Hacking Computers (keyloggers, webcam snap, desktop capture, and more) using Backtrack 5 R1

[cmdprogramer100pro]

did u hack me

[adamsy1]

can u please post a video with a tut. on external ip

[MMinecrafTT]

it says (gedit2170) Gtk-warning **: cannot open display

help....

[MMinecrafTT]

if someone is on my hamachi network does it still works then??

[antaras10]

how to delete the virus from windows pc ?? :P :P

when i open my browser and go to google.gr it teells me Java Required

[antaras10]

i have prob only on firefox and google.gr

[hazimsaleh88]

nice nice but i hate lan hack :S

[AnonymousFYRM]

Can you please help me, it says Handler failed to bind to [My ip]

[TheBoyWithNoSmile]

thanks for the tutorial, i appreciate it

[AnonymousFYRM]

wario, i love you btw, i got it working but i think i noticed 1 glitch when doing this. it logs it but u cant browse any site

It says Error 404 on every site

[MrNicksterish]

I updated my SET.. Now it says it doesn't exist..

[AnonymousFYRM]

@souilem123 i got that as well but when i choose both using the same command it doesn't pop up with a java for me

[CaDDy1233]

can i make this for nonlocal victims?

[Azorathe]

All that is happening is the victim computer just keeps refreshing the java required page and the pop-up is not coming, what did I do wrong?

[BBr0s]

nvm, found out already

[BBr0s]

ehm, is backtrack a operating system?? or just a program?

[killacam5362465]

please help

[killacam5362465]

after it says Web Server Launched. Welcome to the SET Web Attack. and the msf listener is loading it sends me back to the main page where it says set web attack. also im using backtrack 5 r1 off of a Bootable usb and when i type route my gateway says desktop.domain

[quickrolla94]

@killacam5362465 Yeah I am booting off of a usb also and the msf loader sends me right back to the main SET page as well. Im not sure how to fix it and ive looked through numerous forums and goteen nowhere, its really getting annoying. Can anybody help us with this?!

[dmurta1]

Let's say that I did it and it worked. Every time that I want to hack the same computer again I'll have to do everthing in this tutorial again? There is no way to connect easily to the same computer?

Nice tutorial!

Thx

[krsic27]

1 word wow am ur new fan keep up the good vids

[somejarhead]

for those of you on desktops the wlan0 didnt work heres my code if you get error 99 and the ipv4 adress is not found\

ettercap -T -i eth0 -p -M arp:remote /192.168.0.0/ /192.168.0.0/ -P dns_spoof that will get it working over ethernet :D video guy you should put that in description cause i kept trying all your codes and was confused as hell until i tried some custom coding

[unseenpunk4u]

@somejarhead I found that to be true except its still -q not -p, * note to all type ifconfig and what ever the heading is next to your IP info use that i.e. wlan0, wlan1, eth0

[somejarhead]

@unseenpunk4u i i know derp typed it wrong lol

[DJKEBAB]

OK I got it to work, I know what I did wrong. Now I have a problem with the meta update, it freezes when I stat it up.

[DJKEBAB]

When running the gedit /usr/loacl/share/ettercap/ette­r.dns command, I get a message that says: Warning - Could not load theme icon system-file-manager: Icon 'System File Manager' not present in theme. Do you know how to fix the problem?

[thedingalingz]

what is the differince on backtrack 5 and backtrack R1?.can i do the same in just backtrack5?

[thewariomanofdoom]

@thedingalingz The repositories on Backtrack 5 are not up to date, and thus you won't be able to get the latest version of SET unless you manually install it.

[souilem123]

hey man taht's was an instersting tuto but my connection it's not wlan0 or wlan1.. it's eth0 and l0.... can you help plz and thaanks!! :D

[demennojonge]

Hey man the spoof setup works fine. but when he wants to spoof someone he give this error:

SEND L3 ERROR: 1500 byte packet (0800:06) destined to 192.168.1.1 was not forwarded (libnet_write_raw_ipv4(): -1 bytes written (Message too long)

Can you help me with it? btw, thanks for the great tutorial.

