[devontae]

Today I show you how to hack PayPal Accounts very easy.

The Way is not complicated but takes a bit time.
I hacked my first PayPal Accounts a few years ago like that,
and sometimes I do it nowadays aswell cause I grow an have coded a script which tries everything itself so i dont have to invest much time.

What you need for this

# You need to practice SQLI

- Maybe you are able to do manual if not use sqlmap or something
(if you use SQLMAP or something, try to do it manual its not hard as you think)

# You need Proxys and Socks

- Make sure that you always use a High Anonymous Proxy

Lets start

First you have to find a SQLI Vuln Online Shop.
(If you dont know how to find them, google it)

The best shops are those which only accept PP and Banktransfers. But you can choose every shop you find with a vuln.

Get in the DBS and look for the customertable. Make sure that you grab/dump every detail of the Customer.

Firstname
Lastname
Street
City
Country
TEl
Email
Username
Password
etc

If you have all infos choose the right located Proxy + Socks and try to get any PayPal Account.

Open Paypal.com and try to login with the CustomerEmail and the CustomerPass. Many people choose the same pass for every Website.

You see thats pretty easy and not harder than hacking with google dorks

I got good PP´s in past with that beginner methode.

So my Newbies. - Enjoy it


if you require services of a certified and experienced ethical hacking for your general ethical and specialized Hacks with proof, or
Have you been cyber bullied or cyber stalked?
-Find out if your boyfriend, girlfriend or spouse is cheating
-Need ammo for a divorce
-Track a stolen computer
-Track a stolen iPhone or Android phone
-Track a person
-Passwords
-Did you forget your password?
-Email cracking
-Windows and Apple Password
-Cracking
-Website Password Cracking
-Database Password Cracking
-Has your Facebook, Twitter or Google+ account been

hacked?
-Do you want to install spyware on a cellphone or computer?
-Do you want to know if you have spyware on your

computer?
-Remove A Link
-Mugshot Picture Removed
-Blog Link Removed
-Google Link Removed
-Locate Missing People
-SSN Trace
-Address History
-7-Year National Criminal Database Search
-Courthouse Verification of Criminal Database Records
-National Sex Offender Registry Check

At gray hat hackers community, we bring the best out of you

NOTE
We Offer Expert training and hacking servicesand Pin Generation Clear criminal records, university upgrade, Facebook hack, instagram hack, WhatsApp hack with our e Book and online tutorials
* Is your partner cheating on you, we can teach you how to Hack into their phone, monitor their text and conversation.
* Hack and use Credit Card to shop online,book flight tickets
SALES OF HACKING SOFTWARES & ONLINE TUTORIALs

Contact the best online Hacker

Dis,cord ID: holyhck#1248
skype ID : gray hathackin
whatsapp : +1 682 302 5207

[slothic]

Password are usually encrypted in sql databases and most of the time other details so you'll need to bruteforce the encryption key.

[devontae]

This why am an hacking dude it a protection

[mothered]

Password are usually encrypted in sql databases

The majority are not. I've personally compromised over 3k and can confidently say that 80%+ are not encrypted.
This Is one example of a pretty big broadcasting service:

Spoiler:

I've found In major organizations, such as Fortune 500 companies, they do In fact encrypt all user passwords.

[Nil]

Password are usually encrypted in sql databases

The majority are not. I've personally compromised over 3k and can confidently say that 80%+ are not encrypted.
This Is one example of a pretty big broadcasting service:

Spoiler:

I've found In major organizations, such as Fortune 500 companies, they do In fact encrypt all user passwords.

A shame. Should be illegal in 2018 to store plaintext passwords. By encryption, do you mean non-plaintext? Encryption by itself in this context carries some assumptions, which would conclude that you've been able to determine that the companies passwords were the result of encryption vs hashing. That would still be just as scary as plaintext in my opinion. But I'm assuming you meant encrypted as in non-plaintext.

[mothered]

Password are usually encrypted in sql databases

The majority are not. I've personally compromised over 3k and can confidently say that 80%+ are not encrypted.
This Is one example of a pretty big broadcasting service:

Spoiler:

I've found In major organizations, such as Fortune 500 companies, they do In fact encrypt all user passwords.

A shame. Should be illegal in 2018 to store plaintext passwords. By encryption, do you mean non-plaintext? Encryption by itself in this context carries some assumptions, which would conclude that you've been able to determine that the companies passwords were the result of encryption vs hashing. That would still be just as scary as plaintext in my opinion. But I'm assuming you meant encrypted as in non-plaintext.

Correct, encrypted form not In plain text.

I agree It Is a shame and most Importantly, alarming to say the least. Given It's a commonality for users to use the same password for most of their online accounts, they can also be compromised. I have countless user:pass, email:pass entries (from the back-end that I've personally breached) and tested them on all major websites. I'd say around 60% were used.

