Reported Post by The Pkkid V6

The Pkkid V6 · Mar 11, 2011

The Pkkid V6 has reported a post.

Reason:

Another dumb post by this moron .
Click to expand...

Post: Using a MITM attack to steal runescape accounts. (for dummies)
Forum: RuneScape 2 General
Assigned Moderators: Gohan, Louis, HamJam, Sacro, KerokeroCola

Posted by: ol derty bastard
Original Content:

Hey Ya'll its me again.

Today we will be discussing how we can get coonscape accounts off some little cunt kids without them ever realizing what happened.

First, of course, we need Ettercap.

For windows users, you can get it here: http://www.insecure.org/
For Linux users, you can get it here: sudo apt-get install ettercap-gtk
For BSD users, you can get it here: (as super user) cd /usr/ports/net-mgmt
/ettercap/ && make install clean

-----

Alright cool, This guide will be for backtrack linux, although it should be all around universal.

Insert your bt4 live cd and turn on your computer, select live mode. Soon you well be at the shell prompt. Type in "startx" and hit enter to load the gui.

A brief description is required before we persue any further. Ettercap is a program desgined for man in the middle attacks. Basically for example, it pretends to be "the router" so you can hijack, capture, inject, modify, kill, sniff, and even redirect traffic to your assigned targets.

Today, we will be using DNS spoofing to send our targets to a phish. The beauty of this is that they won't be able to tell the difference, will even say "http://www.runescape.com/" in the url. And even when your done browsers tend to remember the dns query. As a result, it's extremely effective for phishing.

Now if you're using backtrack, click on the menu button, go to internet, click wicd network viewer, and connect to the network we'll be raping.

Before we begin, google around for a good fake runescape site. Unless you have your own made.

Good, now we need to edit the *.dns file so we can redirect people to where exactly it is, we wish to be sending them. click on your terminal window, and type "locate etter.dns". This should spit out the directory, should be /usr/share/ettercap/etter.dns

Open up the file, with kwrite or anything equivelant. Scroll down to where it has microsoft written on it 3 times, and delete all of that.

Now where Microsoft A Linux.com where, I want you to make 2 entries in their place:

*runescape.com. A the-phish's-url-goes-here
Runescape.com* A phish's-url-again

-----

What this does is it takes dns queries to runescape.com, and send them to the phish instead. DNS servers are neat things aren't they? More on those in a later tutorial. For now, back to ettercap.

Save and exit.

Now we are ready to use ettercap.

Open up the console, and simply type ettercap -G or select ettercap from the menue.

You will want your wicd network viewer open again.
Right click on options, and select set submask. What a submask is, is an identifier for a subnet. Or.. a small part of a large network. each router can only service 255 hosts, so.. what if you have 256? You hook up another router and assign it a different subnet. It's all on the same network, it's just sections of the network.

For most home networks, the submask will be 255.255.255.0, wicd should also tell you the submask as well if you're on a larger network and arent' sure.

Ok.. now you are ready to scan, so select that tab now. Now, first thing is first, we go to the right tab, and select our plug-in. Scroll down to where it says "dns-spoof" and select it.

Now we scan for hosts:
Click on the hosts tab, and select "scan for hosts".
if you see an ip adress listed as 192.168.1.1, highlight it, and add it to target 1. If not, check wicd for your gateway ip. Confirm it in the hosts list, and add it to target 1. Everything else, add to target 2.

Now we are ready to broadcast our evil signalz~!

Click on the "mitm" tab and select arp poisoining. What this does is now your computer will start spamming arps, in other words its telling other computers that you are the router. Select remote hosts and 1 way.

now we are ready to scan. click the "start" tab and select sniffing.
tah-dah!! Now all traffic for runescape will now be headed to the phishing site. None-the-wiser.

Now imagine.. if you did this at jagex shitty coonfest. amg imagine teh lulz..
anyway..

To quit it, go back to mitm, select stop mitm attacks, go back to start, and end sniffing.

I, salvationless, take no responsibility for anything learned in this guide, it is for educational purposes only. Any references to runescape and/or any other site are merely and example and I am in no way encouraging illeagal activities.
Click to expand...