Session Hijacking

Gmail SMS Verfication Loophole Exposed by HackingLoops

Hello friends, so the first day of the new year has come to an end and we all are safe (some rumors circulated that the world would be destroyed in 2012). HackingLoops is dedicating 2012 to online web security i.e. exposing the loopholes and fixing them, or escalating them to webmasters to fix.

Gmail is the world’s most famous free email service, and it’s a prominent part of the Google brand. Google is always quick to fix loopholes, like when I exposed the GX cookie loophole, where hackers could own a user’s Gmail account from cookies. Google provided a temporary solution to that loophole just 4 business days after I exposed it, and completely fixed it after a month. So friends, let me tell you about the new bug, so that Google will hopefully fix it as soon as possible.

hack gmail account password, Gmail mobile verification, SMS alerts

Gmail Mobile verification Loopholes

This is not just one loophole, but two big ones that I have discovered in the Gmail SMS verification and password reset method.

1. Mobile number as optional field

My knowledge of security norms leads me to conclude that Google should make the mobile phone verification mandatory, at least at the time of a new account’s creation. These would be the benefits:

a. Tracing a user will be easier: Hackers uses anonymous or fake Gmail accounts to access keylogger logs and send fake emails to users. If we have the mobile number of the Gmail account user, we can trace him in a matter of seconds.

b. The mobile number and its location should be validated using Google maps and the IP address used to register the account: Hackingloops is suggesting this because as a hacker, I always try to create a spoof account in which almost every detail is wrong. For complete traceability, it should be validated geographically. This is not a difficult task for a coder.

This loophole is a minor one in its category, but it will prove its worth when a hacker tries to hack something serious using a anonymous Gmail account. If Google realizes these things earlier, they can surely put a track on malicious users and monitor their day to day activity. Unfortunately, I said before, until I publicly expose these hacks, Google will not fix it.

2. Forgot Password SMS verification code message

This is an extremely dangerous loophole and can be heavily exploited using the Social Engineering technique. A few days ago, a client informed me that his Gmail account had been hacked. He told me that he is aware of these techniques, like key stroke logging or phishing that hackers use to hack email accounts. Below is the scenario between the Hackingloops client (who works in software firm) and myself:

Client: My Gmail account has been hacked.
Me (Lokesh): Have you gotten any emails?

Client: Yes, I get a lot of emails on a daily basis.
Me: I mean any suspicious or unsolicited, or Lottery Prize emails.

Client: Yes, lots of emails like that, but I never open any, and I haven’t opened any links from my email.
Me: Okay. It’s nice that you are aware of those scams. Maybe you installed a new application or software on your PC or got your hands on a hack tool.

Client: No, I haven’t installed anything in the last few weeks.
Me: Okay. Did you sign up for a new website.

Client: Yes, I signed on one website yesterday and after that I became unable to login to my account. But I don’t use the same password there that I use for my Gmail.
Me: Okay, how did you find this site? Did you find it in a browser or did someone refer you?

Client: Yeah, a person with an email ID like earnunlimitedmoney@gmail.com told me about that site. But today that site is also down.
Me: What was the website’s name.

Client: Something like “make money by displaying ads on your website.”
Me: Okay. Do you know the person with the email “earnmoneyunlimited@gmail.com.” Is he a friends of your’s?

Client: No, I just got his Gtalk invitation, a day back. But I have talked with him personally and he told me I would get 50% of his Google Adsense revenue for every article that I wrote on his website.
Me: Okay, did he ask anything special, like a registration or mobile verification code or anything similar?

Client: Yes, he told me that I would get a verification code from Google on my mobile phone, that I needed to provide him the code so that he could attach it with my Google Adsense account.
Me: Can you forward me that message?

The message that he received said “Your Google Verification code is 516826.” Take a second to think about what the message might have been.

Did you guess? It’s a Google verification code that you get when you select the FORGOT PASSWORD option and then enter your mobile number to get the password reset code.

This is an incredibly dangerous loophole, anybody can be fooled using this trick.

If any Gmail or Google employee is reading, please ask your boss to raise a change request for this.

