+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Social Engineering (https://sinister.li/Forum-Social-Engineering)
+--- Thread: SE'ing Comcast For Customer Information [ 2 Methods! ] (/Thread-SE-ing-Comcast-For-Customer-Information-2-Methods)
SE'ing Comcast For Customer Information [ 2 Methods! ] - Spirit - 05-13-2014
Introduction & Why I Made This
NOTICE: Social engineering Comcast for a customers information is VERY ILLEGAL. I, nor HackCommunity, will not be held liable for what you do with this information. If you're going to be a child about this and use these two methods against everyone you meet, stop reading here and leave this thread immediately. Thank you.
Brief introduction
Today I figured that I'd make a tutorial on how to social engineer a Comcast worker into giving you someones personal information. Said information includes the victims name, address, phone number, account number, email, and social security number (SSN).
Why are you making this thread, Maxx-san?
Social engineering Comcast employees for customer information is the new big thing in the doxing world. I just want you to be aware of how and what people are doing in order for you to prevent a dox being created on yourself.
With all the doxing that happens these days, I figured that it would be important to share this information with you guys so you know what to expect and how it's happening. Even if I didn't share these methods here with you guys, I'm sure you could have found them with minimal effort using nothing but a few Google searches. So, I don't really consider this as promoting blackhat activity. I only want you guys to be aware of what's happening in this day in age.
"The Methods"
Method #1 - Erebus' Method
Spoiler:
I am showing you how to dox comcasts accounts because a lot of kids think they are special because they know how to! I am releasing the method they use, there is lots of ways to do this but i am showing you the call in method.
1. Call comcast
2. Hello my name is (What ever name you want) and my employee id is (What ever you want e.g 809*jly) and i am from customer care and my floor is down because of maintenance and my level 2 told me to contact you guys to look up an account for me and verify some information?
3. (If you want to use the comcast ip address make sure you ask them to tell them to use the GrandSlam system to lookup from the ip address because that is the only system that can lookup accounts from the ip address if you have something else like the phone #, account #, name, address etc use ascr, csg, comtrac but if you dont ask them they will use ascr/csg by default) So provide them what ever information you have.
4. Ask them if they have the account pulled up yet. If yes, say can you verify the name and so on.
5. Once you have the information you say "thank you for your cooperation have a nice shift".
Here is a format to lay the information out:
IP:
Name on file:
DOB on file:
SSN on file:
Phone on file:
Address on file:
Comcast Account #:
Primary Comcast Email:
Once you have that information and you want to jack the main account go to https://www.comcastsupport.com/ChatEntry/?AccountBilling.Password|form then fill out the information and in the description put "Can you reset my password?" then you will go into a chat with a live agent and you can figure out the rest from there.
1. Call comcast
2. Hello my name is (What ever name you want) and my employee id is (What ever you want e.g 809*jly) and i am from customer care and my floor is down because of maintenance and my level 2 told me to contact you guys to look up an account for me and verify some information?
3. (If you want to use the comcast ip address make sure you ask them to tell them to use the GrandSlam system to lookup from the ip address because that is the only system that can lookup accounts from the ip address if you have something else like the phone #, account #, name, address etc use ascr, csg, comtrac but if you dont ask them they will use ascr/csg by default) So provide them what ever information you have.
4. Ask them if they have the account pulled up yet. If yes, say can you verify the name and so on.
5. Once you have the information you say "thank you for your cooperation have a nice shift".
Here is a format to lay the information out:
IP:
Name on file:
DOB on file:
SSN on file:
Phone on file:
Address on file:
Comcast Account #:
Primary Comcast Email:
Once you have that information and you want to jack the main account go to https://www.comcastsupport.com/ChatEntry/?AccountBilling.Password|form then fill out the information and in the description put "Can you reset my password?" then you will go into a chat with a live agent and you can figure out the rest from there.
Method #2 - chF's Method
Spoiler:
This method isn't very public yet.
It'll always work for Comcast IPs.
So to begin with you're going to have some prerequisites.
You'll need the victims IP address (has to be with Comcast Cable) & it'd be good to have their general location, and a ZIP code for this location.
Once you have this information, you can proceed.
You're going to want to call up Comcast. (1-800-XFINITY, or 1-866-372-4215)
Next, it's going to ask for a phone number associated with an account. (If it prompts you to hit 1 to say that you're a customer, hit 1.)
At this point, I usually just enter 888-888-8888.
Once the phone number is entered, they'll repeat it back to you, hit 1.
Next, they'll say something like:
"I couldn't find an account associated with this Phone number. Hit 1 to proceed, or hit 2 to try again."
Proceed with the prompt it gives you to keep going.
Next, it'll say:
"We need more information on the account. Press 1 to try again, Press 2 to enter the account number, or press 3 if you don't have this information.
Hit 3.
It will then prompt you to enter a ZIP Code. It's important that you enter a ZIP code near the IP address's area. This is because you'll be unable to lookup certain pieces of information if the representative you get connected to can't lookup information for the region of the IP address.
Once you enter this, it'll say something about trouble with your service, hit 1.
Next, hit 2, as this will transfer you to internet.
This is where the basic SE comes in. It'll transfer you to a representative. As soon as you are connected, say something like:
"Hi, my name is Trey Davis, I'm working in Comcast Customer Care. I was recently trying to pull up an account here, but our tools like Vision,CSG & Einstein are down. Do you think you can help me out and pull up an account for me?"