[FenrisVermillion]

what if they're not in my connection?

[thewariomanofdoom]

@FenrisVermillion Then you PM me and I'll tell you.

[pepijn1231]

@thewariomanofdoom Ow i would like to know how to do that too

[proxifier420]

First of all great video, I get everything working, but on my laptop the Java update doesn't show, I disabled the popup blocker in firefox and still nothing. I updated backtrack and still nothing. It gives the page that says you need to update but doesn't give the popup to run it. wondering what I'm doing wrong.

thanks.

[thewariomanofdoom]

@proxifier420 Sometimes this happens for some strange reason. I've come across this a lot with different computers and it pisses me off. Sometimes it just doesn't work. Try with a different computer.

[pepijn1231]

ARP poisening needs a non empty hosts list.

what do i do ?

nice video though!

[thewariomanofdoom]

@pepijn1231 You typed the command wrong. Look again and type it correctly.

[pepijn1231]

@thewariomanofdoom Indeed , I did , but i have an other problem and i would be glad if you could answer this : Every once i spoof it and it says Activating dns_spoof plugin...

and i surf on the internet of the victim pc it doesen'd show a pop-up (but my victim pc was a wireless machine and the attacker pc wasn't.Can you help me?

[forbiddensecrets1]

hey buddy! great tutorial, everything was very easy to follow through, and you explained it all very clearly. i have a couple of questions:

1) is there anyway to stop the java applet on the victim's computer after they hit 'run' once, so that the victim can access the internet again while you mess around and take control?

2) How do you terminate the ettercap spoofing/metasploit attack once you're done fooling around, so the victim can regain full control over his computer and internet access?

[thewariomanofdoom]

@forbiddensecrets1 Thank you for wording your questions well!

1) once you gain a meterpreter session, drop into the command prompt by typing "shell" and then type the command "ipconfig /flushdns" all without quotes.

2) click inside the terminal running ettercap and press "q" and it will stop.

[PlasticTeddyBear]

Great tutorial mate! I love your commentating :o subbed

[link9400]

can i use this method to hack computers that are not connected to my network?

[thewariomanofdoom]

@link9400 Yes. You can't DNS spoof unfortunately, but you can use this method still. PM for more info.

[Awesommedude]

What happens at 11:45? R u saying something imoportant? Couse I dont get any sound...Great tutorial! Subbing! Hope you do some new vids :D

[thewariomanofdoom]

@Awesommedude Haha I don't say anything important. The last option I was showing was dropping into a windows CMD on the remote computer. Thanks!

[o11111111n]

at 7:01 i only get addresses of other VM's also when using command ifconfig i dont get wlan1 or wlan0 only eth0 and lo

help would be fantastic

thanks

[thewariomanofdoom]

@o11111111n If you're using Backtrack in a VM, that's probably a problem. I don't deal with VMs, as you have to set up networking and bridging your adapters and such. It will be easier if you just did this off a USB.

[ggrade1]

what OS is running on the computer you have exploited?....I will appreciate your answer...

[thewariomanofdoom]

@ggrade1 It's OS is Windows 7.

[Mittt079]

did you have a easy way for me to get VICTIM IP's?

awesome video 5/5

[MoonChin100]

@Mittt079 Setup a PHP Script to make a log file of their IP, ask victim to open webpage.

[Mittt079]

@MoonChin100 ooohh ok then thanks dude =)

[MrJayrain19]

there was a problem brought up in one of the comments but was most likely resolved in a pm....after following the directions to the point there is an error i constantly get in SET after selecting the web attack vector option... IT will then ask me to enter the ip address and once i do SET restarts stating "Something went wrong, printing the error: I/O operation on closed file"....i appreciate any help.

[thewariomanofdoom]

@MrJayrain19 Try updating SET and Metasploit, as well as your Backtrack 5 R1 distro.

