[Anima Templi]

Back trace keyloggers

In this tutorial i will be showing you how to reverse or trace the owner of the keylogger.

There are two ways the hacker can send the information from the victim to himself.

Email: Where the hacker configure the email ID and the password while he’s configuring the keylogger. The keylogger records the keystrokes in a tempfile and sends it to the hackers Email.

FTP Server: The hacker setup’s a FTP server where he receives a text file containing the recorded key strokes. It is usually labeled on the basis of the current system time stamp.


If we monitor all data packages we can easily scan for one of these and then we’ll have the hackers email info or FTP info. Highly skilled hackers would of cause not allow you to do this, so they create a separate email account or FTP server which leaves no traces back to them. But skids or novice hackers that don’t have much experience would be more likely to use their own email address.

To this method we will use a program called Wireshark. Wireshark is a very famous network scanning tool, which is used by hackers or network forensic experts to monitor the packet flow of their network card. A packet is a bunch of data.

There are five steps in this method:

1. First of all download Wireshark by search for it on Google. Remember: While Wireshark is getting installed ensure, that it also installs Winpcap, otherwise this method won’t work properly.
   
2. Go to the “capture” –button in the top menu of the Wireshark and select the interface.
   
3. It will now start capturing the packet that is being sent through your network card. I would recommend you to do that for at least 20 minutes for getting the best result.
   
4. Now you need to filter the results, so you’re just getting the information you will need. To do this goes to the filter box and type FTP and SMTP one by one. If you get records for FTP the hacker has used a FTP server to retrieve the records. And if you didn’t get any results the hackers has used SMTP.
   
5. Now scroll down until you find the “FTP username” and “Password” for the hackers FTP account in case that the hacker has used a FTP server to receive the recorded logs. In cases where he has used SMTP you will find “email” and “password” for the email account.
   

Note: This won’t work in all cases. The highly skilled hackers will be able to hide their tracks, and you wont be able to track them down. Also if you have a FTP server where you have connection you will also find that connection.

[muhammad fakir]

Nice i am hacking my fren fb used keylogger...
I am doing this for his future bcoz he not focus on study but always online with fb...

[Anima Templi]

thanks! That is not a valid reason for stealing his creditials for Facebook. The best way would be to talk to him about it, and tell him that you think he should focus more on his studies.

[3r3bus]

Really great tutorial, Bookmarked for sure

Nice i am hacking my fren fb used keylogger...
I am doing this for his future bcoz he not focus on study but always online with fb...

This is considered blackhat and is not acceptable on HC. What you do outside of the forum is not our business, but do not post blackhat related posts on HC. Consider this a verbal warning and I shall take no further action.

thanks! That is not a valid reason for stealing his creditials for Facebook. The best way would be to talk to him about it, and tell him that you think he should focus more on his studies.

Agreed!

[Anima Templi]

Really great tutorial, Bookmarked for sure

I am really glad that you found this useful! :yes:

[Flawless Crimson]

Great tut bro.
I think I'm going to have to try this out! I might be logged ^^

[Anima Templi]

thanks bro, I hope that you are not infected

[Dashing Dave]

Thank You For The Share.

[Anima Templi]

Your welcome!

toshortmessage