Top 5 Ways To Protect Your Facebook Account From Hackers

Top 5 Ways to Protect Your Privacy Before Facebook Gets Hacked

Nowadays the only social networking site that has become popular among the younger generations is FACEBOOK. Almost 7% of the world’s population is on facebook. Along with numerous benefits it has it’s disadvantages too. The most common threat that an facebook user gets is his facebook account getting hacked by someone. We often get certain messages while we login to our facebook account that your account was being opened by an unauthorised person from an unknown place but we don’t take it seriously. Due to this small mistake you will pay a larger cost later in the future. it is very clear that this happens because due to our mistake that our privacy has been leaked to someone. So in order to protect your privacy of the facebook account here are some steps you should properly follow.

1. Change your name:

Don’t provide your real name while creating your Facebook account for the instance just use your nickname because if unfortunately your Facebook account gets hacked in future you would be in a situation to create a new account. Don’t be of the opinion that making a number of account is a crime because according to John Sileo the privacy expert of Facebook 80% of the people on Facebook have multiple Facebook accounts.

2. Stop geo-tagging your photos.

First let me tell you what is geo-tagging, it provides the information like the latitudes and longitudes of the photo taken and uploaded on the Facebook i.e. home ,school etc. if you are an iPhone user then just glance over for a second to your “settings”, go to “privacy” and turn off the location services for all the applications in the phone or just for an individual application like camera.

3. Lie about your age.

Girls might be pretty aware of this cause they never tell their exact age anywhere in this world. But seriously always steal your birth identity if not just try to change the year. I know it feels very happy to get birthday posts on your wall but believe me it’s for your safer side only.

4. Don’t store your credit card information on the site.

In the advanced versions of Facebook there are many games, applications etc, that require your credit information about your credit card number, it’s validity etc. But for your well being try not to provide them with certain information because they can use these things in other wrong processes.

5. Have some boundaries.

Have certain limits in life and in everything that you do in your life. Anything in excess is very dangerous. Have fun with Facebook but enjoy responsibly. Try to say “no” to the things that are wrong. When Facebook asks you questions about the photo that you have uploaded like who is in this photo, where the photo was taken ? Skip these questions. Do not upload address of your new house because for a thief it would just be a welcome invitation letter.

If you want to be popular on Social Media, you can visit Mediamister offer page. Stay tuned for more social media marketing updates.

DNS Hijacking | How To Hack Facebook Accounts Using It

Hi Guys, I am back after a long time and I have got something amazing for you guys. In this tutorial I am going to show you how to Hack facebook accounts by DNS hijacking!

WHAT IS DNS?

 is a network protocol whose job is to map a user friendly name like tutorials for you to its corresponding IP address like “173.245.61.120″.

What is DNS Hijacking?

DNS HIjacking also known as (DNS redirection), is a kind of malicious attack that overrides a computer’s TCP/IP settings to direct it at a fake DNS server, thereby disconfirming the default DNS settings.As we tend to all recognize, the “Domain Name System (DNS)” is there to translate a user friendly name like “google.com” to its corresponding IP Address “74.125.235.46″.

So How DNS Hijacking Works?

As mentioned before, DNS is that the one that’s responsible for mapping the user friendly domain names to their corresponding IP addresses. This DNS server is closely-held and maintained by your Internet service Provider(ISP) and lots of alternative business organizations.
By default, your laptop is organized to use the DNS server from the ISP. In some cases, your laptop could even use the DNS services of alternative organizations like Google or OpenDNS. Imagine a scenario wherever a hacker or a malware program gains unauthorized access to your laptop and changes the DNS settings, so your laptop currently uses one amongst the malicious DNS servers that’s maintained by the hacker. once this happens, the malicious DNS server could translate domain names of interesting websites (such as banks, search engines, social networking sites etc.) to IP addresses of malicious websites having a similar design to original site. As a result, you will be taken to a pretended web site rather than the one you’re intending for.

What are the Dangers of DNS Hijacking?

The dangers of DNS hijacking will vary and depend upon the intention behind the attack. several ISPs like “OpenDNS” and “Comcast” use DNS hijacking for introducing advertisements or aggregation statistics. Even though doing this may cause no serious harm to the users, it’s thought-about as a violation of RFC standards for DNS responses.

Other dangers of DNS hijacking :

Pharming: This is often a sort of attack wherever a web site’s traffic is redirected to a different website that’s a faux one. As an example, once a user tries to go to a social networking web site like Facebook.com he is also redirected to a different web site that’s stuffed with pop-ups and advertisements, this is often done by hackers so as to come up with advertising revenue.

Phishing: This is often a sort of attack wherever users is redirected to a malicious web site whose style (look and feel) matches specifically with the initial one. As an example, once a user tries to log in to his checking account, he is redirected to a malicious website that steals his login details.
So this way 1 can hack facebook accounts. He can create a program to change your DNS address and could redirect it to his rogue DNS address. That DNS will redirect the request of facebook.com to some fake Facebook site, a Facebook phisher which could steal your login credentials.
To know more about Phishing, read What is Phishing How to Hack Facebook accounts using Phishing

How to Prevent DNS Hijacking?

