Transcription
One, two, three, four. A question I get asked all the time is, "Can you help me hack into something?" Probably the easiest way to hack into anything is just to get the password and log into it. So, I thought I'd give you 64 ways to get someone's password in 17 minutes. Oh, and as a disclaimer, don't do any of this unless you have permission.
Probably the most effective way of getting someone's password is just to steal their computer or steal their phone or tablet. This is sometimes called the "evil maid attack" because once you have physical access to their computer, the chances of you being able to get into their accounts is much higher. Sometimes there's no password on their device, and you could just get in. Who knows? Maybe they're already logged into the account you want to access, or their credentials are cached, and you're in.
You could just ask for their password. Jimmy Kimmel demonstrated how to do this on TV: "You mean to give my password right now?" "No, I cannot do that. It is my dog's name and the year I graduated from high school, like my cat's name, and then just like a random number."
Maybe the place you are in has already been breached before. You can go onto breach forums and just buy the passwords you want. If you can't find the database you're trying to get into, a lot of people reuse passwords. So, maybe get into the contents of a different database, see if their password is in that, and then use it to try to get into the one you want to access.
You can try to brute force your way in. Tools like Burp Suite or Hydra can try to log into a website over and over, each time trying a different password, starting with maybe AAA, then AAB, and then AAC, and then going down the line until it finds a match. If you could somehow get the password hash, like by grabbing the contents of Windows System32 config SAM, where hashes are stored, then you can try to brute force the hash using tools like John the Ripper or Hashcat.
Sometimes it's easier to get into a higher-level account. If you can get root access to a Linux computer, then you can reset the password for any user on that machine or see their private keys. Or, if you can get admin access or help desk access, you can then go in and reset any user's password in the whole AD database. If you can get in as the website admin, you can reset any user's password that way. Or, if you can get into the database directly, you could reset someone's password using SQL commands. Heck, if you can get into the database, you might just be able to see the password itself there; sometimes it's stored in plain text.
You might wonder, "How the hell am I going to get into a database of a company in the first place?" Well, you just need network access to it and then find a vulnerability on it or a password for it and then exploit it or get into it. Many times, I've seen people go onto the website Shodan, and they find open MongoDB databases that are just open, sitting on the internet for anyone to read the entire contents of.
Or, you could go into a website and try to do an SQL injection. This is where the website and database servers just aren't secure, and they allow too much user input from the website. Yeah, entire databases have been dumped through SQL injections. Another way to get into a database is to comb through any code that you might find on the website or app. A lot of times, credentials are hard-coded in programs or within the app somewhere.
You can also look to see if there are any open AWS instances that expose the code base and then dive in there looking for any sort of database credentials. Or, you can look through GitHub repos searching for usernames and passwords in there. Unfortunately, a lot of private API keys and passwords are discovered on GitHub, just posted right there in public for anyone to see. An API key, if you can get that, is often just as good as a password.
Sometimes, even an inspection of the app itself, using something like the strings command or looking through the plist files, may just contain a password sitting right there in plain text for you to use. Actually, you might just be able to right-click and view source and look through the code right on the website and find something like a vulnerability or password or API key. An API key can get you data from a website, such as a password or other user data.
Getting a private key is sometimes all you need, but you could also try exploiting an API directly. Sometimes, you can trick APIs into sending you more data than what you should be allowed to see, and we've seen some major breaches that were supposedly just data from insecure APIs. Oh yeah, and if you can get into a data center physically and steal a database server and bring it home, you could probably get into it eventually. It might be as simple as just pulling out the hard drive and putting it in your own computer and trying to read it that way.
Thank you. Okay, so what else? Oh yeah, if you're on the same Windows computer as the person whose password you want to steal, you could try to run Mimikatz. This is a tool that can extract other users' passwords out of memory. If you're on the same local subnet as another user, you could run a tool called Responder, which will act like a shared drive on the network. Other computers will see it and try to connect, but Responder will first ask them to authenticate. This is where another computer will show you their password hash, and you can just grab that and try to crack it.
Sometimes, just passing the hash is good enough to log into something, and you don't actually need a password. Or maybe you run Responder and get the password of another user, not the one you're trying to get. Well, if you have that, you might want to try to log in as them, see if they have some sort of extra privileges, like maybe they're an admin. If they are, then that would give you the ability to take over whoever's account you want.