I made the situation even worse. At this point, the hacker had reset my client’s passwords, and he was even smarter than I thought; he changed all of the recovery options, even the mobile number. My client had no chance to get his credentials back. But luckily, my client told me about the scenario and he got his account back, along with an apology from the hacker…after I hacked the hacker’s system using his IP address, which I got through readnotify. I will explain that procedure later someday, because its unethical to hack someone…

Let’s concentrate on loopholes, now consider my point:

Don’t you think the password reset message should contain a message such as: “the text password reset code is ___.” I had never thought such scenario could happen. Anybody can exploit this loophole. Google team, please correct these bugs. It won’t cost you much, but the ramifications are steep for an email user who has blind faith in you.

Some suggestions by HackingLoops:

1. For Gmail Password Reset:

The message can be something like

“Dear Gmail User(Name),

Your Gmail Password reset verification code is 123456″

“Dear user,

You have requested a password reset for your Google account (email). Your verification code is 123456″

Both of these are less than 100 characters and can easily be configured into Google’s SMS module.

2. If Google doesn’t want to change much of their functionality, then you can use something like:

Dear user(name),

You have requested a Password Reset verification code for account(email). Your code is 123456″

I think friends, you have all recognized these loopholes. Google stays on top of their publicly announced loopholes, so let’s see how quickly they fix this one.

Stay connected with Hackingloops and keep getting the latest security updates and tricks.

Hack email accounts or passwords using session cookies

Today I will be exploring how to hack email and passwords for many websites using session cookies. In my previous article, I described session hijacking. Today, I will show you the practical implementation of session hijacking, that is how can we take over other user’s sessions and hack their email accounts and other website passwords. In this tutorial, hacking email accounts using session cookies, I will utilize a yahoo account.

What are Session Cookies or Magic Cookie or Session ID?

Let’s first discuss this in very simple terms. Whenever we login into our account, it generates a unique string that contains the path of automatic login for a particular time. After that limited time passes, it expires by itself.
Note: its life is only up to when your web browser is open. If you close your web browser, this will be deleted (this has a recent upgrade in the cookie’s field that provides more security).
Now this unique string, or “Magic Cookie,” is stored in two places. The first copy is stored on the server (which we cannot do anything about) and the second is stored in our web browser in the form of a cookie.
This cookie is destroyed by three ways. First when you close your web browser, second when you sign out of your account, and third if you leave your account idle for more than 20 minutes.

How to access the cookies on local system?

As I said above, this tutorial is for hacking Yahoo email account. In your web browser, open yahoo.com and login into your account.
After that, type the below code exactly as is and press enter:

javascript:alert(document.cookie);

Now a popup box will appear showing the cookies something like this:

Create one fake account on yahoo.com and login to that account and retrieve the cookie in the same manner, and notice the changes in session ID’s.

For hacking the session cookies we first need the session cookies of the victim, which are quite simple to obtain. You just need to send him one link; as soon as he clicks on it we will get his session cookie.

After hacking the session cookies, we can use stolen session cookie to login into victim’s account even without providing the username and password – as I already explained, session hacking removes the authentication on the server as we have the AUTO LOGIN cookie. In this type of attack, when victim signs out, the hacker will also sign out. But in the case of Yahoo, things are a little different. When victims sign out, the attacker still has access to his account. Yahoo maintains the session for 24 hours and then destroys the session ID’s from its server.

How to Steal the Session Cookies?

1. Go to any Free Web hosting server website which supports PHP and register.

2. Download the Cookie stealer files:

http://www.mediafire.com/?q4oo0encvhtxoa1

3. Now upload the four files onto the website and create one empty directory named “Cookies” as shown below:

hack session cookies using cookie stealer

4. Now send the link of yahoo.php to your victim. When the user clicks on the yahoo.php, the cookies get stored into directory Cookies and simultaneously the victim is redirected to his account.

5. Open the link Hacked.PHP to access the cookies. In my files the password is “password.” You need to put that in to access the files.

6. You must have gotten the username of the victim’s account. Simply click on it, and it will take you to the inbox of the victim’s Yahoo account without asking for any password.

Now it doesn’t matter if the victim signs out from his account, you will remain logged into it.

