Hack Security Pro.pdf - Index of

We can see that CrashFr is now in bold characters! This means the HTML code is not filtered and well
interpreted by the client's navigator. From then on, the pirate will for example create a fake form in
HTML by using the url instead of the form. In the case of the above example, the hacker can display
CrashFr in bold characters by going to the following url:
css.php?nickname=CrashFr
Here is a URL that will display a fake form enabling the hacker to steal the login/pass of a client:
css.php?nickname=CrashFrPlease identify yourself : Login :Password :
Here is what the client will see on his navigator if he clicks on the link above:
The hacker must make his victim click on this link to have him believe that the form is part of the
website itself, which is in fact not the case. If the client falls for this trap, he will enter his login/pass and
when he clicks on “Sign-in”, this information will not be sent to the bank's website but to the
“recov_info.php” file on the “hacker server” server belonging to the hacker. Generally, the hacker will
use url encoding, the sending of emails in HTML and SE to trap his victim. Here is an example an
HTML email that the hacker could send to his victim:
Hacker Bank Paris
Dear client,
We would like to inform you that your transfer request has been taken into account, you can check your
balance account at click here. We thank you for your trust.
Yours sincerely Pierre Dupart.
Financial adviser for Hacker Bank Paris.
The Hackademy DMP -131/209- SYSDREAM