1
00:00:01,420 --> 00:00:08,170
In this video, we are going to see how hackers hack Android and iOS devices with just a single click.

2
00:00:11,940 --> 00:00:13,080
In this attack.

3
00:00:13,130 --> 00:00:19,530
Attackers, first of all, send a URL to a victim with social engineering such as SMS or email.

4
00:00:19,530 --> 00:00:25,260
And once the victim clicks on the link, his microphone, camera and location services are hacked.

5
00:00:31,920 --> 00:00:32,970
To set up this attack.

6
00:00:32,970 --> 00:00:39,630
We need to install Stormbreaker from GitHub on Kali Linux and once Stormbreaker installed, we need

7
00:00:39,630 --> 00:00:45,720
to expose local stormbreaker port to internet so that our link works on internet as well.

8
00:00:49,710 --> 00:00:52,230
You can install stormbreaker from the GitHub.

9
00:00:55,720 --> 00:00:57,010
It is a lot of features.

10
00:00:57,010 --> 00:01:01,900
For example, it can access microphone, webcam and location.

11
00:01:04,920 --> 00:01:08,880
The default username and password for the program is admin admin.

12
00:01:11,000 --> 00:01:14,630
And here we have our instructions for installation on Kali Linux.

13
00:01:17,290 --> 00:01:19,030
Copy the git clone command.

14
00:01:21,490 --> 00:01:22,690
And on Kali Linux.

15
00:01:22,690 --> 00:01:24,340
First of all, git clone the repo.

16
00:01:32,340 --> 00:01:34,170
A program has been downloaded.

17
00:01:36,790 --> 00:01:38,950
Now move into the storm breaker directory.

18
00:01:40,110 --> 00:01:42,060
Now we can run the install script.

19
00:01:44,660 --> 00:01:50,120
I like running and installing the requirements first to copy the requirements command.

20
00:01:51,080 --> 00:01:52,900
And paste donor links.

21
00:01:54,740 --> 00:01:57,140
And the essential requirements will be installed.

22
00:01:59,650 --> 00:02:02,200
And in my case, they are already available.

23
00:02:06,190 --> 00:02:07,780
Now we can run the install script.

24
00:02:08,440 --> 00:02:11,110
So use the command sudo bash install dot.

25
00:02:13,460 --> 00:02:15,140
And Stormbreaker will install.

26
00:02:21,130 --> 00:02:23,230
If you get some errors, ignore them.

27
00:02:23,380 --> 00:02:25,540
So our program has been installed.

28
00:02:28,070 --> 00:02:32,630
We can fire up the program by running sudo python dot pi.

29
00:02:39,640 --> 00:02:41,620
And our program is now running.

30
00:02:45,290 --> 00:02:49,010
So we have a panel on localhost port 2525.

31
00:02:51,730 --> 00:02:54,490
Now open the browser and browse to the admin panel.

32
00:02:54,910 --> 00:02:57,400
Log in with admin admin credentials.

33
00:03:02,180 --> 00:03:04,340
And we have the main admin page.

34
00:03:06,420 --> 00:03:10,370
Here we have different leagues for getting different information from the victim.

35
00:03:10,380 --> 00:03:14,100
For example, the first link is to capture pictures of the victim.

36
00:03:14,760 --> 00:03:18,900
The second is to record microphone, the third and fifth link.

37
00:03:18,900 --> 00:03:22,230
We can get information about the location of the victim.

38
00:03:23,210 --> 00:03:26,690
And the fourth link is for getting general information about the user.

39
00:03:29,140 --> 00:03:36,280
For example, if you use the first link, the victim will see a page as shown on the screen and it will

40
00:03:36,280 --> 00:03:39,340
automatically capture different photos of the victim.

41
00:03:42,340 --> 00:03:47,740
Stormbreaker is currently running on a local port and if you want to use it over the Internet, we need

42
00:03:47,740 --> 00:03:49,930
to expose this port over the Internet.

43
00:03:50,260 --> 00:03:55,780
The best way is to use tunneling services like andyrock and localhost dot run.

44
00:03:58,300 --> 00:03:59,080
Let's first see.

45
00:03:59,110 --> 00:03:59,710
Localhost.

46
00:03:59,920 --> 00:04:00,370
Run.

47
00:04:03,220 --> 00:04:05,680
So browse to the website localhost or run.

48
00:04:06,830 --> 00:04:08,390
Now click on Get Started.

49
00:04:10,290 --> 00:04:13,140
It allows to tunnel any port over the Internet.

50
00:04:15,250 --> 00:04:17,560
Just enter your port and copy the command.