Upgrade backtrack by doing this:

apt-get update

apt-get upgrade

apt-get dist-upgrade

[benzappo1000]

when i try to upload the metasploit framework it says enter path to framework directory, what directory should i use

[oskarsshooting]

at 5:29 i get a error saying exit whatever is listening and restart SET.

i have restarted several times... still get error message please help. will sub for answer

[thewariomanofdoom]

@oskarsshooting This is strange. Are you sure that you have the most up to date version of backtrack, and that you have updated backtrack to its most recent version using the apt-get commands?

Type: apt-get update

then: apt-get upgrade

then: apt-get dist-upgrade

this will take some time, but will bring backtrack to its most recent version. Be sure to update metaspsloit and set as well.

[oskarsshooting]

@thewariomanofdoom thanks for responding :D. i have updated everything except the metasploit. is there a command to do that? ps. sorry for being a noob. really appreciate the help. pps. subbed anyway great channel

[thewariomanofdoom]

@oskarsshooting Change directory to the Metasploit directory like so:

cd /pentest/exploits/framework

Then once in that directory, type this:

./msfupdate

[AnonOps96]

My ettercap.dns is empty :/

[thewariomanofdoom]

@AnonOps96 It's etter.dns

Make sure you are entering the correct path as showed in the video, and make sure your backtrack is R1 version.

[robbo1985uk]

got the java page on my win 7 system, but no java popup

[thewariomanofdoom]

@robbo1985uk This might be due to your internet browser blocking the java popup.

[robbo1985uk]

another problem now, just gives page cannot be found on victim computer

[robbo1985uk]

just tested with the laptop and its working fine so im guessing its a driver problem, know any fix's?

[robbo1985uk]

seem to be having problems with he network dropping out or hanging or something says im connected but no webpages load, happends after Activating dns_spoof plugin... or its when it spoofs something back to me, im using a usb TPLink TL-WN821N with chipset AR9287 using ath9k driver, any idears? i was thinking maybe driver problem

[robbo1985uk]

also i downloaded bt5r1 32 and my wall paper just says backtrack 5, no R1 on it

[thewariomanofdoom]

@robbo1985uk Don't worry about it, I just have a special background that I got off the internet.

[genius260]

@thewariomanofdoom does it work only if your target is a windows machine or all OSs?

[aha9790]

hey my gedit is emply why ?? :D pls help

[thewariomanofdoom]

@aha9790 It shouldn't be. Check that you have installed ettercap and have entered in the correct path to the etter.dns file.

[aha9790]

@thewariomanofdoom ??? how ??? instal ettercap ?? pls help :(

[WindowsIP]

@aha9790

this can help u

h t t p : / /  ewangi.info/660/backtrack-5r1-­first-hot-review-bugs-fixes/

[mike199097]

Hey can i hack a iphone lol

[thewariomanofdoom]

@mike199097 No. Sorry.

[xcode18]

Does everything go back to normal when you connect to victim(interaction starts) ??

I mean does redirection of websites to your web server stops ??

[thewariomanofdoom]

@xcode18 No, you can do this though by pressing "q" while in the terminal where ettercap is running in. So when you get remote access, click inside the ettercap terminal, then press "q" and it will stop.

[HalomasterA69]

@thewariomanofdoom Well i use Backtrack 5 KDE, and when i wanted to edit that file, it wouldint let me, it just says no command, what do i do?

[thewariomanofdoom]

@HalomasterA69 This is because there is no gedit in Backtrack 5 KDE. I think kwrite would work instead. so you command will be:

kwrite *path of etter.dns file*

or you can just browse for it manually using dolphin file manager.

[HalomasterA69]

@thewariomanofdoom Ok got it, and are only these hacks for ur lan or for someone elses? Like maybe someone across country?

[thewariomanofdoom]

@HalomasterA69 These are only for your LAN.

[HalomasterA69]

@thewariomanofdoom So your saying pretty much most of the things u can do with backtrack can only trully work only for ur LAN? 

[thewariomanofdoom]

@HalomasterA69 No. You know, just PM me I'll tell you more stuff.

