POC – How Facebook Account gets Hijacked

Advanced Ethical Hacking Institute in Pune

Step 1 – Grab the user’s email address:
This can be simply done through creating a Yahoo email account and importing contacts from your original Facebook account. To do this, simply create a Yahoo account, login to it, click the large “IMPORT CONTACTS” button and select Facebook.

Step 2 – Finding the user’s email address:
Go onto your list of contacts, find the person’s real life name and you should be presented with their email address.

Step 3 – Checking if the address is valid
Go onto whatever email provider they use e.g Google, Hotmail, iCloud.. and attempt to login to the address with the exact email address, and some random made up password

Step 4 – Further investigation
If it says “the account doesn’t exist”, or something along those lines you can get the account 100 percent. If it says the username and password is wrong, this method won’t work.

(I’ll be showing you how to get into these accounts at a later date)

Step 5 – Create a new account
Create a new email account. In the following example I’m using hotmail’s system for linking accounts, but the way the way they work is very similar for Google, iCloud, etc..

Step 6 – Link the accounts
For Hotmail: go to “Manage Account Settings”, then navigate to “Manage aliases” and finally you would input the user’s email address you want to hijack and it will automatically link to your account, with no verification needed because the account doesn’t exist.

This system is originally used for restoring old or deleted emails such as “@extremehacking” that aren’t used anymore.

Step 7 – Get their Facebook account (confirmed) and possibly more!
Now, since the account’s are linked up you can request a password reset to their email address which would link it to the account you just created.

Bare this in mind: people tend to use the same email address for multiple services e.g YouTube, Twitter, Instagram, etc therefore you should send a password reset on ALL of those services. It could also be the same for popular games e.g RuneScape, World of Warcraft, League of Legends.. you never know!

Step 8 – Finishing everything up in a bang
You would now simply go to your email address and go through the password reset process which is simple.

www.extremehacking.org
CEHv8 CHFIv8 ECSAv8 CAST ENSA CCNA CCNA SECURITY MCITP RHCE CHECKPOINT ASA FIREWALL VMWARE CLOUD ANDROID IPHONE NETWORKING HARDWARE TRAINING INSTITUTE IN PUNE,Certified Ethical Hacking, Center For Advanced Security Training in India, IT Security Training Information Security Traning Courses in Pune, ceh certification in pune, Ethical Hacking Course in Pune