51
00:04:23,090 --> 00:04:25,400
Now get back on your Kali Linux.

52
00:04:29,030 --> 00:04:31,550
The first step is to generate an SSH key.

53
00:04:31,700 --> 00:04:34,880
Use the command ssh key gen dash RSA.

54
00:04:38,370 --> 00:04:40,680
And our RSA key pair will be generated.

55
00:04:43,580 --> 00:04:45,200
Please use the blank passwords.

56
00:04:49,400 --> 00:04:51,200
Now use the reverse tunnel command.

57
00:04:54,380 --> 00:04:56,240
And a tunnel will be created.

58
00:05:02,560 --> 00:05:05,320
So in this command, we are setting up a tunnel.

59
00:05:06,370 --> 00:05:07,210
From localhost.

60
00:05:07,240 --> 00:05:07,660
25.

61
00:05:07,700 --> 00:05:11,200
25 Port over the internet on port 80.

62
00:05:13,500 --> 00:05:15,570
So we get a as well.

63
00:05:20,400 --> 00:05:24,840
Just copy the URL and this URL will be available over the internet.

64
00:05:26,970 --> 00:05:32,130
We can use this URL to login into our admin panel and then we can share our links.

65
00:05:35,140 --> 00:05:38,290
Let's just visit this over my main machine.

66
00:05:39,220 --> 00:05:42,490
Well, you can see that we can access it over the Internet.

67
00:05:45,950 --> 00:05:47,870
Login into the admin panel.

68
00:05:51,360 --> 00:05:55,500
And we get the updated links that are accessible over the Internet.

69
00:06:00,460 --> 00:06:01,810
To copy the first link.

70
00:06:03,770 --> 00:06:05,930
Now we can send these links to our victim.

71
00:06:07,320 --> 00:06:10,260
Let's just test these links in an initial window.

72
00:06:11,400 --> 00:06:16,170
Just paste the link and ensure that you are accessing the link over Https.

73
00:06:20,630 --> 00:06:24,380
Lower camera link will open and it will ask to use your camera.

74
00:06:24,890 --> 00:06:29,750
And if you allow the access, it will automatically start capturing the photos.

75
00:06:33,360 --> 00:06:40,170
Back in the admin panel, you can get the general information about the victim, its IP address, operating

76
00:06:40,170 --> 00:06:43,020
system, web browser, etcetera.

77
00:06:45,460 --> 00:06:51,640
And in a few minutes you will get alerts for captured photos and they will be saved in Kali Linux.

78
00:06:55,370 --> 00:06:57,330
Let's just move with the Kali Linux.

79
00:07:03,840 --> 00:07:05,340
Move to the Stormbreaker folder.

80
00:07:07,650 --> 00:07:09,300
With the storm web folder.

81
00:07:11,110 --> 00:07:15,610
Here we have the images folder and our images are stored here.

82
00:07:20,400 --> 00:07:26,340
You can see that it has captured images with intervals and saving them with timestamp.

83
00:07:29,860 --> 00:07:34,840
Knowledge is solve the second issue that how we can trick the user to click on it.

84
00:07:34,870 --> 00:07:37,150
The actual URL looks suspicious.

85
00:07:37,180 --> 00:07:40,690
We can make use of link shortener to hide the actual URL.

86
00:07:40,900 --> 00:07:45,460
So Google free url shorteners and there you will get a bunch of URL shorteners.

87
00:07:48,130 --> 00:07:49,240
Just click on any one.

88
00:07:51,910 --> 00:07:54,760
Paste your link and shorten the URL.

89
00:07:56,210 --> 00:07:58,640
No, your shortened URL will be generated.

90
00:07:58,700 --> 00:07:59,690
Just copy it.

91
00:07:59,930 --> 00:08:01,940
Now you can send it to your victim.

92
00:08:04,420 --> 00:08:08,240
We can send this to the victim pretending to be an app.

93
00:08:08,260 --> 00:08:13,600
So in this manner, we will have better chances of the user allowing camera access and clicking on the

94
00:08:13,600 --> 00:08:14,140
link.

95
00:08:15,350 --> 00:08:17,220
We can make use of ChatGPT to.

96
00:08:17,240 --> 00:08:18,620
Make a prompt for us.

97
00:08:19,850 --> 00:08:22,040
Let's just copy the first few lines.

98
00:08:23,610 --> 00:08:26,400
And send the link to the victim with WhatsApp.

99
00:08:31,570 --> 00:08:36,580
Now send the link with the description and hope that the victim will click on it.

