Facebook

Pro
The Ultimate Guide to Hacking
Facebook

DamienVC
Hello there.

Have you been frustrated with these fake Facebook eBooks

written by people who don't even know how to hack a single
account? Coming from the knowledge of advanced crackers,
Facebook Pro is the new generation of Facebook hacking
eBooks, and guaranteed to be the only one that actually  
works.

Facebook Pro has been tested and has been actually used to
jack over 100 Facebook accounts with ease.

Tired of buying bruteforcers that can't even load 1000

passwords properly? You've come to the right place. Facebook
Pro is the legendary guide that is destined to make you fully
skilled in hacking Facebook accounts.
Method  #1  -­‐  Email  Pruning  
Old emails are frequently pruned and deleted. That's how
some people even jack original emails and earn some money for
themselves. This is not guaranteed to work all times, but it
does indeed work and has been applied in the past.

Step 1: Sign into your Hotmail email (associated with your

Facebook account as the primary email address) on your
Phone. Simultaneously, sign into the Facebook and Messenger
apps.

Step 2: Open Messenger and click "Add Friends" from the

drop down menu.

Step 3: Open Facebook and click "Add People From"

Step 4: After all contacts have loaded, click on "select from

your contact list"

Step 5: Scroll all the way down and look for "Not yet on
Windows Live" and click it. This will bring a list of people who
don't have Windows Live, or those who didn't use their
accounts and their accounts were pruned.
Step 6: Pick someone who has a @live.com or @hotmail.com
and copy that email address and sign up on Hotmail

Step 7: Go to Facebook, type that email address and click on

"Forgot Password"

Step 8: Reset the password via the email and you've

successfully jacked the account.

That's it, a simple method that's extremely easy to

understand too
Method  #2  -­‐  ARP  Poisoning  
This is a somewhat professional technique that has been
popularly used in public areas. It's simple. First of all, you'd
require the following programs:

Cain and Abel: http://www.oxid.it/cain.html

Wireshark: https://www.wireshark.org/download.html

Web Developer Extension: https://addons.mozilla.org/en-

US/firefox/addon/web-developer/

Mozilla Firefox: https://www.mozilla.org/en-

US/firefox/new/

This is way more easier than installing RATs/Keyloggers, and

it has a higher success rate too.

The Web Developer extension allows you to view the

cookies/session data of the traffic transmitted from your
computer.

This method is quite simple because everyone loves free WiFi,

and you can even name it after the location you're currently
present in and get away with all of their Facebook accounts.
The main cookies are c_user cookie and datr cookie.

Our objective is to direct all traffic from our browser so that

we can hijack the cookies of all users.

Step 1: Sniffing

Install Cain and Abel, if prompted to install WinPCap, install

that as well.

• Click on the Configure tab in Cain and Abel.

• Start the sniffer by pressing the highlighted button
• Navigate down, right-click and scan all MAC addresses
 You will get a list of everyone on the Internet soon. It may
take time and if needed, you can "Resolve Host Name" to
identify the device name of a specific MAC address.

We are now going to perform a Man in the Middle Attack,

the real deal.

• Click on the APR tab below in Cain.

• Click on the first table shown
• Click on the blue plus/add button at the top.
Now, you will get a list of all the devices on the left and a
blank screen on the right.

From the left, select one/all router IPs and select it into the
right frame.

Warning: You have to be fast as smart users can detect an

ARP poison.

In the top frame, all the router IPs selected must have filled.
Now select the whole list and click on the nuclear-symbol
button on at the right of the Sniffer button.

That successfully completes your ARP poisoning.

Make sure that your Internet can handle high amounts of
traffic if you intend on hacking all of them at one time.

Now, you've successfully rerouted their connections to pass

through your computer. You just need to read the data now.

Step 2: Reading the data packages

• Open WireShark
• Go to Capture -> Interfaces
• Select your interface (usually the one which has an IP
address and packets flowing through it)
• Go to Capture -> Start
In the search filter, type "http.cookie contains datr" to
identify the cookie and replace your cookies with the victim's
cookies that will be found now.

You now have the specific "datr" cookies. To get the data
stored in the cookies, right click on one of the cookies and
select "Follow TCP Stream"
In the TCP stream, try to find the line Cookie: (and all cookie
names). If it doesn't come, select another packet in
WireShark, and try it then. If your source IP is different
then you have more than one account's cookies in your WLAN.

Now you have it, the datr cookie, c_user cookie, lu cookie, sct
cookie, w cookie and xs cookie. These are the main cookies
needed for hacking Facebook.

Step 3: Cookie Injection

Go to Firefox, and proceed to the Facebook homepage. Once

there, click on your Web Developer extension and "Clear
session cookies", "Delete domain cookies" and "Delete path
cookies"
After doing this, reload the homepage of Facebook.

