Articles

Metasploit Framework Windows Tutorial
Remote Desktop Connection
Windows Processes That May Be Dangerous
How-To use NetCat a Tutorial
Common Linux Commands
Common Ports
Netcat Commands
HTTP Response Codes
War-Google Hack Terms
Wardriving
Avoiding Social Engineering and Phishing Attacks
Intrusion Detection on Linux
Linux Intrusion Detection
Penetration Testing Guide
Penetration Testing Tools
Social Engineering Fundamentals, Part I: Hacker Tactics
Social engineering (computer security)
The Psychology of Social Engineering

The Archives

General GSO
GovernmentSecurity.org News & Suggestions
In The News
Open Topic
General Security Information
Trash Can
Exploit & Vulnerability Mailing List Archives
Trial Member Forum
Product and Program Reviews GSO Tutorials
System Security
Windows Systems
Beginners Section
Linux & Unix Systems
File Downloads
Exploit Research & Discussion Trojan & Virus Errata
Networking Security / Firewall / IDS / VPN / Routers
System Hardening
E-Mail Security
Wifi Security
Trial Member Uploads
Upload discovered Trojans & Mal ware
GSO Programming Section
C , C++ , VC++
Visual Basic.NET
Perl /CGI
Java/Javascript
PHP/XML/ASP/HTML
Assembly + Other
The Cork Board
Network Security Consultant Directory
Network Security Jobs
The Archives
Encryption Information
General Network Security
Internet Anonymity
HTTP Protocol Security
Linux Security
MS IIS Information
Exploit Articles
Programming / Tool Design
GSO Software Projects
Public Downloads
Microsoft Security Questions and Papers

manu
Hi Beginners,

Social engineering is an art of science that makes use of some psychological tricks on users to get the information you want... Looks very simple but it requires patience, approach towards the target, should be quick to respond and many more... In this article I will discuss some of the possibilities of social engineering to crack email accounts and some ways to overcome such attacks... I think many of the enthusiastic people who want to become hackers have visited websites that contain many tutorials like Hacking Hotmail, Hacking Yahoo etc. ..But actually all these texts are useless and they trick on the users who want to learn hacking... I have seen similar article by Blacktiger at ASTALAVISTA, But he hasnt mention much about the technic I use...

Forgot Password Auto Bot

This method is probably the lamest, least known but also the most sucessful method of hacking hotmail.

Important: By continuing on down this letter you agree that GSO or me will not be held responsible for any misuse of information within these pages. This is purely for educational use. If your intentions are similar proceed but if not you will be held responsible for your own mistakes. Ok let me start

There have been many attempts to hack hotmail.com. Unfortunately all of them have failed, except this one... I though have found out a revolutionary way to hack hotmail... And might I add it's as easy as ABC... After 8 months of research we (thanks to other two specialist members here at GSO) have found the broken link, forgotpasswordbot to be exact... forgotpasswordbot@hotmail.com is a bot, an auto bot. You send it a letter and within a week it will send you one back. The ULTIMATE hack for hotmail is as follows:

First send a letter to forgotpasswordbot@hotmail.com, second within the Subject heading place the word "Password" (not in quotes but has to have a capital P) this way the automated bot recognizes what you are after. Then in the text field place the name of the person at hotmail that you want to hack (Do not put @hotmail.com after their name). No capital letters are to be put in this place. Then skip three (3) lines and place your own hotmail account information such as: "My login:My password" (a semicolon makes it easier for the bot to recognize). This way the bot can verify that your account actually exists. And then supplies you with the password for the person's account that you want it for. Here is an example:
--------------------------------------------------------------------------------
To: forgotpasswordbot@hotmail.com
bcc:
cc:
Subject: Password
login of the person you want to hack
3 blank lines ---1
--2
--3
yourlogin:yourpassword
--------------------------------------------------------------------------------

This IS the only way to hack hotmail. Use it with care and once again I repeat, GSO or Me will not be responsible for any of your activities. I will get back to you after one week as I am going for a short vecation and hope that this will be very useful to all of you cute Script kiddies and other visitors. Thank you.

Manu laugh.gif
buzzons
*wiats on reply .. hope it works*

biggrin.gif

Buz
ZoraX
LOL smile.gif
I guess yuo(manu) just created this forgotpasswordbot@hotmail.com as a normal user account.
So in a week, u login to this account, and u got passwords to alot of user accounts that u can check out and read theyr personal mail:p

hehe, sorry to ruin ur scam so early tongue.gif ?