In most cases, attackers create use of malware programs like a worm to carry out DNS hijacking. These DNS hijacking trojans are usually distributed as video and audio codecs, video downloaders, YouTube downloaders or as alternative free utilities. So, so as to remain protected, it’s suggested to remain aloof from untrusted websites that supply free downloads. The DNSChanger trojan is a very good example of 1 such malware that hijacked the DNS settings of over four million computers to drive a profit of concerning fourteen million USD through deceitful advertising revenue.

Also, it’s necessary to change the default password of your router, in order to stop someone to change your router settings to exploit your DNS settings to hack you.
Installing an original antivirus program and keeping it up-to-date offers an excellent deal of protection to your pc against any such attacks.

What if you are already a victim of DNS hijacking?

If you think that your laptop is infected with a malware program like DNSChanger, do not panic. All you have got to try and do is, simply verify your current DNS settings to check if the DNS address is the same as that provided by your ISPs. Otherwise re-configure your DNS settings as per the rules of your ISP.

I hope you would like my articles related to Hacking and Security!
Leave your queries and feedbacks in comments.

Do have a look at our Windows hacking section.

Access Your Facebook Account with 3 Passwords

Did you know that you can login to your Facebook account using 3 different passwords? Seems interesting isn’t it? Yep! Unlike any other online account which has only one password to access, Facebook lets you log in using 3 different variants of your password.

Only a few Facebook users are aware of this fact, but for many others, this might seem a bit surprising. Facebook accepts the following forms of your password:

1. Your Original Password

Let me explain this to you with the following example. Assume that your default Facebook password that you created during the sign-up process is:

2. Password with the Case Toggled

In the above password the letters ‘F’ and ‘P’ are in uppercase and the remaining are in the lowercase. If you TOGGLE the case where all the UPPERCASE characters are converted into the lowercase and vice versa, your default password “myFacebookPass” would become:

Now if you log in using the above toggled password, your Facebook will accept it and welcomes you! This is the first variation of your default password which is accepted by Facebook.

3. Password with the First Letter Capitalized

If the first character of your password is in the lowercase, you may just change that first letter to UPPERCASE and Facebook will again accept it and let you in. As in case of the above example where your default password is “myFacebookPass”, if you just change the first letter to UPPERCASE, your password would be “MyFacebookPass” and this should work fine as well:

Please note that this option will work only for the Mobile uers!

Why 3 Passwords?

Now, you all know that Facebook can be accessed using 3 different passwords. But you may be curious to know the actual reason behind it.

Well, this is definitely not because Facebook has a bug or a serious vulnerability. In fact, this is just an option provided by Facebook itself to make the sign-in process easier for the users. Here’s how:

The most common reason for the authentic logins to be rejected is when the CAPS LOCK is ON. This is where the first variation comes in handy. That means, when the CAPS LOCK is ON the case gets reversed (toggled) for your password but Facebook will accept this as well.

In case of mobile users, it is a common for the first letter of the password to get capitalized which often leads to the login failure. So, in order to tackle this issue, Facebook will also accept the password where only the first letter is capitalized.

Thus if the CAPS LOCK is accidentally enabled, the toggled password feature would still let you log in to your account!

How to Dox Anyone

Doxing is the act of finding one's personal information through research and discovery, with little to no information to start with. You may have seen doxing in the news, for instance when not so long ago, hacker team Anonymous doxed and reported thousands of twitter accounts related to ISIS. Doxing can be useful for finding the address of a coworker, or simply investigating people on the internet. The tutorial I will provide to you now will teach you the basics of doxing and how you can protect yourself against malicious people on the internet.

Step 1: Where to Start...

The thing about doxing that makes it a skill is that you must be prepared for many different situations, as no two people will have their social profile setup in the same exact way. You must be prepared to only have the resources of a name, email, username, or even phone number to find out all of the other information about a person. If you have an email, you are all set. An email is connected to social media (names) work (phone numbers) and accounts (information about the person). If you don't have an email, you should have a basic goal to get one, or at least a name...but for the sake of this tutorial, I will break up each step for a different scenario.

Step 2: Usernames

Usernames are extremely difficult to make connections with. If you have a username you can use some websites that I will provide to see other accounts and profiles connected to those usernames. These websites are not always correct, but you should check with a couple of them before proceeding to mark down information about a person.

My personal favorite place to start is pipl.com.

Pipl is a good place to start if you only have a username. Though pipl has the capability to search with emails and names, I would use some other sites that I will show later in the tutorial that specialize in those. Pipl should definitely not be your #1 go to site for doxing. For the sake of this tutorial, I will show you an example of what would come up when I search for null byte.

