DeepCode
Contact Us

It came to me while I was reading an article on Slashdot about sites popping up, offering the customer to hack into a Facebook, MySpace or another social site for 75$ to 100$. EWeek has a similar article[1]. Seems like those sites mostly use social engineering by sending a grammatically deficient e-mail to the victim and somehow, still working most of the time. Most of the time, the goal is to get access to private pictures or information. Hacking Facebook and MySpace accounts is the new “How do I hack Hotmail accounts” of the decade. Just search Google for “facebook hacking service” and plenty of websites will be returned.

Same thing with pictures from services like PhotoBucket or Flickr and such. Getting pictures from private albums is much easier thought and is done thru fusking. The goal is simply to access directly pictures from the private album by guessing the filename of the picture.

As you might know, most cameras have a default naming convention, i.e DSC0001.jpg, Picture0001.jpg etc… (see then end of this article for a complete list) and humans, being lazy as they are, don’t bother renaming them. Since I believe that an example is the best way to learn than 30 pages of detailed explanation, here how it’s done.

Let’s create an account on PhotoBucket first. I used a username I always take everywhere, but it seems that Photobucket didn’t liked it:

Anyway, just deleting the Photobucket cookie solves the problem. Registered using brand new data. Small tips, if you are looking for zip code, try this page: Find A Zip, it has about every zip code for every town in the US (I haven’t verified but looks like it…).

Once in, I created a private album and put two pictures in it; one I renamed and the other I left with a camera default filename.

I named one of those pictures DSC0005.jpg and the other an uncommon name: The URL of my private album is

http://s991.photobucket.com/albums/af33/Cheetah897/Real%20Private%20Album/

The filename is

DSC0005.jpg

So just to try out the concept,  I signed out and look if, with the album’s URL and the filename, could access the picture. Oh! Look at that:

So you should be able to guess the rest from here. Nevertheless, there are tools out there to even do the guessing work for you. The one I will use is PHUSK. It’s especially done for PhotoBucket and is for Windows. This shouldn’t be hard to program for another website and another platform.

There is really not much to explain, just type the username of the victim and set up any properties you want (which are pretty much self-explanatory). On the first try, it didn’t found any private album, so I had to specify it by selecting “advanced mode” which show this window:

Select “Add Album”, type the album name and then it will appear in the list of albums (which is ordered).

Started PHUSK again and this time it found the private album, it will then try to brute force filenames, which might take a while.

I changed the default lists to make it faster, otherwise, it might take a long time (411 albums name X 439 filenames X ~9999 file numbers each…).