[SmithTEK11111000100]

nice entry level guide

[themegadevin09]

when i type in route it comes up with a ip adress that dosnt match the one i see when i look at my actuall net web and i type in net map it showes other ip adresses

[thewariomanofdoom]

@themegadevin09 You are going to have to be much, much more specific. Please PM me with the output of nmap copy and pasted, as well as the output of you typing route.

[themegadevin09]

ok so i got the eth1 to work but im using my desktop to attack my labtop and when i use the net map none of the addresses match the one im trying to attack

[thewariomanofdoom]

@themegadevin09 Make sure you are plugging in the correct router IP address for nmap.

[themegadevin09]

ok so mine isnt wlan1 or wlan0 its lo or eth1 and the both dont work

[thewariomanofdoom]

@themegadevin09 Don't bother with "lo" as that's just a loopback interface. Eth1 should work if all the other computers are wired as well, but your laptop should have a wireless interface for you to do it.

[juniorGs12]

@thewariormanofdoom

I'm right at my other notebook side, but sill ssometime it works sometime it doesn't, that's weird, like it shows that the dns spoof worked it shows like for example: youtube.com spoof to 192.168.0.1 and but the other notebooks seems normal! Post more videos of backtrack man, you are really good at teaching this congratz!

[JohnSmithTheSecond]

Great tutorial! Please keep it up!

[juniorGs12]

Hey what does it sometimes work and sometimes it doesn't?? Like it nerver works when i do the set up of the apache to ON... can you tell me possible reasons y it doesn't work? i do everything, it worked a couple of times, but then it doesn't work!

[thewariomanofdoom]

@juniorGs12 Get closer to the target computer, that will help.

[juniorGs12]

Thanks alot, very successful, only one thing, it keeps opening sessions because the person keeps clicking run, run how to once migrated to explore.exe make it stop opening sessions???

[thewariomanofdoom]

@juniorGs12 When you get a session, type: sessions -i 1

The other sessions won't matter, you can just keep them open. Once you are in a meterpreter shell, you can try: run migrate

[feniaxgiannis4ever]

i have a question.! The other pc must be connected to the same wifi net as my pc on not?

[thewariomanofdoom]

@feniaxgiannis4ever Yes it must be the same network.

[feniaxgiannis4ever]

@thewariomanofdoom thank you

[mike199097]

can u use backtrack 5 not backtrack r1

[thewariomanofdoom]

@mike199097 Yes, but it's inconvenient because that version is no longer being regularly updated and supported. To get the newest version of SET, type the following commands in the terminal:

apt-get remove set

apt-get install set

afterwards follow the rest of the tutorial. If you can, get Backtrack 5 R1.

[Khalidalhajj]

hello please help me, i got to the point where it says " Sending stage (xxxxx bytes) to 192.168.x.x

and this msg keeps on showing .

but the meterpreter session ...etc doesnt show :(

[thewariomanofdoom]

@Khalidalhajj I get this to sometimes. It's usually because you are too far away from the target computer.

[VladimirViskoff]

i have a problem configuring the attack with set and with ettercap. for the attack, after i select web templates i am not prompted to enter my victims IP address. it just jumps straight to which template i want. and with ettercap, i do everything like you did with my own variables, but after it says "Activating dns_spoof plugin..." nothing happens. i browsed on my target computer through several webpages. Do you know why this might be happening?

[thewariomanofdoom]

@VladimirViskoff This could possibly be that you have the version of Backtrack that glitches with DNS spoofing. Backtrack 5 R1 32 bit GNOME is the most reliable. DNS spoofing gets iffy sometimes, and it will work and not work. If you're doing this across a wired network, sometimes it doesn't work.

[VladimirViskoff]

@thewariomanofdoom

i am using a wireless network and an external card on my host computer. my target is my laptop using its built in card. i have been using backtrack 5 instead of r1, but i guess ill update and try again. ill let you know and thanks for the help =)

[VladimirViskoff]

@VladimirViskoff

k so i install BT5R1 and tried again but im having the same problem. i noticed something when i ran the ettercap command. in your video, it adds your router to group 1. mine doesnt do that, it just adds my target computer to group 2 and mentions nothing about a "group 1" could this be relevant? i was thinking maybe my host isnt poisoning through the router.