Hey, maybe the domain admin password wasn't what you wanted, but if you had that, this can get you access to other accounts that might help you get into what you do want. Or maybe this password is reused in other places, or maybe it shows you a clue of what the passwords might look like. If you want someone's Wi-Fi password and you're near their device, you can get something called a Wi-Fi pineapple, which will act like their Wi-Fi network and ask them for their Wi-Fi password, and their devices might give it.
Speaking of Wi-Fi passwords, if you're in range, you can get tools like Aircrack-ng to try to watch Wi-Fi traffic and try to crack the password on some networks. Talk about insiders! Imagine if you knew someone who worked at Facebook who could reset any user's password for you. They might charge you a fee, but that's one way to get a password, right?
Take a look at this: this is a picture someone sent me of an insider who works at Taco Bell, showing that for 30 bucks, they'll reset any Taco Bell user's account. This picture is of their terminal, showing that they have access to do these things. There are a lot of different kinds of insiders; you just gotta know people. Nation-state actors do something similar with what's called a "seeding operation," where they recruit someone who's about to go work for a company and help them get hired there, then use their inside access to carry out tasks that will help the government.
Like, the CIA might seed someone into a company and then ask them for passwords or internal data or something. Another thing I've heard nation-state actors do is set up surveillance systems on certain targets and spy on them, such as planting microphones and listening to conversations or using long-range photography to see what they're doing on a computer. Take a look through the NSA's ANT catalog for an example to see some wild and crazy tools that could absolutely be used to steal a password.
I saw this article the other day; supposedly, you could just turn the mic on your phone and record when somebody types in their password, and that might be enough information to decode what buttons were pressed. Here's another crazy article about someone using thermal cameras to watch what keys got warmer when someone was typing on there.
Let's talk about tricking your target. This is sometimes called phishing or social engineering or just scamming them. There are hundreds of ways to trick the user into giving you their password. One method is to install a keylogger on your computer and then get them to use your computer to log into something of theirs. With a keylogger on your computer, you can then go back and see what keys they typed when they typed in their password to a website.
You can try shoulder surfing, watching their fingers hit the keys as they type their password. You should probably practice this before doing it, as it takes a bit to learn. I mean, for some reason, others like to watch this video and try to guess what Kanye's password is.
You could set up a fake look-alike website using a tool like the Social Engineering Toolkit. With this, you can set up a totally fake website and then give them the link to make it look like they're logging into their account, but it's a fake website. When they try to log in, it captures that password that they typed in and sends it to you.
You can try to call the person up and just try to trick them into telling you their password, like, "Hello, I'm calling from Microsoft customer support. We see some suspicious activity on your account. I can fix it, but first, I need you to verify your password." This kind of trickery can work very well; it might be the easiest way to get someone's password.
You could also call up the place that you're trying to access and act like you're the target you're trying to access, asking the company to reset your password. You're acting like you're them, and now if you can get them to do that, you can access their account. You can also try looking on their desk under their keyboard or in their wallet; the password just might be written down somewhere.
If you're the CEO of a company and you're dumb enough to leave your login info on a Post-It note on your desk, it's not a hack; it's barely social engineering. If they don't physically write it down, you could try looking through their files, Dropbox, Google Drive, local storage, or network storage. People sometimes think it's a safe place to store their passwords in some file somewhere.
You could also try to get a victim to install a keylogger on their machine. Maybe you trick them into installing something like a chat program or game that they want to play, but really it's a keylogger, which captures all their keystrokes and then sends them to you. You can eventually see what passwords they type when they finally do.
Speaking of keyloggers, there are USB keyloggers too. If you could just walk by someone's computer and plug it in, it'll capture all the keystrokes that person types and stores it on the USB drive. Then, you just need to walk by later and pull it out. There are also other tools, such as the Rubber Ducky and the OMG cable, that look like ordinary cables and USB drives. When you plug them in, they inject keystrokes into the computer.
You could plug it in, and it might do something like grab a dump of the memory or hash table, and then you can unplug it and try to look through that data for a password. Or maybe you could just attack their device over the network because maybe it's insecure somehow. If you can identify a vulnerability and use that exploit to get yourself access to their device, once you get on their device, you can do things like install your own keylogger or sift through their files looking for the password.
A lot of people use password managers now, which I recommend. I think it's a good idea, but what this is is a secure database where all your passwords are in one place and it's protected by a single password. So, if you can get their password manager's master password, you can have access to everything.
