View and vote on the article here: Hacking a bank (dexia.be) , not as difficult as you thought it was.
Hacking a bank (dexia.be) , not as difficult as you thought it was.| Category | | | Summary | | I've recently got a project from a bank. They asked me if i could hack their system, or at least get mony from an account. Normally banks are very secured, but in these modern times, banks often get too lazy for even double-checking their scripts. |
| | Body | Here's what i did:
Mapping the system
First of all i wanted to really get int o their system, so i tried
portscanners
, ping tools and such to map their system, but i got nothing. After that i tried to get to their web server. So i used the same techniques, but still nothing. So i did a
netstat dexia.be
command (since dexia.be is their website). Than i saw a masked line (with * * *). Now i knew they had a good configured firewall and that i probally couldn't do anything about it. So what can one do next ?
Finding bugs in scripts
I tried to find bugs in their netbanking script. After doing some research in their script i found this really cool url (which i'm not going to tell as they haven't updated their scripts yet). By going to that page. Several pages opened and i heard my computer trying to access my floppy drive. Aha ! This was a very improtant discovery, because now i knew that the banking program tried to get date from my floppy. Soon i found out those 3 files were: "userid.dat", "privkey.der" and "pubkey.der". These files had all the data needed to login. After checking the scripts again, i found that there was a 'hidden' frame window wich had the url: 127.0.0.1:xxxx. This was the page that accessed my floppy drive !
The bug.
Now i knew what to do. As 127.0.0.1 = localhost, i just had to replace 127.0.0.1 by my victims IP. Easy huh ? Now what i did was: i send a mail to a user (i found him on a help forum) telling him, that i was the webmaster and that i needed some data before i could help him. He replied and bang, i got his IP :) After putting his IP instead of 127.0.0.1 i could enter his netbanking account and basically do anything !
The lesson :p
Hacking isn't always breaking through firewalls and breaking into systems. If you've got some insight in scripts and you know some coding, you can hack as well as others can. Hope you liked it !
- ciri out - |
|
This article was imported from zZine. (original author: ciri)
There are no replies to this post yet.
|