[SlayCrazed]

hey, can you make a tutorial on how to do this on a remote pc? like using the ip adress you can obtain through facebook or something?

[thewariomanofdoom]

@SlayCrazed You can do this on other computers outside the network, but you can't use DNS spoofing. PM me if you want more information.

[DJBethette0fficial]

@thewariomanofdoom I want more info! that would help me alot thanks =D can you PM me soon plz??? thanks.

[MonteLSV6]

I've gotten to the point here it says "Activating spoof plugin" but it just stays there. Why isn't it connecting? I'm doing this on my desktop pc (hardwired) and my laptop I have in my lap (wireless)?

[thewariomanofdoom]

@MonteLSV6 If you have backtrack 5 64 bit, it won't work. Make sure you also entered the correct ip addresses and that you are editing the correct etter.dns file and making the correct changes.

[MonteLSV6]

@thewariomanofdoom I got it, thanks! I had to type in my gateway lol....what else could you do whilte your in the meterpreter?

[thewariomanofdoom]

@MonteLSV6 You can do a lot. Best thing to do is to upload an actual keylogger, such as Project Neptune, so you can continue receiving logs from them.

[AmD992]

Hey .. works successfully! awesome man! .. but how can I stop java required when I migrate to explorer?

[thewariomanofdoom]

@AmD992 Exit out of ettercap after completing the attack, and when you gain access, type shell to get into CMD. Then type ipconfig /flushdns

[jpaulo400]

veja tambem serc: snap'yo java

[nnngggiii]

what about externaly attact?

thanks nice tutz

[rushman819]

Ive tryed this and after getting the

ettercap -T -I eth0 .... it start well, when i try to open a webpage for example youtube on the targeted pc it gives me this error

(send le error; 1555byte packet (0800.06) destined to 192.168.0.106was not forward (libnet_write_raw-ipv4(): -1 bytes written (message too long)

Can you give me a hint on this?? mabe this will help other too..?! loll

[thewariomanofdoom]

@rushman819 Does the targeted PC get redirected to the site you wanted it to redirect to? As long as it does, everything should be fine. I had that error message before, but it usually didn't get in the way.

[rushman819]

@thewariomanofdoom Yheaa..! example i type youtube the page loads up Then on my pc i see this kind of error pop up each time i load a webpage on the target pc, We are all conected to my dlink router, me plug in direct and the target pc on wifi, what could it be else ?

[navamoore]

Do you mind tell me how you got so good at linux commands?

[thewariomanofdoom]

@navamoore Hahaha thanks. Just try using the terminal more. Learn how to manage files in the terminal, such as moving, copying, deleting, making new directories, and such using the terminal. Also, learn to use tab completion, which will let you type a lot faster and makes you look like a boss.

[habaaab88]

thanks for these informations my question if i use wired connection

[pozkiemon]

super cool :)

[ximzaable]

who is this sexy boss???

[thewariomanofdoom]

@ximzaable Thank you XD

[B35TxKAVSTER]

does this work

[thewariomanofdoom]

@B35TxKAVSTER Yes this works very well.

[blackchidori34]

Hey I have 3 quick questions. This only works for when I'm spoofing a desktop or computer hooked up through ethernet. Is it supposed to let me get access to wireless connected computers as well? If so, how? And second say if i was gaining remote access to apple or linux, what would I migrate? I know in windows it's explorer.exe. Also how do i turn disable apache after this? I tried editing it again in "kwrite set_config" by turing it from on to off. Didnt work. Now I cant get facebook passwords.

[yoran108]

hey can i do this with the normal backtrack? i dont have the R1 version :(

[thewariomanofdoom]

@yoran108 Yup! Just be sure to update backtrack to the latest version by typing:

root@bt:~# apt-get update

root@bt:~# apt-get upgrade

root@bt:~# apt-get dist-upgrade

and then be sure to update the social engineering toolkit as well.

