0 Social Engineering via Phone to get Admin.

Phone Verify / Social Engineering via Phone to get Admin.
----------------------------------------------

Ok.. Simple tutorial..its hardly a tutorial.

This is just to people that don't understand what a Phone Verify is.

When you card a shop they sometimes call to verify the order and ask some details about the order and maybe some card details.


How do we do this..

Well there are 2 ways..1 easier then the other.

1. Skype or any other VOIP Provider thats cardable. - Easy
2. Card a Pre-paid Sim and phone. - Hard

We will use 1.

Ok it's pretty easy to card skype just goto it, make an account use socks for the country your going to be using.. so USA = USA socks.

Once you buy $20 credit they will give you a phone number.

Example number 800-675-8734

Now we have a number..all you need now is skype installed on your computer and a mic/headset.

When you card the store try do it in business hours that way the call will come asap and you will get it confirmed and shipped the same day.

So say we carded apple.com for a ipad.

We would get a fresh USA sock and put into the connection settings of skype.

When the order goes through make sure your on skype..leave it on your speakers or headset if your going to be on the computer for a while.

When the call comes through they will ask if your are the card holder, your address etc..and what did you order and what total $$.

Once it's verified they will put the order through.

This is also good for Social Engineering..

If you got information from a server like the admin's user and server information but can't get the password you can whois the site and get the Webserver provider info and then call the admin of the site and say your the tech team and you found out someone has been attacking customer's websites and would like to validate the admin's info..etc..

Then ask for them to change there password and it would be quicker for me to do it on the phone now and more secure just incase someone has put a virus on there site or computer.

When they give you the old password and a new one..login to there server via the web host and change the old to the new so looks legit and like the call was legit.

To make it look even more legit you could send a fake email to there email account under the webservers name and say that there password was changed and thank you for your service and help in the matter.

That's one the easiest ways to root a server

Hope this helps.

Written by Syncorion
Date: 11/06/2010

0 Spoofing Caller ID

What Is Spoofing Caller ID?

Caller ID spoofing is the practice of causing the phone network to display a number on the recipient's caller ID display/phone display which is not that of the actual originating station.

Just like email spoofing you can set a spoofed email that will be sent to a victim ; example: billgates@microsoft.com. But instead of email this is the Phone Network caller ID number so instead of sending our number "555-555-5554" we spoof it with a service to "111-111-1112" making it show up on the victims phone when we call them.

Some people use this for prank calls, some people use when they do telemarketing..But we will be using for Hacking/Carding.


How do you mean Carding/Hacking?


Well Lets do this in 2 sections..

1) Hacking.

To lets say Hack into a shop network online or root a server you can do this by social engineering, So lets say we did a Whois on a company.

For this example we use http://www.cygnett.com/

So we do a whois.. You can do this anyway you like but we will just use > http://whois.domaintools.com/

So we do the whois and the information we are looking for is:

Organisation Name
Organisation Address
Organisation Phone
Admin Name
Admin Address
Admin Phone
Tech Name
Tech Address
Tech Phone

So in this case we find all the information needed to hijack the whole site and database by simple Social Engineering and to do all this we will use Call ID Spoofing.


Organisation Name.... Cygnett Organisation Address. Level 1, 3 Newton Street Organisation Address. Organisation Address. Richmond Organisation Address. 3121 Organisation Address. Victoria Organisation Address. AUSTRALIA Admin Name........... Daniel Harper Admin Address........ Level 1, 3 Newton Street Admin Address........ Admin Address........ Richmond Admin Address........ 3121 Admin Address........ Victoria Admin Address........ AUSTRALIA Admin Email.......... Admin Phone.......... 03 9429 2552 Admin Fax............ 03 9429 2551 Tech Name............ Web Master Tech Address......... P.O. Box 13266 Tech Address......... 1300660603 Tech Address......... Melbourne Tech Address......... 3000 Tech Address......... VIC Tech Address......... AUSTRALIA Tech Email........... Tech Phone........... +1.300 660 603 Tech Fax............. +61.3 9370 0652
So What we would do is use Caller ID spoofing service to spoof our skype number to the Tech > 1.300 660 603

Then We can call Cygnett Owner on > 03 9429 2552 as we can see the admin is the owner in this case and in most cases.

So when we call we could say, that we are doing a Security verification check on customers due to a hack attempt on the networks and would like them to verify there username, current password, email address used to register to "fundamentalit.com Hosting" Owner's name used to register/pay for the site address...etc

Also you would need to try not act like a robot over the phone and never stutter or say "umm's" cause they will think its a fake caller, just keep your cool, and don't worry if you can't speak heaps of English because so many people around the world employee Admin's/Help desk from overseas.


2) Carding/Shipping

This is a smaller section as its not as hard to explain.

Lets say we had a CC and you were from UK but the CC account phone number was USA.. well you could setup your skype in UK to spoof to the victim's number..example:

John Doe's billing Address Phone Number is "300-444-8004" our number is "98-999-9807" So we would use the Caller ID Spoofing service to spoof our number to the Phone number of John Doe then we can call to verify orders if needed.

The Best service I think to use and its also anonymous is called Blufmycall

Site: http://blufmycall.com/

Its around $10 for 60 credits "minutes"/ $100 for 775 credits "minutes" and that includes unlimited caller ID changing..so you could keep changing it to what you want.


Have fun..Keep Cool..Fuck the Feds.
By Syncorion - Yes I am a Bitch you better know it.