Wordpress strange characters. | Help!

Code:
Let's face it, we've all at one point wanted to hack a friend or an ex's Facebook account, &amp; its actually been one of the main reasons some hackers learn to hack, but with Facebook being the leading social network in the world, that comes with a lot of security. Server-side hacking is nearly out of the question unless you're pretty experienced, but what we can do to gain access is perform a MITM (man in the middle) attack.

&nbsp;

A MITM (man in the middle) attack is exactly as it sounds. The hacker (man) intercepts data between the network &amp; the victim in order to steal information or inject information. This, of course, has to be done through a local network or a VPN.

[caption id="" align="aligncenter" width="811"]<img src="http://www.4kcc.com/images/maninthemiddleattack.png" alt="" width="811" height="435" /> MITM Attack Chart[/caption]

In the diagram above, we can see the standard protocol for a user browsing the internet, A being the end-user, B being the server. When performing a MITM attack, we step in between that connection allowing all the data being communicated to pass through us first. With a few simple tweaks &amp; a fresh Linux distribution, we can pull off a Facebook Cookie Heist.

<!--more-->
<h3>What you'll need:</h3>
<ul>
	<li>Linux Distro (I'll be using Ubuntu 14.04 for this demonstration)</li>
	<li>Victim on the same network</li>
	<li>Firefox Web Browser</li>
	<li>Greasemonkey (Firefox Addon)</li>
	<li>Custom Injector Script</li>
	<li>Ettercap (Linux networking tool)</li>
	<li>SSLStrip (Linux networking tool)</li>
	<li>Dsniff (Linux networking tool)</li>
	<li>Wireshark (Linux networking tool)</li>
</ul>
<h3>Setting up Greasemonkey:</h3>
First we're going to get <a href="https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/">Greasemonkey</a> set up &amp; ready to go with our custom script. So head over <a href="https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/">here</a> to install the latest version of <a href="https://addons.mozilla.org/en-US/firefox/addon/greasemonkey/">Greasemonkey for Firefox</a>. For those unfamiliar with the add-on, this will allow us to run various scripts within Firefox. This comes in handy quite often in hacking.

Next we're going to download the custom script we wrote for this project. This is a cookie injector script, the original source was written by a very experienced member of <a href="http://hackcommunity.com">HackCommunity</a>, <a href="http://www.hackcommunity.com/User-Snipa">Snipa</a>. You can download the <a title="Cookie Injection Script" href="https://www.dropbox.com/s/rurqbq299aztumn/Cookie%20Injection%20Script.js" target="_blank">edited version here.</a>

After the script is downloaded, open it up using Notepadd, or Notepad++ to view the source code. You should see the Greasemonkey icon in your toolbar of Firefox. Click the icon &amp; click <strong><em>"New User Script"</em> </strong>&amp; paste the source of our script there.

<a href="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-11_40_04.png"><img class="alignnone size-medium wp-image-136" src="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-11_40_04-300x237.png" alt="HHD Script" width="300" height="237" /></a>

&nbsp;

Save the script. Alternatively if you have any problems with the script wizard, you can also drag &amp; drop the script into a Firefox window &amp; you'll be prompted to save the script.

&nbsp;

&nbsp;
<h3><strong>Installing the tools:</strong></h3>
Since I'm using Ubuntu 14.04 in this tutorial, the steps may differ depending on your distro. I am using a virtual machine as well, which means the configuration you're seeing in my screenshots aren't going to be exact for you (assuming you're not using a VM). I will cover my configuration for <em><strong>VMWare Player</strong> </em>in a later post.

So here's what we'll be installing, &amp; the command-line we'll use to do so. Press <em><strong>Ctrl</strong></em> <b><i>+Alt</i></b>+<strong> T</strong> to open a new terminal window, &amp; input the following:

<strong>Ettercap -</strong> <em>sudo apt-get install ettercap-text-only</em>

<a href="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_34_36.png"><img class="alignnone size-medium wp-image-132" src="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_34_36-300x194.png" alt="Installing Ettercap" width="300" height="194" /></a>

<strong>SSL Strip - </strong><em>sudo apt-get install sslstrip</em>

<a href="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_36_38.png"><img class="alignnone size-medium wp-image-134" src="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_36_38-300x194.png" alt="Installing SSL Strip" width="300" height="194" /></a>

<strong>DSniff - </strong><em>sudo apt-get install dsniff</em>

<a href="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_37_16.png"><img class="alignnone size-medium wp-image-135" src="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_37_16-300x194.png" alt="Installing DSniff" width="300" height="194" /></a>

<strong>Wireshark - </strong><em>sudo apt-get install wireshark</em>

&nbsp;

These are all vital components to a man in the middle attack for their own reasons. Now that we've got everything set up just the way we need it, we can dive right into it.

