Confessions of a wanna be hacker

All I have ever wanted and strived to be is, a grubby little hacker. Those three words written indelibly in my mind:

grubby little hacker

Always lower case. In fiction they were smart, they were generally physically weaker than their antagonists. Clever won the day though. I became enamored with the idea after the advent of getting my first computer, an IBM PS/1 486 25 Mhz, Both types of floppy drives. A machine, that when it's broken doesn't get mad. You can work on it, and not get yelled at. As long as you don't get angry you can keep trying any solution until it's fixed.

My first experience fiction withstanding with anything even "hacking" related, was when I was young probably mid to late 90s. I needed a fresh install of Windows 95, and I didn't know what I was going to do. I didn't have an install disk from my current computer. And I was telling my friends about my woes and he said no problem he had a copy. His dad had a copy of Windows 95 on diskette. I don't remember the actual number of disks but at like 12 years old, I think I believed there was about 90 of them. But seriously installing windows 95 from diskette was an all day experience. It took like 8 hours because the disks were slow and every so often you would have to change one out. I wouldn't see a windows disk with a holograph on it for another 10 years. I think once we got installed we hooked up a null modem and played doom or something. Cause you know, there ain't no party like null modem lan party.*

About this same time I had my for dip into programming, thanks to a seriously outdated computer lab. It was the 90s, but they had a complete lab of full working Apple IIe's. They were awesome. I learned how to type in 6th grade and Basic in 7th. By 8th they replaced the entire lab with the multicolored mac's. But I knew after watching the cheesy videos about "Don't copy that floppy" and various other warnings of hackerly things in the class. That's what I waned. To own the machine.

We had the internet briefly at my home for a while, but my dad decided he didn't want to pay for it anymore. I ended up shoulder surfing dial up account usernames and passwords, from anyone's house that would let me near there computer. So I still had internet. At the time there was a free service called Juno that allowed you to connect to there service and download email then immediately disconnect. I used this as a cover for my parents if they ever picked up the phone and heard the modem cranking away.

In 1999 I installed my first linux install. I stole the cd out of the back of a book, from booksamillion...you know cause it's difficult to download an os over dialup. I didn't know how much different my life would be. My mentor and friend at the time had told me about linux and though he had some enthusiasm at first, he would eventually move to windows 2000. I would as well but I always kept a frankenbox with linux on it, I knew it was going to be important. And my best friend at the time whenever I was working on it, or trying to learn my first scripting language (perl), he would call it "fake work."

In high school, I was a decent student, but I never did homework. I kept a more or less A/B average :). At night I was sleeping 3 maybe 4 hours a night either reading novels, tech manuals or working with the computer. In High School, I got in trouble a bit more than I care to admit. One day I had written something the administration didn't like, and they informed me they were going to call my parents, so for the remainder of the week I tied up the phone with the modem. My principle asked me if I told my parents about it, I said I had and nothing else came of it.

The towers came down, while I was in programming class. In the very same programming a class a group of friends and I shoulder surfed the Teacher's password. They all got in trouble for using the password at their desks. My machine showed no such usage.

High school ended. There was a break up with a girl, and a partion magic accident. I decided I wasn't using computers anymore. My personal life got dark. A theme of things to come.

Two years after that decision, my dad told me to "get my shit together" or else. And suggested I start going to school somewhere. I briefly looked into medical assisting. Ultimately deciding maybe I have to get back into computers again. There was a computer networking and security program, and I thought, security, and

grubby little hacker

echoed in my head again. During and after school my career would take off. In my downtime I wrote a piece of malware that I distributed as a credit card number generator(I still can't believe people downloaded and installed this thing). And created a small bot net, I mostly used to harass the installers of the program with the vbscript voice on windows.

I can remember the first time I used metasploit to solve an actual real problem at a job. And I can remember in between jobs being poor and cracking wifi networks just for internet access. Shortly after I would write webscrapers, for a semi-reputable company wanting to fill there databases with other peoples data. And then managing cloud servers for high availability sites, in the mid to late aughts. And then doing various dev and linux admin roles. Still toiling away after hours on various projects including shells, or what not.

Am I hacker, did I become what I wanted? It doesn't really matter what anyone says I don't think I'll ever believe it, I either have the worst case of impostor's syndrome ever, or I will just keep striving for the unobtainable.

You know what, I don't think I've ever written an exploit...I think I'll go do that.

*To be honest I don't think we got doom working, but we did get a file transfer going, much to the regret of FM radio listeners in a block radius.

Phishing Tutorial

Crow, a friend of mine made this phishing tutorial:

9unkz0r.com Forums: Phishing Tutorial
I don't do the phishing thing so I am just going to post his.

A link everyone should already have

http://www.phenoelit-us.org/dpl/dpl.html

Default password list. Go to their site, read about phenoelit, then get that list in your memory.

Facebook passwords?

When logging into facebook your login account name/email address is passed of in login_x, there are the three more variables. One of them is most likely the password. c_user appears to be your facebook user id number. h_user and xs are unknown. I believe one of them is an encrypted version of the password and I don't know about the other.

I made a fake account with these user credentials.
login:bsdpunk@gmail.com
Password:Mosssalad

These are the returns
login_x=bsdpunk%40gmail.com
c_user=1089782116
h_user=9856f1ae07ca
xs=d771ba051a12a4ad7c5f898d71a1482a

So if you want more info to deal with here is how you capture your own stuff. Open wireshark, and start sniffing. Login to facebook. Once you are done stop sniffing. Right click on your first http packet, probably coming from a 204.x.x.x click follow tcp stream. If you make a fake facebook account to do this, and you feel like sharing please send me the same variable information I have provided here. The c_user and h_user stay the same, the xs is different.


This post would have been more thorough but, work calls, and I just got my eeePC. Bleh. Maybe more tommorrow.


EDIT so I looked at the source and it looks like it's passing some

EDIT login stuff to ssl and there is a shit ton of Javascript

EDIT that I didn't go through, so in closing I would like to say

EDIT that I feel unqualified to talk about this subject.