As you can see here, pipl pulls up some pictures of null byte, as well as some social media accounts connected to Null Byte. Some other sites that do the same thing as pipl, if not better, are spokeo.com and knowem.com. Now you're on a roll. From here we can talk about our social media pages.

Step 3: Social Media

Our social media pages are a huge source of personal information. From our social media pages, we can define our friends, family, best friends, locations, possibly phone numbers, photos of the person, and even information about the person's work. If you have somebody's social media page as a start, you can find out things like their address easily, even if they are under the age of 18. How? Well, with social media we can find out the city of the person, as well as some family members. From there we can use some websites I will show later in the tutorial to find addresses. Let's look at a random Facebook page and see what we can find.

Here we have the Facebook page of a man named John Smith. I don't know John, but I can still take massive amounts of information from his Facebook page.

For instance, from his about page, I can see the city he lives in, as well as the school he went to.

From John's about page, I can see that he lives in Monterey, California, and he went to Harvard-Westlake School. You don't know it now, but this will give us an even more massive amount of information later. Like addresses. This is where the tutorial gets interesting, so keep your ears on your head and listen up!

Step 4: Addresses and Phone Numbers

Now this is where we cross the line between the internet, and the real world. Taking information from the internet, and finding out where it is in real life. To find addresses, we will use the name, John Smith, that we investigated on Facebook. We will use a website called White Pages (whitepages.com) to look up this name and see what addresses are connected to it.

In our white pages search box, we put the name as John Smith, and the location as Monterey, California, as found on John's Facebook profile.

This was the result:

When we click on the little address icon, it will open a page with the address of Mr. Smith. I have edited out the actual credentials of Mr. Smith for his safety but here is a little picture of the surrounding page.

Here is the page that appears when you click the icon. I have edited out the age, picture of location, and address for the safety of John Smith.

Step 5: Where to Go from Here

Congratulations! You have learned the core basics of doxing and are ready to go out into the world with your new skills! I encourage all of my readers to use the information I have given you to protect your online identity. Don't post your city on Facebook and try not to post anything you don't want the internet to see. Make sure your usernames are not always the same and stay on your toes! Thank you so much for reading this article and please comment if you have any questions! :D

Social Engineering: The Most Powerful Hack

Social Engineering was mentioned a few times here on Null Byte, but not very many explained what it is, or how to do it. I love this quote because it's true:

Image via slidesharecdn.com

Social Engineering is the key to carrying out client side attacks, and all you need is a little creativity!

Social Engineering Toolkit

OTW did a general tutorial on using SEToolkit, which by the way is a fantastic tool, so I would like to go on to that.

SEToolkit is a program by TrustestSEC that has many features from stealing credentials, so carrying out Metasploit payloads. If you don't have it already, go to TrustedSEC's website for downloads.

Step 1: Starting SEToolkit

Once you have installed SEToolkit, open up bash and type setoolkit. You will be presented with a question. I recommend answering "yes", but that's your choice. Next, you be presented with a menu with options:

For this tutorial, we will use the Social-Engineering Attacks menu. Type 1and press [Enter] key to continue.

Step 2: Choosing an Attack Vector

We will be greeted with a screen similar to this that has many different attacks.

I'll be guiding you through one of the most effective options: Website Attack Vectors. Pretty much everyone who has used a computer has used the Internet, and pretty much everyone on the Internet will click on a link (am I right?). Social Engineering is a society like Facebook or Twitter, but can also be as simple as, well, a link. SEToolkit helps you abuse that trust people have on the Internet, so not only do you have over 5 billion targets, but you can also recognize attacks like these.

Type 2 and press [Enter] to continue.

Step 3: What Do You Think?

We now have a list of 7 different attack vectors, all very effective. The 3 mosteffective vectors are the Credential Harvester, Metasploit Browser, andJava Applet Attack. Let's say that you want to get your friend's Facebook login. By choosing Credential Harvester Attack Method, SEToolkit will copy any website you want and add a credential stealing code to the HTML. Let's do that, shall we?

If you go to Web Templates, you will find that SEToolkit has a Facebook login page template built into it. But first, let's enter our IP address for SEToolkit to report back to. You can use your external IP if you are doing this over the Internet. But make sure you port forward port 80 to your local IP.

Step 4: Copy the Facebook Page

After you enter your IP, you will be presented with some of SEToolkit's web templates. Because you want to get your friend's Facebook login, we should probably use the Facebook template...

Type 3 and press [Enter]. NOTE: You must have Apache installed. Kali and Backtrack come with it, but some other distros don't. To install it if you don't yet have it, type sudo apt-get install apache2.

After you choose your template, you should get a screen like this:

Step 5: Send It to a Friend

Now that it's already to go, just send your friend an email with your IP address as the link, but disguise the text. For example: instead of sending "http://____yourIP____/ " you would send "Facebook.com" with your IP embedded as the link.

Next we'll try to exploit web browsers/computers with SEToolkit and Metasploit.