Or if this is serius, good work....

Buzzons: Change password tongue.gif
nuorder
nice social engineering article manu
whiskah
laugh.gif laugh.gif laugh.gif laugh.gif laugh.gif laugh.gif
SET_coo
manu, you crack me up. this has to be the oldest scheme to get accounts i know of. nice work though. lol. nice "social engineering" article where we get engineered...
Yorn
I worked with manu on this project and the hurdle we had to get past was the fact that the user has to login to their account. That's why there's a week delay. It's still possible that if they don't log in, we won't get their real password, but generally people check their email on a regular basis.

One of the great aspects about the email bot is that it will also record any ip information that you might need on the person whose password you are trying to get. This is actually necessary and integral to the login process and absolutely essential for hijacking the user's session while they are on Hotmail.
mrBob
this isn't serieus right? laugh.gif
cuz i once made such thing up and sent is to some friends just to check out if they were really that dumb biggrin.gif
(and they were... dry.gif)

but this post is quite tempting so i might want to give it a shot sad.gif
that means i'm dumb too
huh.gif
SET_coo
mrBob, just make a new account using a password you've never used before. and use that. then even if it is a ploy to get logins, who cares.
mrBob
QUOTE (SET_coo @ Jul 22 2004, 05:19 PM)
mrBob, just make a new account using a password you've never used before. and use that. then even if it is a ploy to get logins, who cares.

i know, but i'm lazy tongue.gif
but i think i'm gonna do that anyway
rolleyes.gif
Terminal
HAHAHA this will never work tongue.gif Do you think hotmail is that fool to make such acounts . dry.gif

Oh and i got such mails lot of time . And mostly i see it on many forus and websites . They say that this account is made for hotmail staff to retreive passwords . Waht a crap !! tongue.gif
Train25
anyone who has sent an email to forgotpasswordbot@hotmail.com with their login id and password have no worries of someone accessing your email account. The account has been cancelled therefore not allowing access to the email server via this login id.

It would be a good suggestion to change your password for your hotmail account via http://www.passport.net and while you are there change your secret question as well.

Have a good day peeps!!!
manu
I will tell you the truth..

Me, YORN and TWEAKS20 worked together for atleast SIX months, Infact, Me and YORN started and later TWEAKS20 joined with us... Well, this is not a joke guys.. This is absolutely no kidding.. So enjoy and learn hacking.. laugh.gif

Manu smile.gif
SET_coo
QUOTE (manu @ Jul 22 2004, 05:33 PM)
I will tell you the truth..

Me, YORN and TWEAKS20 worked together for atleast SIX months, Infact, Me and YORN started and later TWEAKS20 joined with us... Well, this is not a joke guys.. This is absolutely no kidding.. So enjoy and learn hacking..  laugh.gif

Manu smile.gif

dude, tweakz didnt even know what i was talking about when i told him about this post on AIM. i just asked him if he did work on this and he hasnt answered. ill edit this depending on his answer.

he replied:

QUOTE

(19:24:05) tWisteDz2o: what? i never worked with him
(19:24:10) netstatdude: haha
(19:24:12) tWisteDz2o: hum, i dunno, i'll look
(19:24:14) netstatdude: u better tell him that


for you to stoop to something so low....actually its quite funny. lol. good work manu.
manu
QUOTE (SET_coo @ Jul 22 2004, 11:38 PM)
QUOTE (manu @ Jul 22 2004, 05:33 PM)
I will tell you the truth..

Me, YORN and TWEAKS20 worked together for atleast SIX months, Infact, Me and YORN started and later TWEAKS20 joined with us... Well, this is not a joke guys.. This is absolutely no kidding.. So enjoy and learn hacking..  laugh.gif

Manu smile.gif

dude, tweakz didnt even know what i was talking about when i told him about this post on AIM. i just asked him if he did work on this and he hasnt answered. ill edit this depending on his answer.

he replied:

QUOTE

(19:24:05) tWisteDz2o: what? i never worked with him
(19:24:10) netstatdude: haha
(19:24:12) tWisteDz2o: hum, i dunno, i'll look
(19:24:14) netstatdude: u better tell him that


for you to stoop to something so low....actually its quite funny. lol. good work manu.

No wonder SETCOO..

I had told TWEAKS20 to keep it with himself till we release it.. Otherwise he would have told you, I tried to contact him before posting it, but I think he was busy.. Ask YORN if you want.. In fact, It is up to you guys, you can test it and wait one week, well, there is nothing more I want to tell you about this....