Here is a list of filenames used by PHUSK. This can be used to build your own list.
###.jpgUnknown-#.jpgMe.jpg
##.jpgUntitled-###.jpgME.jpg
#.jpgUntitled-##.jpgmygirls.jpg
Picture###.jpgUntitled-#.jpgMygirls.jpg
Picture##.jpguntitled-###.jpgMYGIRLS.jpg
Picture#.jpguntitled-##.jpgfine.jpg
Photo###.jpguntitled-#.jpgFine.jpg
Photo##.jpgstuff###.jpgFINE.jpg
Photo#.jpgstuff##.jpgsexy.jpg
#####.jpgstuff#.jpgSexy.jpg
####.jpgStuff###.jpgSEXY.jpg
CIMG####.jpgStuff##.jpghot.jpg
CIMG####.JPGStuff#.jpgHot.jpg
DSCN####.jpgstuff-###.jpgHOT.jpg
PICT####.jpgstuff-##.jpghott.jpg
DSC_####.jpgstuff-#.jpgHott.jpg
DSC0####.jpgmycamerapics###.jpgHOTT.jpg
Image###.jpgmycamerapics##.jpgreally.jpg
Image##.jpgmycamerapics#.jpgReally.jpg
Image##.JPGmypics###.jpgREALLY.jpg
Image#.jpgmypics##.jpgass.jpg
PICT####.JPGmypics#.jpgAss.jpg
IMG_####.jpgMisc-###.jpgASS.jpg
_MG_####.jpgMisc-##.jpgbad.jpg
000_####.jpgMisc-#.jpgBad.jpg
001_####.jpgmisc###.jpgBAD.jpg
100_####.jpgmisc##.jpgface.jpg
100-####.jpgmisc#.jpgFace.jpg
100-####_IMG.jpgmisc-new###.jpgFACE.jpg
101_####.jpgmisc-new##.jpgpage.jpg
101-####.jpgmisc-new#.jpgPage.jpg
101-####_IMG.jpgNew###.jpgPAGE.jpg
102_####.jpgNew##.jpgtits.jpg
102-####.jpgNew#.jpgTits.jpg
102-####_IMG.jpgNew-###.jpgTITS.jpg
103-####.jpgNew-##.jpgboobs.jpg
103_####.jpgNew-#.jpgBoobs.jpg
0##########.jpgnew###.jpgBOOBS.jpg
1##########.jpgnew##.jpgbreasts.jpg
0########.jpgnew#.jpgBreasts.jpg
1########.jpgnew-###.jpgBREASTS.jpg
########.jpgnew-##.jpgnaughty.jpg
#######.jpgnew-#.jpgNaughty.jpg
######.jpgOld###.jpgNAUGHTY.jpg
Cimg####.jpgOld##.jpgsmile.jpg
DCAM####.jpgOld#.jpgSmile.jpg
DC####S.jpgold###.jpgSMILE.jpg
DCFN####.jpgold##.jpglight.jpg
DCP_####.jpgold#.jpgLight.jpg
DCP0####.jpgnude###.jpgLIGHT.jpg
dsc#####.jpgnude##.jpgkiss.jpg
DSC#####.jpgnude#.jpgKiss.jpg
DSC####.jpgNude###.jpgKISS.jpg
dsc0####.jpgNude##.jpgkisses.jpg
DSCF####.jpgNude#.jpgKisses.jpg
DSCF####.JPGSexy###.jpgKISSES.jpg
dscf####.jpgSexy##.jpgmuah.jpg
DSCI####.jpgSexy#.jpgMuah.jpg
DSCI####.JPGsexy###.jpgMUAH.jpg
dscn####.jpgsexy##.jpgmwah.jpg
EX00####.jpgsexy#.jpgMwah.jpg
HPIM####.jpgsexxy###.jpgMWAH.jpg
IM00####.jpgsexxy##.jpgdrunk.jpg
IMAG####.jpgsexxy#.jpgDrunk.jpg
IMAGE_####.jpgpictures###.jpgDRUNK.jpg
IMAGE####.jpgpictures##.jpgdrunken.jpg
IMG0####.jpgpictures#.jpgDrunken.jpg
IMG####.jpgPictures###.jpgDRUNKEN.jpg
Img#####.jpgPictures##.jpgsleep.jpg
IMG_00####.jpgPictures#.jpgSleep.jpg
IMG_#####.jpgsexypic###.jpgSLEEP.jpg
IMG_####.JPGsexypic##.jpgsleeping.jpg
IMGA####.JPGsexypic#.jpgSleeping.jpg
IMGP####.JPGsexypics###.jpgSLEEPING.jpg
IMGP####.jpgsexypics##.jpgtongue.jpg
IMPG####.jpgsexypics#.jpgTongue.jpg
KIF_####.jpgSmile###.jpgTONGUE.jpg
mvc#####.jpgSmile##.jpgcute.jpg
MVC0####.jpgSmile#.jpgCute.jpg
MVC-####.jpgsmile###.jpgCUTE.jpg
MYDC####.jpgsmile##.jpghehe.jpg
P00#####.jpgsmile#.jpgHehe.jpg
P10#####.jpgmirror###.jpgHEHE.jpg
P101####.jpgmirror##.jpgus.jpg
PC00####.jpgmirror#.jpgUs.jpg