The majority do not have a password complexity requirement nor a minimum character length, hence allow sequential chars and commonly-used passwords. You can see my password entry In the above Image of "1337". Four characters that's (In hacker parlance) commonly-used.

[Nil]

The majority are not. I've personally compromised over 3k and can confidently say that 80%+ are not encrypted.
This Is one example of a pretty big broadcasting service:

Spoiler:

I've found In major organizations, such as Fortune 500 companies, they do In fact encrypt all user passwords.

A shame. Should be illegal in 2018 to store plaintext passwords. By encryption, do you mean non-plaintext? Encryption by itself in this context carries some assumptions, which would conclude that you've been able to determine that the companies passwords were the result of encryption vs hashing. That would still be just as scary as plaintext in my opinion. But I'm assuming you meant encrypted as in non-plaintext.

Correct, encrypted form not In plain text.

I agree It Is a shame and most Importantly, alarming to say the least. Given It's a commonality for users to use the same password for most of their online accounts, they can also be compromised. I have countless user:pass, email:pass entries (from the back-end that I've personally breached) and tested them on all major websites. I'd say around 60% were used.

The majority do not have a password complexity requirement nor a minimum character length, hence allow sequential chars and commonly-used passwords. You can see my password entry In the above Image of "1337". Four characters that's (In hacker parlance) commonly-used.

Thanks for the clarification. You're right about re-using passwords. A breach of your system has consequences further than the data revealed in your own system whether you want to bear that burden or not. Maybe it's wrong to blame the applications and blame the users in that regard, I don't know. I don't have a strong opinion on that yet.

I know internal UIs are generally simplistic and messy since you don't need the same care that customer-facing pages require, but judging by your pic it just looks to be like a typical legacy enterprise application UI. A lot of these companies have not kept up with the times. They don't value developer labor, thus their services suffer and situations like you posted occur. Things don't get updated and vulnerabilities aren't a priority when developers are considered your cost center and are treated as such. Not to mention, such places are rarely recruiting new, competent developers because no one wants to work with unmaintained, legacy spaghetti code while being treated like an uneducated expense source.

[mothered]

A shame. Should be illegal in 2018 to store plaintext passwords. By encryption, do you mean non-plaintext? Encryption by itself in this context carries some assumptions, which would conclude that you've been able to determine that the companies passwords were the result of encryption vs hashing. That would still be just as scary as plaintext in my opinion. But I'm assuming you meant encrypted as in non-plaintext.

Correct, encrypted form not In plain text.

I agree It Is a shame and most Importantly, alarming to say the least. Given It's a commonality for users to use the same password for most of their online accounts, they can also be compromised. I have countless user:pass, email:pass entries (from the back-end that I've personally breached) and tested them on all major websites. I'd say around 60% were used.

The majority do not have a password complexity requirement nor a minimum character length, hence allow sequential chars and commonly-used passwords. You can see my password entry In the above Image of "1337". Four characters that's (In hacker parlance) commonly-used.

Thanks for the clarification. You're right about re-using passwords. A breach of your system has consequences further than the data revealed in your own system whether you want to bear that burden or not. Maybe it's wrong to blame the applications and blame the users in that regard, I don't know. I don't have a strong opinion on that yet.

I know internal UIs are generally simplistic and messy since you don't need the same care that customer-facing pages require, but judging by your pic it just looks to be like a typical legacy enterprise application UI. A lot of these companies have not kept up with the times. They don't value developer labor, thus their services suffer and situations like you posted occur. Things don't get updated and vulnerabilities aren't a priority when developers are considered your cost center and are treated as such. Not to mention, such places are rarely recruiting new, competent developers because no one wants to work with unmaintained, legacy spaghetti code while being treated like an uneducated expense source.

You've made some very valid points.

In terms of passwords, If the complexity requirement Is Implemented to begin with, It will "force" the user to create a strong password. But It must be properly configured- contain upper & lowercase letters, numbers, special chars "not consistent" with (for example) Injection attacks, no two characters of the same type allowed In the same sequence, cannot be based on any form of familiarity and have a minimum length of 8 chars. This Is my recommendation of what's considered a very strong password.

There are a lot factors Involved with the lack of security. Cost Is one, and lack of knowledge and awareness Is another. After a months of trial and error, I've discovered a vulnerability In probably the biggest real estate company In the US. Right this minute, I can take down 550+ sites. To remain on-topic, I'll create a thread shortly after this post.

We're now back on-topic.

[nieprophsono]

Great article, but in this case it's very difficult to maintain security in the network and you can quickly be declassified by the FBI agents at the slightest error. Personally, I earn a similar method - carding. I'm looking for a bank card seller and after purchasing I'm looking for cvv shops for bank cards. Then I buy some goods (phones, laptops, expensive jewelry) from online stores to a fake address, and then sell them to a pawn shop. It seems to me that this is the safest way to earn money without straining. If there're willing I'll create a topic with carding explanation and will describe all the cons and pros of this work.