Note: You can try this attack by using two browsers. Sign into a yahoo account on one browser and run the code. Then sign in through another browser using stolen session.

In my next article, I will explain how to decode cookies. In this tutorial, you will only get the cookies which are encrypted. You will be able to login but you will not know what information it contains. As we are professional hackers we must know each and everything, so wait till next article..

Hope you all have liked it…. IF you have any queries ask me….

Please comment…

Session Hijacking : How to hack online Sessions

Hello friends, i am back and from now onwards we will explore the most advanced Hacking Techniques. One of them is Session Hijacking. In today’s tutorial we will discuss How to hack the online sessions using Session Hijacking. In today’s Hacking class, i will explain basics of Session Hijacking like What is session Hijacking and Different types of Session Hijacking attacks and different methods to Hijack the sessions. In my next tutorial that is tomorrow i will explain you in Detail How to Hijack the Sessions and what tools you will need to Hijack the active sessions. So friends read on…

How to hack online sessions, session hijacking

How Session Hijacking works

What is Session Hijacking?

Let’s discuss them in common term’s, Session Hijacking by the name only it suggests that we are hacking someone’s active session and trying to exploit it by taking the unauthorized access over their computer system or Network. So Session Hijacking is the exploitation of valid computer or network session. Sometimes technical guys also call this HTTP cookie theft or more correctly Magic Cookie Hack. Now you guys surely be thinking what is Magic Cookie.

Magic cookie is simply a cookie that is used to authenticate the user on remote server or simply computer. In general, cookies are used to maintain the sessions on the websites and store the remote address of the website. So in Session Hijacking what Hacker does is that he tries to steal the Magic cookies of the active session that’s why its called HTTP cookie Theft. Nowadays several websites has started using HTTPS cookies simply called encrypted cookies. But we all know If encrypter exits so its decrypter also :P..

Session Hijacking is the process of taking over a existing active session. One of the main reason for Hijacking the session is to bypass the authentication process and gain the access to the machine. Since the session is already active so there is no need of re-authenticating and the hacker can easily access the resources and sensitive information like passwords, bank details and much more.

Different Types of Session Hijacking

Session Hijacking involves two types of attacks :

1. Active attack

2. Passive attack

In Passive attack, the hacker Hijacks a session, but just sits back and watches and records all the traffic that is being sent from the computer or received by the computer. This is useful for finding the sensitive information like username passwords of websites, windows and much more…

In Active attack, hacker finds the active session and takes over it. This is done by forcing one of the parties offline which is usually achieved by DDOS attack (Distributed Denial of service attack) . Now the hacker takes control over the active session and executes the commands on the system that either give him the sensitive information such as passwords or allow him to login at later time.

There are also some hybrid attacks, where the attacker watches a session for while and then becomes active by taking it over. Another way is to watch the session and periodically inject data into the active session without actually taking it over.

Methods to Hijack Sessions

There are four main methods used to perpetrate a session hijack. These are:

Session fixation, where the attacker sets a user’s session id to one known to him, for example by sending the user an email with a link that contains a particular session id. The attacker now only has to wait until the user logs in.
Session sidejacking, where the attacker uses packet sniffing to read network traffic between two parties to steal the session cookie. Many web sites use SSL encryption for login pages to prevent attackers from seeing the password, but do not use encryption for the rest of the site once authenticated. This allows attackers that can read the network traffic to intercept all the data that is submitted to the server or web pages viewed by the client. Since this data includes the session cookie, it allows him to impersonate the victim, even if the password itself is not compromised. Unsecured Wi-Fi hotspots are particularly vulnerable, as anyone sharing the network will generally be able to read most of the web traffic between other nodes and the access point.
Alternatively, an attacker with physical access can simply attempt to steal the session key by, for example, obtaining the file or memory contents of the appropriate part of either the user’s computer or the server.
Cross-site scripting, where the attacker tricks the user’s computer into running code which is treated as trustworthy because it appears to belong to the server, allowing the attacker to obtain a copy of the cookie or perform other operations.

That’s all for today tomorrow we will discuss in detail How to do the Session Hijacking practically.

I hope you all like this…

If you have any queries ask me in form of comments…