Recently I wanted to turn my RickRolling pineapple into an automatic Phishing Pineapple, per the instructions on the Hak5 site (http://hak5.org/hack/pineapple-phishing). Those instructions work for both Twitter, and Facebook phishing, but you can easily see how you could extend it to gmail, MySpace, yahoo, etc, etc.
I had a bit of trouble at first getting my pineapple to work (specifically, it wouldn't redirect php pages). It turns out that the instructions on the Hak5 site didn't mention removing the semicolon from line 277 of the /etc/php.ini file, which is required to redirect pages. But after I found this trick out in the forums, I was up and running.
One note is that while this phishing worked great in testing agains my Chrome on my Windows box, it didn't redirec either my Backtrack 4 R2 box, nor my Ubuntu box. After some testing, it didn't seem to work on my no-script crippled Firefox or JS-non-enabled IE on Windows either. So you have to have a pretty open browser for this to work.
Still, as most users have JS on, and don't use no-script, I think it's a pretty good attack. I added not only Facebook and Twitter, but Gmail, Yahoo, MySpace, Hotmail, and eBay to the Fon, and made Google the homepage. The gmail link on the Google page even works!
Pretty decent system for a self-contained Pineapple!
I had a bit of trouble at first getting my pineapple to work (specifically, it wouldn't redirect php pages). It turns out that the instructions on the Hak5 site didn't mention removing the semicolon from line 277 of the /etc/php.ini file, which is required to redirect pages. But after I found this trick out in the forums, I was up and running.
One note is that while this phishing worked great in testing agains my Chrome on my Windows box, it didn't redirec either my Backtrack 4 R2 box, nor my Ubuntu box. After some testing, it didn't seem to work on my no-script crippled Firefox or JS-non-enabled IE on Windows either. So you have to have a pretty open browser for this to work.
Still, as most users have JS on, and don't use no-script, I think it's a pretty good attack. I added not only Facebook and Twitter, but Gmail, Yahoo, MySpace, Hotmail, and eBay to the Fon, and made Google the homepage. The gmail link on the Google page even works!
Pretty decent system for a self-contained Pineapple!
Comments
Post a Comment