So I sent a valid username and Blind XSS Payload on the password field. After that I back to the first page and enter a username like “a” and I see the HTML tag works. But I did not find any important directory. I use ffuf for directory brute force and use SecLists for the wordlist. I think all these processes are automated. Someone asks about cyber security Ömer Çitak, One year later, the same account sends him phishing mail 🙃Īfter you enter your username and password, the website wants your email and password and then they can do everything on your account.
In one of his phishing messages, the scammer was sending a message to the Instagram user through the account named Inhelptechnicanalyse, stating that there was a copyright violation and demanding that the user visit and fill out a form to verify their account.Īfter the Instagram user name was entered on the web page, the profile picture of the user was downloaded and displayed in the background, in order to increase the credibility of the page for which the password was requested. I started on a website that you’ll see on the first tweet. So I started browsing these websites and understand how they stole credentials. When I am surfing on Twitter and Instagram, I saw tweets and stories about Copyright Violation messages, and nice to see that people are being aware of phishing (not all of them). Also, these websites are shut down because probably they understand the abnormal activities. So I decided to make research how scammers scam people and stole hundreds of Instagram accounts. I see many phishing websites and messages these days.
0 kommentar(er)
