In this video, we are going to see how hackers hack Android and iOS devices with just a single click.
In this attack.
Attackers, first of all, send a URL to a victim with social engineering such as SMS or email.
And once the victim clicks on the link, his microphone, camera and location services are hacked.
To set up this attack.
We need to install Stormbreaker from GitHub on Kali Linux and once Stormbreaker installed, we need
to expose local stormbreaker port to internet so that our link works on internet as well.
You can install stormbreaker from the GitHub.
It is a lot of features.
For example, it can access microphone, webcam and location.
The default username and password for the program is admin admin.
And here we have our instructions for installation on Kali Linux.
Copy the git clone command.
And on Kali Linux.
First of all, git clone the repo.
A program has been downloaded.
Now move into the storm breaker directory.
Now we can run the install script.
I like running and installing the requirements first to copy the requirements command.
And paste donor links.
And the essential requirements will be installed.
And in my case, they are already available.
Now we can run the install script.
So use the command sudo bash install dot.
And Stormbreaker will install.
If you get some errors, ignore them.
So our program has been installed.
We can fire up the program by running sudo python dot pi.
And our program is now running.
So we have a panel on localhost port 2525.
Now open the browser and browse to the admin panel.
Log in with admin admin credentials.
And we have the main admin page.
Here we have different leagues for getting different information from the victim.
For example, the first link is to capture pictures of the victim.
The second is to record microphone, the third and fifth link.
We can get information about the location of the victim.
And the fourth link is for getting general information about the user.
For example, if you use the first link, the victim will see a page as shown on the screen and it will
automatically capture different photos of the victim.
Stormbreaker is currently running on a local port and if you want to use it over the Internet, we need
to expose this port over the Internet.
The best way is to use tunneling services like andyrock and localhost dot run.
Let's first see.
Localhost.
Run.
So browse to the website localhost or run.
Now click on Get Started.
It allows to tunnel any port over the Internet.
Just enter your port and copy the command.
Now get back on your Kali Linux.
The first step is to generate an SSH key.
Use the command ssh key gen dash RSA.
And our RSA key pair will be generated.
Please use the blank passwords.
Now use the reverse tunnel command.
And a tunnel will be created.
So in this command, we are setting up a tunnel.
From localhost.
25.
25 Port over the internet on port 80.
So we get a as well.
Just copy the URL and this URL will be available over the internet.
We can use this URL to login into our admin panel and then we can share our links.
Let's just visit this over my main machine.
Well, you can see that we can access it over the Internet.
Login into the admin panel.
And we get the updated links that are accessible over the Internet.
To copy the first link.
Now we can send these links to our victim.
Let's just test these links in an initial window.
Just paste the link and ensure that you are accessing the link over Https.
Lower camera link will open and it will ask to use your camera.
And if you allow the access, it will automatically start capturing the photos.
Back in the admin panel, you can get the general information about the victim, its IP address, operating
system, web browser, etcetera.
And in a few minutes you will get alerts for captured photos and they will be saved in Kali Linux.
Let's just move with the Kali Linux.
Move to the Stormbreaker folder.
With the storm web folder.
Here we have the images folder and our images are stored here.
You can see that it has captured images with intervals and saving them with timestamp.
Knowledge is solve the second issue that how we can trick the user to click on it.
The actual URL looks suspicious.
We can make use of link shortener to hide the actual URL.
So Google free url shorteners and there you will get a bunch of URL shorteners.
Just click on any one.
Paste your link and shorten the URL.
No, your shortened URL will be generated.
Just copy it.
Now you can send it to your victim.
We can send this to the victim pretending to be an app.
So in this manner, we will have better chances of the user allowing camera access and clicking on the
link.
We can make use of ChatGPT to.
Make a prompt for us.
Let's just copy the first few lines.
And send the link to the victim with WhatsApp.
Now send the link with the description and hope that the victim will click on it.
Now move back to the admin panel to monitor the progress.
We have got the first information from our victim.
Once he clicks on the link and the victim is on iOS and is using mobile safari browser.
We have also got the browser version.
And you can see that we have started getting the photos.
You can open the photos directly from here as well.
Now let's just use the other service to expose our link over the internet, which is andyrock.
Visit Angie Rock website.
Go into the download section.
Select Linux.
Select your binary as x86 64 and download it.
Once it is downloaded, we need to unzip it.
And the command is provided by the rock.
Just copy the command.
Moving to the downloads folder.
Open the terminal in the same folder.
And use the command to unzip it.
Now we have set up our rock.
You can check if rock is set up by typing rock and you can see that we get the help menu.
Now we need to register on ngrok to use it.
So open his website again.
You can log in with your GitHub or Google account and your account will be created automatically.
The left panel, select your auth token.
To select the command from the command line.
No back in the terminal on going Linux page this command.
And the authorization token will be added to your rock.
Now we are set up to go.
The Stormbreaker is already telling the command to use Ngrok.
Just copy the command from there and run it in another terminal.
So local port 2525 has been exposed over the internet.
Now you can use Ngrok link to access it over the internet.
We can also make use of some URL shortener to shorten the URL.
Let's just shorten it.
For open a new window and use the link.
We do get a warning from Angie that this link may be malicious.
That is why I recommend using localhost dot run and our admin panel is open.
And we have our links to send to the victim.
Copy the first link, shorten it with URL shortener.
Let's just check it in a new window.
As you paste the link, you will again get the warning.
You can click on visit site.
And the malicious app will open up.
And if you allow access, it will start capturing the photos.
And we get the basic information about the victim in our admin panel as well.
You can see that we have started getting the photos.
So in this manner we can have a victim on iOS and Android devices with just a single link.
In this tutorial we are installing stormbreaker and then exposing the Stormbreaker port over the internet
using two methods using localhost, ren and ngrok.
I hope you like this tutorial and see you in the next video.