Another thing that would give you tons of data is their email. If you can't get into where you need to go, but you can get into their email inbox, then you can just reset their password, which will typically send them a link to their email. Then, you can just click the link and reset it to whatever you want. This is so effective that what some people do is go right for attacking the email when they need to get into someone else's account.
Like, they'll call up Google or Microsoft and pretend to be that person that they want access to and trick Google into resetting the Gmail password. A lot of times, the password is just something you can guess. A lot of people use their dog's name or grandma's name or something close to them.
Here's Gilfoyle doing it on the show Silicon Valley: "I was social engineering them." Then, that information is entered into a word list generator, popped with their hash into John the Ripper, and within minutes, you have their passwords. You don't have to social engineer them; you can sometimes just look at what they publish online and build a word list that way.
They might talk a lot on social media about the things they love or their private life, which can all be gathered for someone to try to guess what their password might be. To give you a clearer idea, when pen testers are tasked with seeing if a company's users have weak passwords, they'll try to crack the hashes of all the users in the whole company.
What they've learned that helps them find weak passwords is to throw a whole bunch of culturally relevant words into the word list that they'll be guessing from, such as local school names, local sports teams, local street names, local restaurants, city names, or things that are related to the company, like the name of the company or its mascot or address. It's sick how many employees use their own company name as their password.
Also, take a look at the most common passwords seen today; there's a high chance it might be just one of those. People will often use the simplest password they can. Thank you.
Sometimes, websites have weak reset or password policies. I've seen a website once reset the password to a new four-character password that the website chose for me. If you can reset a user's password to four characters, it'll be pretty easy to brute force that afterward. If you know where the person works that you're trying to hack into, you could call up their help desk and pretend to be that person that you want to access and ask for a password reset. You might be able to trick them into changing it for you to whatever you choose.
Sometimes, you don't need their passwords; sometimes you can just steal a session cookie, which will make it seem like you're already logged in without even providing a password. Recently, I had someone try to trick me into sending them my Discord logs, which contained my session data. If I would have sent this to them, they would have been able to log in as me on Discord, even though I have two-factor authentication turned on.
You know, when I talked with this person, they told me about another trick they use, which is to send people fake Dino links on Discord, which looks like you're authenticating to a Discord Dyno, but in reality, you just gave them access to your account, which works even if you have two-factor authentication turned on.
I've seen people get into someone else's account simply by telling the website that they are a different user. Since the website saw that they have already authenticated, it just lets them switch users to someone else. This obviously relies on the website being poorly coded and insecure for it to work.
Private keys are a whole other thing. If you can get a private key, it's often just as good as a password, and private keys are typically too hard to memorize, so they've got to be stored somewhere. Where are they stored? You can look around for them and try to find them. When someone types their password in, it's usually shown in asterisks on the screen, right? But in some situations, you can right-click and do "inspect element" to see what the password looks like in clear text.
You can also try looking through cached data to see if a password is saved somewhere on their device. A lot of times, the password is left as default too, so always try default passwords like maybe admin/admin or root/root or admin/password. If you're on the same network as them, you might be able to act as a proxy, start intercepting all the traffic on your network, and inspect all their traffic that they're sending or receiving.
Or intercept their traffic with something like a LAN tap. Somewhere in the traffic is their password or session cookie, and it's just a matter of finding it. Instead of getting the password for the target that you want, it might be possible to attack a third party. Maybe if you can get into their Apple account, that might get you into their phone, and then once you're in their phone, you can get into the other account you want.
Or you could just extort them, threaten them, or attack them. There's something called a "wrench attack," where it doesn't matter how much security you have; if somebody is banging you in the head with a wrench over and over, that might be enough for you to give up your password.
I've got it all right here with a bow on it. Now, I want to emphasize: don't go stealing people's passwords and logging into their accounts, accessing their data. You could get in a lot of trouble for doing that. The point I'm trying to make here is that there are a lot of ways that someone can get into your accounts, and it should be clear at this point that your password is a weak link when it comes to securing your stuff.
I just mentioned 64 ways of getting into your accounts, but with enough creativity, time, and resources, this list can grow really long. It's important to take your own security seriously, so use long, complex passwords, use a different password on every website you have an account on, and I recommend using a password manager. Use two-factor authentication where available, and always be extremely careful of where you're logging in or who you're giving your password to, so that you don't accidentally hand your password to the wrong person or site. Good luck and stay safe.