Posted 05 April 2011 - 09:12 PM
Q: I heard you can steal peoples passwords over wifi! How do I do that?
A: Well, yes you can, but you can't just get any of their passwords that easily. You can run whats known as an MITM, or Man In The Middle, attack. What this does is uses ARP spoofing to trick the target computer/s into sending their traffic through your computer or iPod, and you use a packet recorder and sniffer combo to read the passwords, urls, etc such as pirni and derv or firesheep. But an MITM attack isn't guaranteed to get the password. If the website they are logging onto uses https, which is a secure version of http, hence the S, you aren't going to be able to get a password. In this case you will need to be a little more creative. You will need to be a bit more skilled. You will need to copy the login page of the site you want the password for, like facebook, with wget. Then you will need to put that in your webservers main page as index.html, along with a script that records the input into the username and password field into a .txt file. When you have that all ready you just need to run iPwN, use the dns spoof attack, and DON'T use the wildcard target! How suspicious would it look if you wanted to go to google but you get sent to facebook? Just say no to a wildcard and put in the URL of the login page. Now there you go! Leave that run for a bit and check the .txt file for passwords.
Q: But when they visit the URL I'm faking it says "http://192.168.1.2:80/var/www/index.html" How do I make it different?
A: Now that is an excellent question! Unfortunately, you cannot change the ip of the URL, but you CAN change the directory so it looks less suspicious. If you are using Lighttpd from cydia go to /etc/lighttpd2.conf and change the first line, which should say 'server.document-root = "/var/www" '
Change the directory to any that you want. For example, if you are getting a facebook login, change it to something like "/facebook/default_login". Then just make a directory to there and put your index.html there and your keylogger. There you go! You can now get peoples passwords!
Stupid questions get stupid answers.