[prajwal2005]

Thanks a lot buddy:) There r many such videos bt the way u explained was crystal clear. Its the small things u said whch made the difference:)keep it up

[thewariomanofdoom]

@prajwal2005 No problem! This is what I seek to accomplish. Stay tuned and thumbs up if you like!

[infowaredm]

the 2 edits on the config files is what helped me thx. only video that pointed that small but very important part out. keep doing what your doing your a great instructor.

[thewariomanofdoom]

@infowaredm Hey man, thanks so much for the great comment! I try my best to point out those small details, as I myself was very frustrated with videos that failed to do this, so I will do my best to give to my audience something they won't be able to find.

[infowaredm]

@thewariomanofdoom no problem man. like I said just keep making videos. ill be here to watch..

[Salee1204]

Is there any script for automatic migration to explorer.exe, flushing DNS, and setting up netcat backdoor? :) It dont seem to be complicated task, its just few lines of code to input... any idea?

[dodielward]

when i select 1) Windows meterpreter reverse TCP ...it loads and after that it gives me ! Exit what ever is listening and restart SET..what does it meas??thnx a lot :D

[thewariomanofdoom]

@dodielward I would love to help you, but you will have to be more clear about your problem. Maybe PM me a screenshot so I can better understand your problem so I can help you.

[dodielward]

@thewariomanofdoom oh really thnx but i found the solution..but i have a small question and im sorry if i bother u..when i use nmap staff i write route to see my gateway number, the problem is that the use iface is still eth0 how could i change it to wlan... i already installed my wifi card..thnx

[thewariomanofdoom]

@dodielward Make sure that your wifi card is properly inserted. Check to see that you have internet connection with that wifi card. Then you can use nmap.

root@bt~#: nmap -sn *gatewayip*

[dodielward]

you r greaaat man really u are genius..:D

[doug60remixd007]

whenever i try to put in the wylan thingy it comes up with this "listening on wlan0... ERROR 19,no such device [ec_capture.c:capture_init:146­] pcap open: SIOCGIFGWADDR: No such device" please help asap!

[thewariomanofdoom]

@doug60remixd007 You entered your interface device incorrectly. Type ifconfig into a terminal to see your list of interfaces. Find the one you are using and use that for your interface.

[doug60remixd007]

hi, when you choose the payload bit mine doesnt have the "shell" one 04:21 please reply asap :)

[thewariomanofdoom]

@doug60remixd007 You have to remember to update the social engineering toolkit prior to doing the attack.

[hawkeye12289]

Ok thanks and great videos and comments keep it up!!!!!!

[Salee1204]

Great stuff, can you stop DNS spoof after migration to explorer.exe is over? So client dont get errors...

[thewariomanofdoom]

@Salee1204 Yes. Press "q", without quotes, in the terminal that ettercap is running in.

[hawkeye12289]

Oh and thanks

[hawkeye12289]

Man it works great on my end but my victim computer can't brows to any web pages after it keeps wonting to run the java update I won't my victim to be able to go on and brows the web

[thewariomanofdoom]

@hawkeye12289 Hey man, this is a slight problem with this style of attack. I can attempt to reduce the problem a little bit. Right when you migrate to explorer.exe, you can type "shell" to get in command prompt, and then type, without quotes, "ipconfig /flushdns"

That will flush their DNS cache. Oh, and make sure you stop the DNS spoofing attack right when you get remote access by pressing "q", without quotes, in the terminal that ettercap is running in. Then do the ipconfig thing.

[gnikola123]

Man I have a problem, when I do dns spoof, it says:"dns plugin can not be found !"

What should I do?

[thewariomanofdoom]

@gnikola123 Hey, I'm pretty sure I know your problem, but I'm not too sure. I believe it is because you have Backtrack 5 GNOME 64 bit, which is incapable of performing DNS spoofing. Switch to Backtrack 5 R1 32 bit.

If that's not the case, please send a screenshot of your error.

[gnikola123]

@thewariomanofdoom And I have to reinstall Linux or what? Sorry for anoying. :(