PANA####.JPGsingle###.jpgUS.jpg
PDR_####.JPGsingle##.jpgmesexy.jpg
PDR_####.jpgsingle#.jpgMesexy.jpg
PDRM####.JPGHappy###.jpgMESEXY.jpg
PDRM####.jpgHappy##.jpgunderwear.jpg
pdrm####.jpgHappy#.jpgUnderwear.jpg
pict####.jpghappy###.jpgUNDERWEAR.jpg
Picture#####.jpghappy##.jpgthong.jpg
Picture####.jpghappy#.jpgThong.jpg
Picture###-1.jpgpicture###.jpgTHONG.jpg
Picture##-1.jpgpicture##.jpgpanties.jpg
Picture#-1.jpgpicture#.jpgPanties.jpg
Picture###-2.jpgcute###.jpgPANTIES.jpg
Picture##-2.jpgcute##.jpgbra.jpg
Picture#-2.jpgcute#.jpgBra.jpg
Photo####.jpgxxx###.jpgBRA.jpg
Photo###-1.jpgxxx##.jpgcostume.jpg
Photo##-1.jpgxxx#.jpgCostume.jpg
Photo#-1.jpgdelete###.jpgCOSTUME.jpg
S#######.jpgdelete##.jpgheart.jpg
S######.jpgdelete#.jpgHeart.jpg
S#####.jpgHalloween###.jpgHEART.jpg
S####.jpgHalloween##.jpgbed.jpg
SANY####.jpgHalloween#.jpgBed.jpg
SDC#####.jpghalloween###.jpgBED.jpg
scan#####.jpghalloween##.jpgshower.jpg
SPA#####.jpghalloween#.jpgShower.jpg
ST@_#####.jpgMe###.jpgSHOWER.jpg
STA#####.jpgMe##.jpgbath.jpg
STP#####.jpgMe#.jpgBath.jpg
PANA###.jpgME###.jpgBATH.jpg
{user}#.jpgME##.jpgcloset.jpg
DSCI###.jpgME#.jpgCloset.jpg
DigitalCamera###.jpgme###.jpgCLOSET.jpg
Image(##).jpgme##.jpgkitchen.jpg
Image(##).JPGme#.jpgKitchen.jpg
mvc-###.jpg1-###.jpgKITCHEN.jpg
MVC-###.jpg1-##.jpgfridge.jpg
Sony#.jpg1-#.jpgFridge.jpg
PhotoMoto_####.jpgIMG_###.jpgFRIDGE.jpg
###-1.jpgIMG_##.jpgtable.jpg
##-1.jpgIMG_#.jpgTable.jpg
#-1.jpgnaughty###.jpgTABLE.jpg
Picture###.pngnaughty##.jpgrisque.jpg
Picture##.pngnaughty#.jpgRisque.jpg
Picture#.pngNaughty###.jpgRISQUE.jpg
stuff###.jpgNaughty##.jpgnew.jpg
stuff##.jpgNaughty#.jpgNew.jpg
stuff#.jpgass###.jpgNEW.jpg
stuff-#.jpgass##.jpgold.jpg
S###.jpgass#.jpgOld.jpg
S##.jpgAss###.jpgOLD.jpg
S#.jpgAss##.jpghalloween.jpg
s###.jpgAss#.jpgHalloween.jpg
s##.jpgPic###.jpgHALLOWEEN.jpg
s#.jpgPic##.jpgcleavage.jpg
unknown-###.jpgPic#.jpgCleavage.jpg
unknown-##.jpgpic###.jpgCLEAVAGE.jpg
unknown-#.jpgpic##.jpgpic.jpg
Unknown-###.jpgpic#.jpgPic.jpg
Unknown-##.jpgme.jpgPIC.jpg
So basically, the way out of phuskers is only to rename your files so that it won’t fit any of the above masks. So a simple description (3-5 words) on what’s on the picture might be able to defeat most of these software.

So here you have it how to get pictures from Photobucket.  Although I haven’t shown it here, this concept can be used for other picture sharing sites. As in anything that ever existed, this can be used for good and evil purposes. I started to get interested in computer security by reading that stuff when I was young so my goal here is to do the same, knowing that some script kiddies will probably use this.

Sayonnara
1 “ Security Researchers Find Alleged Facebook Hacking Service ”, Brian Prince, eWeek, September 18, 2009,http://www.eweek.com/c/a/Security/Security-Researchers-Find-Alleged-Facebook-Hacking-Service-358854/ 2009-12-29
DeepCode
Linkedin
  • Copyright 2024. All rights reserved