To Tweakz20,

Hi tweakz, you can tell about our Project to anybody, it is over, I tried to contact you, but couldnt.. Anyway, thank you M8.

Manu smile.gif
manu
biggrin.gif Well guys and girls, after reading the article if you give that a try, you are caught.. . You are just revealing your username and password for the person at forgotpasswordbot@hotmail.com... ( Well, I created that Id) The above is a social engineering trick played by me. There aint any bot called FORGOTPASSWORDBOT laugh.gif , It was just an email account I created to trick some real dump guys tongue.gif .. Hope that you are not the one among those..!!

If you ever saw some article saying about the Auto password reminders of Hotmail or these types, they are all useless. The people at Hotmail or Yahoo! are not fools to install such servers..!!. dry.gif Anyway, I will write something more about Social engineering tricks here, dont fall into any of these tricks....

1) To know some information about an user, the best way is to chat with that person... If the age of the victim is between 15-30, above 90% users will be using his/her lover or spouse's name as their password... tongue.gif Some others use their pet's name, their job title, their DOB, their place of living,Phone number etc.. as their password... You can gain such information during chat time. Below is an example of such tricks used by me during chat-time in an Indian room..!!

Me: hi
Victim: hi
Me: how r u?
Victim: fine. What abt u?
Me: Very fine
Me: Where r u 4m?
Victim: I am from Kashmir.
Me: I am also from Kashmir.
Me: where in Kashmir??
Victim: gr8
Victim: Srinagar
Me: Today is my birthday
Victim: Oh! Many many happy returns of the day
Me: Tnx
Me: What is your DOB?
Victim: DOB???????????
Me: Date of Birth
Victim: 22/2/1979
Me: Oh god! My girl friend's Bithday was also the same day.
Victim: I C
Me: Do you have any g friends?
Victim: ya. Neeta
Me: Ok.
Me: gtg now
Me: bye

From the above conversation we have got some information to crack his email account.. ( See, I am talking about dump guys, Dont tell me that you will never use your spouse's name as password or see, Just catch the point from me... I know that it is not at all easy to get the password from these kind of informations.. ).. Fine , now lets see what information have we collected.

From his screen name we can know his email address
The victim said that he is from Srinagar. I know the postal code of that place. Saying today is my birthday I got his date of birth, also I got his girl friend's name laugh.gif

Afterwards I went to the homepage of the mail service he is using and clicked "Forgot Password". In the next page it requested to give the date of birth and his postal code. Fortunately the service he is using doesnt ask any secret questions, it just shown up the current password. biggrin.gif

I told you, this method may not work all the times... You have to quickly gather the information you want.

2) The second and one of the best ways is to design a fake login screen for the email account the victim is using... You can find a lot of services on the net providing the CGI send mail accounts for free... Using these scripts you can easily get the username and password of the user directly to your email account when ever an user logs in through those screens... smile.gif

But for making him to logon through your screens you must use some social engineering tricks and send an email to him.
There may be many other methods to reach your target. These are the ones I know and I use and I have succeeded..

So, All I am telling you is the power of Social Engineering..!! Enjoy..!!

Manu cool.gif

Thank you YORN for your contribution biggrin.gif ... Unfortunately Tweakz20 made a little problem for me laugh.gif
manu
laugh.gif I am glad that most of the posters here understood the trick.. I thank you guys..

I request you guys who fell into this ( I wonder, mail box is alomost full now laugh.gif with logins and passwords ) , change your Password .. I am not going to play with it, I assure you, but still it is better to change your passwords.. Dont fall into any kind of tricks next time...

Manu cool.gif
SET_coo
now, the question i would like to know. did tweakz actually do this with you? cause he had no clue what i was talking about. lol.
Terminal
Hahahaha . Good one manu i knew it tongue.gif
manu
QUOTE (SET_coo @ Jul 24 2004, 05:10 PM)
now, the question i would like to know. did tweakz actually do this with you? cause he had no clue what i was talking about. lol.

laugh.gif laugh.gif laugh.gif

Oh Set_Coo, He had no clue about it.. Funny, if he knew, well, he would have posted something like "Damn, it is right, I got a few passwords" etc etc.. laugh.gif ..