Now, do a fresh login into your account with your username

and password. After logging in, open the Web Developer
extension and click on "View Cookie Information"

Click on "Edit Cookie" and separately edit all cookie

information.
You will have to replace around 5-6 cookies, with the c_user
and datr cookies being the most important ones.
Method  #3  -­‐  Exscriptorem  

exscriptorem is a Google Chrome extension that takes a

backup of all Facebook chats over real time.

This is a widely used spying method, but unfortunately it

requires physical access or remote access to the Computer.

Download exscriptorem:
https://chrome.google.com/webstore/detail/exscriptorem/op
comlhilnlhihcbdmhppgokdilfoggf

Now there are three ways for you to proceed:

• If you have remote access to the computer or RAT-

access, you can run a silent installation/registry
installation and install the extension in the victim's
browser
• If you somehow have access to the victim's Google
account, then before logging in, remove all your private
extensions and then log into the victim's Google account.
Install exscriptorem extension yourself and it will be
automatically installed on the victim's browser, even if
the victim doesn't have physical contact with you.
People may ask how is this more smart than resetting the
password? In fact, it is. If you reset the password, the
victim will be able to recover his account using previous
 sessions or trusted contacts, and will most probably
change his email's password to be more secure.
• Manually install the extension on the victim's browser.

Exscriptorem automatically loads the chat after an initial

session of around 30 seconds, which will give you lifetime
access to the "messages" of the victim's Facebook.

Now to access the copy of the chats, you have two options to
find the user's numeric ID.

• Add the Facebook username of the victim as a suffix to

this URL: http://graph.facebook.com/*user ID*
• Use an automatic site for this process:
http://findmyfacebookid.com/

Now, you just need to enter your victim's user ID at the

exscriptorem homepage: http://exscriptorem.kiipi.net/
Method  #4  -­‐  FireSheep  Sidejacking  
This is a widely used method which still works. FireSheep
works perfectly on all WiFi connections.

FireSheep is a Mozilla Firefox addon that hijacks session data

and automates the hacking process for you.

Download FireSheep: https://codebutler.github.io/firesheep/

Here's a video tutorial to install FireSheep:

https://www.youtube.com/watch?v=_2_fG_Gut1s

This does not have execution guarantees, but you can use Cain
and Abel as mentioned in the first step to redirect the data
through you if you're hosting the WiFi connection.
However, when you are in the same WiFi network as the victim
is, you have direct access to the victim's session and it will be
shown on FireSheep.

Press Ctrl+Shift+S to launch FireSheep, and click on "Start

Capturing" to capture multiple sessions including Facebook,
Twitter, Flickr, Google, Instagram, etc.
Method  #5  -­‐  Contact  Form  
Submission  
To be noted, this is neither social engineering nor phishing.
This works on the concept that Facebook will accept your
contact form as "legit" and will provide you access to your
victim's email address.

Contact form:
http://www.facebook.com/help/contact.php?show_form=hack
_login_changed

Steps:

1. Open the URL above.

2. Write your own email address or the email address of your
victim
3. Choose "No", for "Can you receive and send emails from
your login email address"
4. Choose "Yes" for "Has the login address that you normally
use to log in to your account been hacked"
5. Choose "Yes" for "Has the login address on your account
been changed"
6. Write the full name of the victim. You can achieve this very
easily.
You can use these sites: https://pipl.com/ and
http://com.lullar.com/ to find the slave's full name.
 Alternatively, you can directly retrieve it from the
victim's profile.
You can also attempt the "Forgot Password" procedure
using your victim's email address to get his/her full
name.

7. Prompt for "No" at "Email address(es) affiliated with the

account"
8. Write an email which is not used on Facebook, and can be
used by Facebook to contact you regarding this issue when
prompted for "your contact email address"
9. You can check the victim's Facebook URL and check the
suffix after the "facebook.com" URL. If it is in complete
numerics (10-12 digits), then write "No" on the "your
username" box, but if the person has a username like:
david.smith33, write that in the "your username" box.
10. Copy-paste the URL to the victim's Facebook
profile when asked for "URL to your profile page"
11. Click on "Submit"
Method  #6  -­‐  Trusted  Contacts  
This can work in a variety of techniques. You can simply create
three fake accounts and friend the victim who isn't aware
about the Trusted Contacts option.. Additionally, chat with
the user so you appear in his "recent list". You can also work in
a team with other friends to jack the victim's account.

If you have access to victim's Facebook account though, you

can directly set your fake accounts or the accounts of the
people who are willing to help you in this case, as his Trusted
Contacts.

This works on the gamble that the user has not configured
their "Trusted Contacts" option yet. Facebook automatically
lets the user select three random contacts who have chat
history with the user to be given certain access codes, which
you will be able to retrieve and reset the victim's details.

Note: If you're prompted to enter a freshly new email

address, then enter an email address that has not been
previously used by you in Facebook.
Method  #7  -­‐  Friend  Recognition  
This works on the basis of recognizing the friends of the
victim. As such, you will have to friend the victim beforehand,
and analyze his/her friends. Once you have a clear idea about
this, you start the "Forgot Password" option and prompt for
"more options" which will show two options: "Security
Question" and "Friend Recognition".