&nbsp;
<h3>The Attack:</h3>
A man in the middle attack relies heavily on the ability to see the traffic on our network, this is where <strong>Wireshark</strong> comes in. Seeing how we're trying to reveal the data being sent from a specific IP address, we'll need the local IP of the target. Once this is obtained, we'll be able to capture the cookie &amp; use it to login to Facebook. This is what the Greasemonkey script is used for.

We'll have to enable IP Forwarding, which will allow us to resend any data we receive. Open a new terminal window with <em><strong>Ctrl</strong></em> <b><i>+Alt</i></b>+<strong> T </strong>&amp; input <em>sudo sysctl -w net.ipv4.ip_forward=1</em>. The most effective way to test that IP Forwarding has been enabled is by inputting <em>cat /proc/sys/net/ipv4/ip_forward</em>. If the terminal doesn't output any errors, you should be good to go.

<a href="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_42_36.png"><img class="alignnone size-medium wp-image-138" src="http://www.hackershelpdesk.net/hackhdcontent/uploads/2014/07/Screenshot-from-2014-07-13-12_42_36-300x194.png" alt="Port Forward" width="300" height="194" /></a>

For <em><strong>SSL</strong></em><strong> Strip</strong> to work correctly, we're next going to enable IP tables to redirect the target from port 80 to port 1000. To do this, input <em>sudo iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-ports 1000</em> into a terminal window. There should be no output, if you receive any errors, open up a new terminal window &amp; try again. This sometimes happens in a stale window.

Now we're ready to be the <em><strong>Man in the middle,</strong></em><strong> </strong>putting ourselves between the router &amp; the target. This will require you to open a fresh terminal window so we don't run into any problems. Once you have a new window open, you'll input <em>sudo arpspoof -i <strong>(your network adapter here)</strong></em><strong> </strong><em>-t 192.168.<strong>x.xx </strong>192.168.<strong>x.x</strong>. </em>Replace the <strong>X</strong> with the corresponding numbers for your victim's local IP, &amp; the network's default gateway. All this can be found by running the <strong><em>ifconfig</em></strong> command in a new terminal window. You should receive an output with an <em><strong>arp</strong></em><strong> reply</strong>, if you do, then you're on the right track.

Now we're going to repeat the same command-line, just backwards. So in the same terminal window, input <em>sudo arpspoof -i <strong>(your network adapter here) </strong>-t <strong>(default gateway) (target's local</strong></em><strong> IP)</strong> &amp; once again, you should receive an <em><strong>arp</strong></em><strong> reply</strong>.

Now for the fun part, let's start up <em><strong>Wireshark</strong></em><strong> </strong>using <em>sudo wireshark</em>. You'll see in the window a <strong>Filter</strong> field, in that field, you're going to input <em><strong>http.cookie</strong></em><strong> </strong>which will allow <strong>Wireshark</strong> to search only for cookies. Now, when your victim logs into their Facebook, you'll see something similar to this:

[caption id="" align="alignnone" width="1024"]<img src="http://i.imgur.com/fo0al4c.png" alt="" width="1024" height="654" /> Taken from Snipa's post on HackCommunity[/caption]

&nbsp;

Just as <strong>Snipa</strong> did here, you're going to copy the <em><strong>Text</strong></em><strong> Only</strong> &amp; open up Firefox &amp; press <strong>Alt+C</strong> to see an input box, paste the information there to inject the cookie, &amp; navigate to Facebook. If you've succeeded you will be logged in to your victim's Facebook account. Using the information you learned here, you can see the dangers in connecting to unsecured public networks, especially those pesky <em><strong>FBI </strong></em><strong><i>Surveillance</i> Van</strong> SSIDs. Fortunately for us, MITM attacks are easily combatible on our home networks, &amp; on our personal computers so we can feel protected even when connecting to public networks, but that'll be covered in a future article.

&nbsp;

I'd like to thank <strong>Snipa of HackCommunity </strong> for his exceptionally detailed tutorial on this method which inspired me to publish my method. Some photos in this article are courtesy of his tutorial.

&nbsp;

&nbsp;

&nbsp;