Next, they'll probably say something along the lines of:
"Sure! Can I have the phone number associated with the account"
or
"I'm sorry, you're calling from Customer Care?"
If it's scenario one, respond with something like:
"Unfortunately, I wasn't provided that by my Supervisor. I do however have the IP address of the customer, and you can look this up in Grand-Slam"
If it's scenario two, respond with something similar to:
"Yes, I'm in Customer Care/Tier 1. My supervisor redirected us to you guys to see if you could pull up the account
And then in the case of scenario two, they'll respond with the same responses as scenario one.
Next, they'll likely provide the information on file. Here's a general template to ask for the information:
Name on file:
Phone number on file:
Address on file:
Account Number:
Last four of SSN on file:
Email/Primary Userid on file:
Once you get this information, you can then ask them:
"Can you provide a password reset for the userid please? I'm in a live-chat with the customer and they're requesting that, but I'm unable to pull up the account."
And they'll likely provide the new reset password, which follows the format of two words and a number.
Once you get this reset, you can head over to Comcast.net and login to it. There is plenty of useful information there, and you'll have access to their emails, modem information and lots more.
It'll always work for Comcast IPs.
So to begin with you're going to have some prerequisites.
You'll need the victims IP address (has to be with Comcast Cable) & it'd be good to have their general location, and a ZIP code for this location.
Once you have this information, you can proceed.
You're going to want to call up Comcast. (1-800-XFINITY, or 1-866-372-4215)
Next, it's going to ask for a phone number associated with an account. (If it prompts you to hit 1 to say that you're a customer, hit 1.)
At this point, I usually just enter 888-888-8888.
Once the phone number is entered, they'll repeat it back to you, hit 1.
Next, they'll say something like:
"I couldn't find an account associated with this Phone number. Hit 1 to proceed, or hit 2 to try again."
Proceed with the prompt it gives you to keep going.
Next, it'll say:
"We need more information on the account. Press 1 to try again, Press 2 to enter the account number, or press 3 if you don't have this information.
Hit 3.
It will then prompt you to enter a ZIP Code. It's important that you enter a ZIP code near the IP address's area. This is because you'll be unable to lookup certain pieces of information if the representative you get connected to can't lookup information for the region of the IP address.
Once you enter this, it'll say something about trouble with your service, hit 1.
Next, hit 2, as this will transfer you to internet.
This is where the basic SE comes in. It'll transfer you to a representative. As soon as you are connected, say something like:
"Hi, my name is Trey Davis, I'm working in Comcast Customer Care. I was recently trying to pull up an account here, but our tools like Vision,CSG & Einstein are down. Do you think you can help me out and pull up an account for me?"
Next, they'll probably say something along the lines of:
"Sure! Can I have the phone number associated with the account"
or
"I'm sorry, you're calling from Customer Care?"
If it's scenario one, respond with something like:
"Unfortunately, I wasn't provided that by my Supervisor. I do however have the IP address of the customer, and you can look this up in Grand-Slam"
If it's scenario two, respond with something similar to:
"Yes, I'm in Customer Care/Tier 1. My supervisor redirected us to you guys to see if you could pull up the account
And then in the case of scenario two, they'll respond with the same responses as scenario one.
Next, they'll likely provide the information on file. Here's a general template to ask for the information:
Name on file:
Phone number on file:
Address on file:
Account Number:
Last four of SSN on file:
Email/Primary Userid on file:
Once you get this information, you can then ask them:
"Can you provide a password reset for the userid please? I'm in a live-chat with the customer and they're requesting that, but I'm unable to pull up the account."
And they'll likely provide the new reset password, which follows the format of two words and a number.
Once you get this reset, you can head over to Comcast.net and login to it. There is plenty of useful information there, and you'll have access to their emails, modem information and lots more.
... And there you have it! That's how people often obtain information when their victim is a Comcast customer. These two methods, and every other method out there are exactly why I'd never recommend Comcast for anyone to use... Their employees are too easy to SE!
RE: SE'ing Comcast For Customer Information [ 2 Methods! ] - AlCapone - 05-19-2014
I'm not with comcast but this made me think twice about using my real IP anywhere lol, Thanks for the share!.
RE: SE'ing Comcast For Customer Information [ 2 Methods! ] - Spirit - 05-19-2014
(05-19-2014, 12:39 PM)AlCapone Wrote: I'm not with comcast but this made me think twice about using my real IP anywhere lol, Thanks for the share!.
That's what I was aiming for! It's important to be careful when doing anything online. You never know when you might just suddenly have your identity stolen, or something along those lines when doing anything on the Internet. There are definitely some bad cookies out there!
RE: SE'ing Comcast For Customer Information [ 2 Methods! ] - pure - 04-12-2017
I would like to point out that Comcast/Xfinity have specifically used these methods and turned them in to a "how NOT to take a phone call" class. They actually now have anti-social engineering classes, and will intentionally mess with you if they believe you are trying to social engineer them!
I urge any of you adventerous types to find new methods and share them, as these will *always* be new ways and methods to exploit the easiest machine of them all: the person.
RE: SE'ing Comcast For Customer Information [ 2 Methods! ] - pvnk - 04-12-2017
These methods are completely outdated and no longer work. Grandslam is years old and is basically a dead tool. Not only was the IP lookup slot disabled but the tool was removed entirely.