100
00:08:37,120 --> 00:08:40,419
Now move back to the admin panel to monitor the progress.

101
00:08:43,450 --> 00:08:45,970
We have got the first information from our victim.

102
00:08:45,970 --> 00:08:52,000
Once he clicks on the link and the victim is on iOS and is using mobile safari browser.

103
00:08:52,210 --> 00:08:54,760
We have also got the browser version.

104
00:08:55,460 --> 00:08:58,730
And you can see that we have started getting the photos.

105
00:08:58,910 --> 00:09:01,760
You can open the photos directly from here as well.

106
00:09:04,830 --> 00:09:10,190
Now let's just use the other service to expose our link over the internet, which is andyrock.

107
00:09:11,520 --> 00:09:13,380
Visit Angie Rock website.

108
00:09:15,850 --> 00:09:17,560
Go into the download section.

109
00:09:19,410 --> 00:09:20,880
Select Linux.

110
00:09:22,760 --> 00:09:26,630
Select your binary as x86 64 and download it.

111
00:09:29,100 --> 00:09:31,650
Once it is downloaded, we need to unzip it.

112
00:09:33,240 --> 00:09:35,850
And the command is provided by the rock.

113
00:09:35,970 --> 00:09:37,260
Just copy the command.

114
00:09:38,920 --> 00:09:40,510
Moving to the downloads folder.

115
00:09:43,780 --> 00:09:45,970
Open the terminal in the same folder.

116
00:09:49,590 --> 00:09:51,480
And use the command to unzip it.

117
00:09:55,700 --> 00:09:57,710
Now we have set up our rock.

118
00:09:58,220 --> 00:10:03,830
You can check if rock is set up by typing rock and you can see that we get the help menu.

119
00:10:05,710 --> 00:10:08,710
Now we need to register on ngrok to use it.

120
00:10:10,000 --> 00:10:11,680
So open his website again.

121
00:10:16,540 --> 00:10:21,850
You can log in with your GitHub or Google account and your account will be created automatically.

122
00:10:28,270 --> 00:10:30,820
The left panel, select your auth token.

123
00:10:32,300 --> 00:10:34,400
To select the command from the command line.

124
00:10:36,870 --> 00:10:40,140
No back in the terminal on going Linux page this command.

125
00:10:43,610 --> 00:10:46,460
And the authorization token will be added to your rock.

126
00:10:46,760 --> 00:10:48,410
Now we are set up to go.

127
00:10:51,540 --> 00:10:54,690
The Stormbreaker is already telling the command to use Ngrok.

128
00:10:54,870 --> 00:10:58,650
Just copy the command from there and run it in another terminal.

129
00:11:01,440 --> 00:11:05,160
So local port 2525 has been exposed over the internet.

130
00:11:05,430 --> 00:11:09,210
Now you can use Ngrok link to access it over the internet.

131
00:11:12,410 --> 00:11:15,980
We can also make use of some URL shortener to shorten the URL.

132
00:11:16,250 --> 00:11:17,900
Let's just shorten it.

133
00:11:21,470 --> 00:11:23,600
For open a new window and use the link.

134
00:11:26,800 --> 00:11:30,880
We do get a warning from Angie that this link may be malicious.

135
00:11:31,030 --> 00:11:36,700
That is why I recommend using localhost dot run and our admin panel is open.

136
00:11:40,010 --> 00:11:42,770
And we have our links to send to the victim.

137
00:11:43,860 --> 00:11:47,250
Copy the first link, shorten it with URL shortener.

138
00:11:51,260 --> 00:11:53,480
Let's just check it in a new window.

139
00:11:55,660 --> 00:11:58,420
As you paste the link, you will again get the warning.

140
00:12:01,190 --> 00:12:02,810
You can click on visit site.

141
00:12:05,910 --> 00:12:07,800
And the malicious app will open up.

142
00:12:09,380 --> 00:12:12,200
And if you allow access, it will start capturing the photos.

143
00:12:16,910 --> 00:12:21,470
And we get the basic information about the victim in our admin panel as well.

144
00:12:25,830 --> 00:12:28,410
You can see that we have started getting the photos.

145
00:12:31,330 --> 00:12:37,450
So in this manner we can have a victim on iOS and Android devices with just a single link.

146
00:12:38,800 --> 00:12:45,280
In this tutorial we are installing stormbreaker and then exposing the Stormbreaker port over the internet

147
00:12:45,280 --> 00:12:49,540
using two methods using localhost, ren and ngrok.

148
00:12:49,850 --> 00:12:53,170
I hope you like this tutorial and see you in the next video.