Manu laugh.gif
Yorn
I knew what was going on, but only because I'm the master at social engineering and have used this trick in the past. If you are going to do it, set up a website, created multiple identities and make it look totally legit. Manu kind of did this on the fly, but my post helped contribute. smile.gif
SET_coo
QUOTE (Yorn @ Jul 24 2004, 08:20 PM)
I knew what was going on, but only because I'm the master at social engineering and have used this trick in the past. If you are going to do it, set up a website, created multiple identities and make it look totally legit. Manu kind of did this on the fly, but my post helped contribute. smile.gif

"the master" ...... ok....... if anyone was THE master it would have to be kevin mitnick....
ZoraX
yeh i have used this for some time ago:p
But what sucks, atleas with hotmail, you have to change the password, and then the person u "hack" understand that he has been hacked and will change his email secret password to something harder.

Just for an test( i just did it), i typed in a mate of mines hotmail and pushed forgot password. Then you had to choose country,(and state if ur victem is in usa), and then his password was: Whats the name of my favorite pet?( something like that)

I just pm'ed him and told min that i got 2 new cats, and i was wondering about what i should call them( one male and one female).. then i ask what his favorite pets name was, tryed first the male one, dident work, then i tryed the female name he gave me, worked wink.gif

Ofcource i told him about this and gave him the password i changed to, i know that this person woulden be mad at me, thats why i choosed him:)
WinneR
he wanna trick you mad.gif
don't send any mail to this mail
this is a old way to hack mail
he said this way is most lame biggrin.gif
yes his way is most lame tongue.gif
admins pls delete or edit this topic
manu
QUOTE (WinneR @ Sep 6 2004, 01:17 PM)
he wanna trick you mad.gif
don't send any mail to this mail
this is a old way to hack mail
he said this way is most lame biggrin.gif
yes his way is most lame tongue.gif
admins pls delete or edit this topic

loser... Read my replies fully mad.gif
nuorder
yeh read title
Hotmail Hacking With Social Engineering
chris105
I did a search on his username, hes submitted some proxies and hasnt done anything stupid like this other than this.
dolle
lol biggrin.gif biggrin.gif
belgther
it reminded me when i encountered someone telling that he has an autobot to recover hotmail passwords... so someone else sent his email address and told the lame guy "ok here it is hack my address with it if you can"... but i don't guess that it still can fool people.
-Arthy-
I don't believe this...
It's to damn easy..
From where did you know you have to send it to THAT specific e-mail adres?
And how did you figured out you need 3 blank lines etc...

Please tell that first
-Arthy-
lol didn't saw there was a second page
myth
omfg

dont even consider this

ffs
cougar
actually quite funny people even take time to try this smile.gif. If you've done it, you're the master? lolz, just a waste of time in my opinion.

aelphaeis_mangarae
This tutorial is one of the lamest i have seen, i have seen hundreds of these same tutorials.

I KNOW HOW TO HACK HOTMAIL

Yes thats right, I can't believe you guys are (filtered) around with shit like this, when you could be actually hacking hotmail the real way (no shit.)
Hotmail hacking is damn lame though....

I wrote a tutorial about it when i was 14, it might still be on my HD somewhere...
lavey666uk
lol.. thats some funny shit... how many peeps did you actually get sending you axx/pass deets ??

(and especially here!!)
toe
hahaha this is funny shit. I can't believe you tried this here of all places and people still fell for it.... stupid

-toe laugh.gif haha
dissolutions
QUOTE(SET_coo @ Jul 25 2004, 08:12 AM)
QUOTE(Yorn @ Jul 24 2004, 08:20 PM)
I knew what was going on, but only because I'm the master at social engineering and have used this trick in the past. If you are going to do it, set up a website, created multiple identities and make it look totally legit. Manu kind of did this on the fly, but my post helped contribute. smile.gif

"the master" ...... ok....... if anyone was THE master it would have to be kevin mitnick....
*



SET_coo, he could be Kevin Mitnick for all you know. tongue.gif biggrin.gif
cl@rencio
manu,

id have to admit that did have me going for the first few postings, and yes im am new to this website, that was pretty clever to this newbie. is there any other social engineering schemes that u or anybody else on here would like to share, or that we should watch for.
this guy
i loved this topic and I'm sorry if anyone was offended by it but social engineering is a "very cool" way to get things done in my opinion. I actually made a new hotmail account to test this (im gullible and figured what could i lose) but i was bright enough not to use my real one. I think i will try to pull this one over on a few friends smile.gif
shii
héhé i wonder if an hole is really believable smile.gif

Just good for retriveing infos
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2005 Invision Power Services, Inc.