Archive for May 2021

INTRODUCTION

WhatsApp has become an important part of billions of people’s life. Many of us woke up or go to bed, by checking our WhatsApp messages. Some of us are always curious to know to check WhatsApp of our friends. Girlfriends want to check on boyfriends and boyfriends want to check on girlfriends. Today Ethical Hacking researcher from X University of Cyber Security will demonstrate on How to Hack WhatsApp of your Friend by sending a Single Link.

We will use a tool called Ohmyqr which is a social engineering tool. Using this OhMyQR Tool, we can hijack anyone’s WhatsApp account using the Malicious QR code. We will send Victim a URL using social engineering techniques and when the victim opens that URL he/she will receive a malicious WhatsApp malicious QR code on his/her machine. This QR code is a replica of what you normally see when you use WhatsApp web. On scanning QR code, hackers will be able to session hijack victims WhatsApp account.

ENVIRONMENT

O S: Kali Linux 2019.3 64 bit

Kernel-Version : 5.2.0

INSTALLATION STEPS

Use this command to clone the project.

git clone https://github.com/thelinuxchoice/ohmyqr

root@kali:/home/iicybersecurity# git clone https://github.com/thelinuxchoice/ohmyqr

Use the cd command to enter into ohmyqr directory

root@kali:/home/iicybersecurity# cd ohmyqr/

root@kali:/home/iicybersecurity/ohmyqr#

When we tried to launch the tool, we got an error for not installing the required packages for the tool as shown below.

Use this command bash ohmyqr.sh.

OhMyQR – Scrot Missing Package

For this we used this command to install missing scrot package.

sudo apt-get install scrot

root@kali:/home/iicybersecurity/ohmyqr# sudo apt-get install scrot

In the same way we got another error for missing package while launching the tool.

OhMyQR – xdotool Missing Package

For this we used this command to install xdotool package.

Code:

sudo apt-get install xdotool

root@kali:/home/iicybersecurity/ohmyqr# sudo apt-get install xdotool

Now, use the same command to launch the tool bash ohmyqr.sh

OhMyQR – Tool Launch

We successfully launched the tool.

Now, choose option 1 to launch the Ngrok server.

Select website to mirror or press enter for default WhatApp and it will starts PHP and Ngrok server and then it generates malicious Link (ngrok link).

Then press enters to start the Web WhatsApp on hackers machine.

It will launch web.whatsapp.com on FireFox browser in Full screen mode on Hacker machine.

Now send malicious Link (ngrok link) to the victim using social engineering techniques.

As shown below when the victim opens the malicious link in the browser, it will display the same WebWhatsApp QR code which is coming on hacker machine.

For more understanding, on the right is the Hacker screen and on the left is the Victim screen.

OhMyQR – Right is the Hacker screen and on the left is the Victim screen

When the victim scans the QR code, BOOM!

Hacker screen will get the web.whatsapp account of Victim. Now the victim whatsapp session is hijacked.

On the same Victim will also be able to view his/her WhatsApp, but victim will not be able to do anything on it (as it is only a screen shot of what hacker is viewing).

OhMyQR – Victm’s WhatsApp Account

Right is the Hacker screen and on the left is the Victim screen

In the above picture, we can see one is the Victim machine (on left) and the other one is the hacker’s machine (on right).

We successfully hacked the victim’s account.

Its very easy to hack account of victim using social engineering techniques, in the similar way researcher of International Institute of Cyber Security demonstrated other techniques to hack other things.

CONCLUSION

Now, we saw on how easy to view and access the victim’s WhatsApp using one malicious link. Most of the people imagine that we had logged in our WhatsApp web account but their WhatsApp account is been Hijacked. So it is always recommended to not click on any unknown link.

Enjoy freaks😎

How To Install and Use Masking-URL Tool

It is always the same now in this case and we will download it first using the following command This is a very small tool that does not require any additional reliance, so we can use it in any third party Android app. After the download is complete then we will go to the guide for this tool. That is the only way we can launch this tool using the bash command.

Step 1 :- First you need to Open the Terminal, Termux. After installation you need to open and type the apt update and hit Enter. Then type the command apt upgrade -y to upgrade the termux.

pkg update -y && pkg upgrade -y

Step 2 :- After updating and upgrading the termux then you need to install other packages like, git etc.

pkg install git

Step 3 :- A small and simple tool written in bash, called "MaskPhish". This tool is made by us and is specially available in our GitHub repository. We can add this from our GitHub repository via the following command:

git clone https://github.com/OnlineHacKing/Masking-URL

Step 4 :- Now we just need to navigate to the maskphish directory by simply using the cd command:

cd Masking-URL

Step 5 :- Use the command below to make the file Permission readable, compact, and effective.

chmod +x *

Step 6 :- We can do this by using the following command:

bash Masking-OH.sh

MaskPhish will then open the main menu in front of us as a screenshot:

Step 7 :-Now we need to set up our URL for sensitive identity theft here or anywhere (via http: // or https: //).

Step 8 :-After that we need to set up a trusted URL, anything that can mislead the victim's mind like https://google.com or https: //youtube.com or http: //anything.com. As we did on the following screen:

Step 9 :-Here we need to use some social engineering words separated by "-" to make an example if the victim is a football fan then we can use something like the footaball skills concept that here we are not using anywhere.

After that we just install it and have our MaskPhish link. We started our URL with facebook.com and the URL has no ngrok at the exact URL.

Step 1: Go to this link (https://apply.vccs.edu/) and solve captcha. Then Click on new user and then sign up with email.
Step 2: To fill the detail you can use your real name and email but if you are not an US citizen then you can use this link https://www.fakeaddressgenerator.com/... to generate fake user detail. [Note: Save name, username and password in notepad or somewhere it may need later
➖
Step 3: After filling all the detail click on submit. Now that you have created account lets move on to part two of this tutorial.'
After creating account and loging into click on Apply Now. Select any college name from the list and click on Apply.
A pop-up will open then click on Apply Now (OR CONTINUE APPLICATION) BUTTON.
Then you are asked for different questions.
You can answer these questions randomly or you can use the detail below to answer these questions.
First name and last name:
Put the name that you have entered in part 1. Leave other field empty. Birthdate, Social Security Number: Enter details which was generated from https://www.fakeaddressgenerator.com/... Gender: Male/Female (as you like) Racial or ethnic identification: White Hispanico or Latino : No Have you ever applied, attended …… : No After that click on Save and Continue. For Mailing address use the detail generated from temp-mail.org Is this your permanent address: Yes You can leave telephone number blank. Then check on I have reviewed the guidelines box and click on save and continue. Which ….. high school education: I don’t have a GED/High ……. Last date attended: 01/2017 Highest grade completed: 11th grade. Have you ever attend …. : No I have planned to earn a degree…..: No I plan to start class: Choose any After that click on Save and Continue. Have you ever served …….. military: No Are you …….. military: No After that click on Save and Continue. Parent 1 and 2: Choose any. What is your current status?: Native US…… Primary spoken language: English Do you want……: No After that click on Submit your completed application. After successfully completing the application put on your signature i.e your full name. Then you will be redirect to with all your detail. Under the student information you will get your username and temporary password. Note down that password, username and other details. After that you can go here https://my.vccs.edu/tenant;jsessionid... and login where you will get your .edu email.

Subscribe to YouTube Channel :

https://youtube.com/channel/UCUhO6qymOnHOUGZM9AyQb6w

https://youtube.com/channel/UC9H8sUv8y-T6H7BMwE3bUhA

Follow On

Search This Blog

Hidden WIKI

Translate

About Me

Top 10 Reasons Why Python is So Popular and Why You Should Learn Python

Link List