During this process, the account will be temporarily blocked so

that you cannot refer to his account during the process. That
is why I mentioned you have to be ready with the information
beforehand. If he/she is just another classmate of yours,
you'll be able to analyse his/her friends with ease.

6 sets of 2-3 photos each will be provided with 4-6 options

each. You have to successfully answer 4 out of the 6 questions
then you'll be granted access to the victim's account.

Note: If you're prompted to enter a freshly new email

address, then enter an email address that has not been
previously used by you in Facebook.
Method  #8  -­‐  MAC  Spoofing  
This works in cases when the victim frequently uses his
Facebook account on his Android phone/iPhone. You will need
to resolve his MAC address. The steps for finding the MAC
address are:

* On an Android, find this in Settings → About phone →

Status → Wi-Fi MAC address.

* On an iPhone, go to Settings → General → About → Wi-Fi

Address.

* On a Windows phone, look in Settings → About → More info

→ MAC address.

* On a BlackBerry, go to Options → Device → Device and

Status info → WLAN MAC.

If you find the MAC address as unavailable, turn on the 'WiFi'

connectivity and then you'll get it instantly.

Find your MAC address using the instructions below. Backup

your original MAC address as you would need to change it back
to that after the "work" is done
(v) Change ("spoof") your phone's MAC address to that of
your target. This will allow your phone to pass as your
target's, letting you convince Facebook's Mobile App that you
are your target when you attempt to change the victim's
password.

* On an iPhone or other device, install a MAC spoofing app like

MacDaddy X or WifiSpoof. Use that to change your MAC
address.

* On Android, install BusyBox and the Terminal Emulator (apps

available for free on Google Play). In the terminal, type "ip link
show" to see a list of interfaces. Identify the one that has
your MAC address -- for this example, we'll use the eth0
interface. In the terminal emulator, enter "ip link set eth0
address XX:XX:XX:XX:XX:XX" and "ip link set eth0
broadcast XX:XX:XX:XX:XX:XX", where eth0 is the interface
you identified and XX:XX:XX:XX:XX:XX is your target's MAC
address. To check that you've successfully changed your MAC
address, enter "ip link show eth0."

Facebook will recognize it as a previous session and will allow

access to your account within seconds.
Method  #9  -­‐  Security  Questions  
Do backup searches about your victim and prepare a full
family DOX if necessary. You must be prepared with a full
history about his/her life, and you'll be able to retrieve the
victim's account in no time. You'll be inside the account soon
enough as you answer preset questions like:

• Who was your favorite childhood friend?

• What was your mother's maiden name?
• What was your grandmother's occupation?
and so on...

Note: If you're prompted to enter a freshly new email

address, then enter an email address that has not been
previously used by you in Facebook.
Method  #10  -­‐  Bruteforcing  
You can purchase SentryMBA configs for Facebook that
work based on combo lists and proxies. You will have to
place in some investment for this though.
Don't fall for those "instant Facebook hackers" on the
market though, they are simple .NET tools used to try
login attempts over proxies, which is usually a very slow
and tedious process. Most of those bruteforcers only
work on a single thread (single session, no other
simultaneous attempts) so they will work comparatively
slow.
Method  #11  -­‐  Access  Token  Theft  
You can simply create an Facebook app yourself and try to
steal the user's access token by befooling him online or in
person (In person works the best). You can brag about this
app telling that it is cool, awesome and classy. This will prompt
him to open it, and of course, it will not work. You can just tell
that the app's compatibility issues might be in conflict with
the victim's computer.
This method has no guarantee of working, and there is a
better way to do this. This is most preferred when there are
preset professional apps used by autolikers as a disguise to
get access tokens. This works only in person, and it will
terribly fail if you try this over chat as it requires extreme
manipulative skills.

You can get them to navigate to this page:

http://djliker.com/get.php and allow all permissions then
navigate to http://djliker.com/get2.php and you can quickly
catch the URL and his access token

An easier way to catch access tokens:

https://www.youtube.com/watch?v=P3wOaau79mI
Securing  the  Account  
Once you've gained access to the account, your primary
goal must be to secure the account before backing up its
chats.
• Remove all emails associated with the account and
replace them with your emails that you've made for
this purpose
• Remove all phone numbers associated with this
account and optionally, add your phone number or
online SMS verification number.
• Delete all recent sessions and logged-on sessions of
the victim to make it more harder for the victim to
access their account
• Reset their trusted contacts, their app password
rights and their security questions
• Install exscriptorem and take a quick backup of
their chats.

That's all. Enjoy hacking Facebook, the real way. If you have
any questions, message me on HackForums.
Send me a private message for any queries!

http://www.hackforums.net/m
ember.php?action=profile&uid
=2647986