Leaks - Introduction how to use leaks to hack accounts 12-01-2016, 06:39 PM
#1
In this thread i will teach how to use Leaked databases to access common services.
The databases in question are:
000webhost breach in March 2015
Gmail/Yandex/Mail.ru breach in September 2014
The software to use:
Email Recon 1.4
Both databases and the software cost $25 payable by paypal or btc.
Let's start with an example then i will publish one live hacked account as proof.
===================================
1) First i will start to verify if the email is leaked in the databases i have posted above. For that i use the site https://haveibeenpwned.com which already comes in Email Recon 1.4. If the email is associated to one of the two databases that means that the password is visible in plain text.
2) Download the database using "Email Password Databases" available in Email Recon 1.4 and open with EmEditor Txt Editor. Search for the email and the password should be there.
3) Copy the email and password to a text file and launch Email Recon 1.4. Now navigate between the services available and check if the email is associated with that service. If the email is associate with the service just try to break in using the password you have found.
=================================
Live Example: (Found by me)
=================================
The email for this live example is castarnet@Gmail.com
1) By using https://haveibeenpwned.com i know that this email was leaked in 000webhost breach in March 2015. So i open the database and retrieve the password which is "uopl12".
2) Using Email Recon 1.4 i know which services are registered with this email.
Has Twitter? Yes
Has LinkedIn? Yes
Has Instagram? Yes
Has Paypal? Yes
Has Wordpress.com? Yes
Has Steam? Yes
Has 4shared? Yes
Has Dropbox? Yes
Has Mega.nz? Yes
3) Now we try to login in those services using the email and password. In almost all the services the password didn't match
Except Mega.nz. That's right Mega.nz account uses the same password. Yes i just gain access to a Mega.nz File hosting account
4) Repeat this 3 steps with diferent emails...
The databases in question are:
000webhost breach in March 2015
Gmail/Yandex/Mail.ru breach in September 2014
The software to use:
Email Recon 1.4
Both databases and the software cost $25 payable by paypal or btc.
Let's start with an example then i will publish one live hacked account as proof.
===================================
1) First i will start to verify if the email is leaked in the databases i have posted above. For that i use the site https://haveibeenpwned.com which already comes in Email Recon 1.4. If the email is associated to one of the two databases that means that the password is visible in plain text.
2) Download the database using "Email Password Databases" available in Email Recon 1.4 and open with EmEditor Txt Editor. Search for the email and the password should be there.
3) Copy the email and password to a text file and launch Email Recon 1.4. Now navigate between the services available and check if the email is associated with that service. If the email is associate with the service just try to break in using the password you have found.
=================================
Live Example: (Found by me)
=================================
The email for this live example is castarnet@Gmail.com
1) By using https://haveibeenpwned.com i know that this email was leaked in 000webhost breach in March 2015. So i open the database and retrieve the password which is "uopl12".
2) Using Email Recon 1.4 i know which services are registered with this email.
Has Twitter? Yes
Has LinkedIn? Yes
Has Instagram? Yes
Has Paypal? Yes
Has Wordpress.com? Yes
Has Steam? Yes
Has 4shared? Yes
Has Dropbox? Yes
Has Mega.nz? Yes
3) Now we try to login in those services using the email and password. In almost all the services the password didn't match
Except Mega.nz. That's right Mega.nz account uses the same password. Yes i just gain access to a Mega.nz File hosting account
4) Repeat this 3 steps with diferent emails...
![[+]](https://sinister.li/images/modern/collapse_collapsed.png)
