[王子様Xero]

Hello HackCommunity!

Is there anything worse than finding out you have been infected a keylogger? Ever want to find the source of your misery? Well hopefully this tutorial will help you! This method will work a lot of the time but not if the enemy is skilled enough to hide his tracks. Someone with a lot more skill in network analysis could do a better job, but that's not me or the average user. This will work fine!

Keyloggers: What Are They?

I'm going to leave Wikipedia explain this one:

Keystroke logging (more often called keylogging or "keyloggers") is the action of tracking (or logging) the keys struck on a keyboard, typically in a covert manner so that the person using the keyboard is unaware that their actions are being monitored. It also has very legitimate uses in studies of human-computer interaction. There are numerous keylogging methods, ranging from hardware and software-based approaches to electromagnetic and acoustic analysis.

Basically, this is a nightmare if we are constantly entering sensitive information, CC details, passwords etc. For more information, read over the Wikipedia entry on keylogging. While I won't be going over how to remove a keylogger, I will be teaching you how to reverse engineer the skids e-mail and/or password.

So What Type of Keylogger Are You Dealing With?

We will be covering:

• FTP Server-based: Data is uploaded to an FTP server.
  
• E-mail based: Data is periodically emailed to a pre-defined email address.
  

Server-based keyloggers are when the hacker configure their FTP sever where they will recieve logs of your keystrokes in pre-determined intervals.

E-mail based keyloggers are quiet similar. They configure the keylogger using e-mail login details. The victim's logs are then sent to that address again in pre-determined intervals. (Usually every 5-10 minutes.)

What Tool Will We Use and What Does it Do?

We only need one tool and that is Wireshark. You can download it from the below link.

----------------------------
Download me!
----------------------------

Wireshark® is a network protocol analyzer. It lets you capture and interactively browse the traffic running on a computer network. It has a rich and powerful feature set and is world's most popular tool of its kind. It runs on most computing platforms including Windows, OS X, Linux, and UNIX. Network professionals, security experts, developers, and educators around the world use it regularly. It is freely available as open source, and is released under the GNU General Public License version 2.
It is developed and maintained by a global team of protocol experts, and it is an example of a disruptive technology.

Steps To Finding Out Who Infected Your Baby.

1.Install and run Wireshark. When installing it, you will be asked do you also want to install Winpcap, click yes as this is necessary for everything to work!

WinPcap consists of a driver, that extends the operating system to provide low-level network access, and a library that is used to easily access the low-level network layers. This library also contains the Windows version of the well known libpcap Unix API.

2.When in Wireshark, up at the top left you will see "Interface List". From here, select your network card and hit "Capture". This will now capture any packets passing through said network card. The longer you leave it running, the better! This will capture more packets for you to analysis. 20 minutes should be fine too but like I said, the longer the better.

3. It's filtering time! Go to the filter box and type in 'FTP'. Go through all the results and eventually you should see the hacker's e-mail address and password associated with their FTP server.

4. ???

5. Eat a cookie.

6. PROFIT!!

Aftermath.

What happens next is your decision. Revenge is sweet! You should now try to remove that pesky keylogger.

Credits:

The Wireshark team and community.
Laura Chappell
An old friend I met on the darknet by the name of Rozen.
Myself

There you have it! I will be updating this thread in the future along with adding images. Depending on how popular this is, I might create more tutorials on the topic! I hope you enjoyed my tutorial. Have fun!