following is what you will see. I got impatient as the number 1 choice wasn’t doing anything for a LONG time. So I pressed CTRL+C to quit out of it.

This is actually a great feature of WIfite. It now asks me,

What do you want to do?

1. ontinue attacking targets
2. [e]xit completely.

I can type in c to continue or e to exit. This is the feature I was talking about. I typed c to continue. What it does, it skips choice 1 and starts attacking choice 2. This is a great feature cause not all routers or AP’s or targets will respond to an attack the similar way. You could of course wait and eventually get a respond, but if you’re just after ANY AP’s, it just saves time.

And voila, took it only few seconds to capture a handshake. This AP had lots of clients and I managed to capture a handshake.

This handshake was saved in /root/hs/BigPond_58-98-35-E9-2B-8D.cap file.

Once the capture is complete and there’s no more AP’s to attack, Wifite will just quit and you get your prompt back.

Now that we have a capture file with handshake on it, we can do a few things.

Cleanup your cap file using wpaclean

Next step will be converting the .cap file to a format cudaHashcat or oclHashcat or Hashcat on Kali Linux will understand.

Here’s how to do it:

To convert your .cap files manually in Kali Linux, use the following command

wpaclean <out.cap> <in.cap>

Please note that the wpaclean options are the wrong way round. <out.cap> <in.cap> instead of <in.cap> <out.cap> which may cause some confusion.

In my case, the command is as follows:

wpaclean hs/out.cap hs/BigPond_58-98-35-E9-2B-8D.cap

Convert .cap file to .hccap format

We need to convert this file to a format cudaHashcat or oclHashcat or Hashcat on Kali Linux can understand.

To convert it to .hccap format with “aircrack-ng” we need to use the -J option

aircrack-ng <out.cap> -J <out.hccap>

Note the -J is a capitol J not lower case j.

In my case, the command is as follows:

aircrack-ng hs/out.cap -J hs/out

Cracking WPA2 WPA handshake with Hashcat

cudaHashcat or oclHashcat or Hashcat on Kali Linux is very flexible, so I’ll cover two most common and basic scenarios:

1. Dictionary attack
2. Mask attack

Dictionary attack

Grab some Wordlists, like Rockyou.

Read this guide Cracking Wifi WPA2 WPA passwords using pyrit cowpatty in Kali Linux for detailed instructions on how to get this dictionary file and sorting/cleaning etc.

First we need to find out which mode to use for WPA2 WPA handshake file. I’ve covered this in great length in Cracking MD5, phpBB, MySQL and SHA1 passwords with Hashcat on Kali Linux guide. Here’s a short rundown:

cudahashcat --help | grep WPA

So it’s 2500.

Now use the following command to start the cracking process:

cudahashcat -m 2500 /root/hs/out.hccap /root/rockyou.txt

Bingo, I used a common password for this Wireless AP. Took me few seconds to crack it. Depending on your dictionary size, it might take a while.

You should remember, if you’re going to use Dictionary attack, Pyrit would be much much much faster than cudaHashcat or oclHashcat or Hashcat. Why we are showing this here? Cause we can. :)

Another guide explains how this whole Dictionary attack works. I am not going to explain the same thing twice here. Read Cracking MD5, phpBB, MySQL and SHA1 passwords with Hashcat on Kali Linux for dictionary related attacks in full length.

Brute-Force Attack

Now this is the main part of this guide. Using Brute Force MASK attack.

To crack WPA WPA2 handshake file using cudaHashcat or oclHashcat or Hashcat, use the following command:

Sample:

cudahashcat -m 2500 -a 3 capture.hccap ?d?d?d?d?d?d?d?d

Where -m = 2500 means we are attacking a WPA2 WPA handshake file.

-a = 3 means we are using Brute Force Attack mode (this is compatible with MASK attack).

capture.hccap = This is your converted .cap file. We generated it using wpaclean and aircrack-ng.

?d?d?d?d?d?d?d?d = This is your MASK where d = digit. That means this password is all in numbers. i.e. 7896435 or 12345678 etc.

I’ve created a special MASK file to make things faster. You should create your own MASK file in similar way I explained earlier. I’ve saved my file in the following directory as blackmoreops-1.hcmask.

/usr/share/oclhashcat/masks/blackmoreops-1.hcmask

Do the following to see all available default MASK files provided by cudaHashcat or oclHashcat or Hashcat:

ls /usr/share/oclhashcat/masks/

In my case, the command is as follows:

cudahashcat -m 2500 -a 3 /root/hs/out.hccap  /usr/share/oclhashcat/masks/blackmoreops-1.hcmask

Sample .hcmask file

You can check the content of a sample .hcmask file using the following command:

tail -10 /usr/share/oclhashcat/masks/8char-1l-1u-1d-1s-compliant.hcmask

Edit this file to match your requirement, run Hashcat or cudaHashcat and let it rip.

Location of Cracked passwords

Hashcat or cudaHashcat saves all recovered passwords in a file. It will be in the same directory you’ve ran Hashcat or cudaHashcat or oclHashcat. In my case, I’ve ran all command from my home directory which is /root directory.

cat hashcat.pot

Conclusion

This guide explains a lot. But you should read read Wiki and Manuals from www.hashcat.net to get a better understanding of MASK and Rule based attacks because that’s the biggest strength of Hashcat.