Showing a Craigslist scammer who's boss using Python

[@donwilson]

You know you're on a programming video when the comments are full of "a better way to do this would be to..."

[@kevinmuller3425]

@@erikpowa lol there are still people saying python is not real Programming? Damn

[@deathcoder]

crowdrefactoring

[@blair3549]

Yes, because this is a really ineffective and futile attempt to waste the time of phishers. Skiddies gave him their ad revenue, though.

[@RayTC]

guize i totally made a minecraft fortntie mod so im obviously a master progremmer and i know what a script is so im leet haxxor

[@eternaldreamerofsleep]

DIOhydrogen Monoxide is this bait?Whatever,I only know a bit of HTML :/

[@Aighthandle]

The great thing about this white hat kind of project is there’s always more work to be done. Great for intermediate beginners that like trolling as a force for good

[@tiptopanteater7713]

wasting peoples time is where trolling started. simple, effective and literally never gets old.

[@drew9017]

More of a red hat lol

[@terminatorfishstudios]

Red hat hacking, good guys but taking an illegal and destructive approach.

[@ryanolsen294]

@@terminatorfishstudios lol

[@wheezybackports6444]

@@terminatorfishstudios legality != morals

[@CecilMerrell]

To make it harder for him to sort through the list, you should just random select from the list of top 10k commonly used passwords instead of auto generating them.

[@hereandnow3156]

Isn't it also likely the scammer would be able to reasonably discard the fake data he sent by looking at the time and the IP address they are coming from?

[@yousif6982]

@@hereandnow3156 yeah he definitely shouldve used a vpn and something like the rockyou password list to be safer and more effective, still a good idea though

[@JohhnyBasedDepartmentDab]

@@hereandnow3156 That is what i was also wondering

[@peterhindes56]

​@@hereandnow3156only if he logs the IP with the username and password otherwise he's going to have to comb through access logs that he may or may not have

[@bonbonbonbons]

​@@hereandnow3156Use proxying

[@199NickYT]

Yes, there are better ways to do it. Yes, you should share them here. No, you shouldn't berate Engineer Man for not doing them. He did 90% of the work that cost 10% of the time here. He isn't going to turn his 5 minute video into half an hour just to squeeze out that last 10%. It's a proof of concept, people.

[@EngineerMan]

Thanks for noticing this important fact which it seems many are missing.

[@istvandeak8232]

ofc you are not going to show all the parts! I don't even know who was that stupid to think you gonna... nice job! :) ;) btw I just like to rat them & destroy all of their equipment! :D perament damage! :P

[@r3wturb0x51]

that 10% is the difference between pwning the scamming bastard and being swatted like a fly. besides, i could make something much better in around 10 minutes.

[@199NickYT]

r3wturb0x alright, you have ten minutes.

[@dreamsteal4773]

BPNave lmao

[@toolbelt]

That was a delight to watch. I’m learning Python and I find this so inspiring.

[@moreish7193]

me too :)

[@lennyshoe]

Same here!

[@oppenguin6462]

same

[@connormclean4220]

Yea things like this are brilliant for learners because it makes them actually want to learn more and try this out . This is a great little project and videos like this is literally how I got into coding and actually started coding in my free time

[@roguishowl3915]

Me three ✌🏻

[@dislikebutton966]

Imagine if you had one of those emails and were wondering how scammers gets your email 😂

[@2oqh]

These aren’t unrealistic at all so guaranteed atleast a few of them are real 😂😂

[@thatonehenward4275]

the password though.

[@MintBunHunter]

Nathan9

[@gabrielh7517]

Breaking news man in Nigeria with no family or friends dies with millions of dollars of cash he had been trying to give away

[@gedgar2000]

Damn, I KNEW that Nigerian email sounded legit!

[@gabrielh7517]

@@gedgar2000 we all missed out 😓

[@jtc1947]

GABRIEL! FANTASTIC! You have a GREAT SENSE OF HUMOR!

[@definitiveentertainment1658]

Gabriel Hormuth Man in Nigeria? He’s a Nigerian Prince with close ties to First Nigerian Bank, thank you very much!!

[@justincase1898]

WHERE do i send my SSN# and moms maiden name

[@ChristmasEve777]

Unless you have that thing running all the time (looping), then your requests will all basically be in one giant block with 8 character passwords. It would be easy for him to crop them out. It would be better to kick them out slower with a bigger name base that's more randomized with passwords that are better randomized (including length). And run it constantly.

[@Noobsaibot21]

True. But chances are, the scammer wont get an awful lot of legitimate emails (I would hope in this day and age) so leaving this running on a cloud VM 24/7 with a few extra providers would make spotting real stuff almost impossible. This is great stuff and should certainly be made available to 419baiter too. Love it :)

[@glock21guy]

Would be even easier if he's saving the remote IP address with them all, especially if it's going into a database where he could just use a limit and group on the select.

[@kiveynen]

They're also all yahoo adresses. So .. he could just delete all of those without losing too much data :D

[@landonpowell6296]

Seriously. It'd take 30 seconds to make a regex that'd clean this shit up. Emails are all in this format: /[a-z]*\d@yahoo\.com/g Passwords are all in this format: /.{8}/g If he's got the know-how to make a phishing page, he's got the know-how to make a regex that fixes your shit.

[@MattTrevett]

And different TLDs for the e-mail address. Make the random number length variable and sometimes come before the name. Maybe throw in a dictionary as well.

[@rich1051414]

You should randomize the length of the password, and randomize the domain of the email. As it is, all he has to do is filter out all yahoo domains with a password length of 8, and he would have minimal loss of acquired real passwords.

[@wujeonghyun6865]

exactly

[@ikyyntts7807]

yeah thought his generation algo was a bit dodgy, no last names, no full stops or underscores etc, just one name, one letter, same domain, all random 8 char passwords

[@deildegast]

there is always room for improvement, but to show how easy you can overload a spammer with a short python program really opened my eyes on what you(anyone really) can do.

[@bfwebster]

Great video. :-) Reading through the comments, I'm reminded of the classic joke: Q: How many programmers does it take to change a light bulb? A: 35. One to actually change the bulb and 34 to say after the fact, "I could have done that better."

[@EngineerMan]

Can't stop laughing at this. Thanks.

[@jcadult101]

None, it's a hardware problem.

[@Me63422]

lol

[@chegomez841]

you only need one. you said it yourself.

[@luigielite1]

Here's my answer: one to actually change the bulb and 34 to use stackoverflow to figure out on how to do it.

[@kookyflukes9749]

I have no idea what just happened but I'm glad it did

[@TheValorantGuy]

He created a file to send 1000 emails to scammers inboxes to make them go threw each email and password so he cant tell real emails from fake ones

[@MBA2804]

oh no, its infinite emails.

[@williamfunes2740]

Control yourself...control yourself.. .THATS WHAT SHE SAID!!!!

[@DebugCat]

@William Funes not funny :L

[@williamfunes2740]

@@DebugCat the office...when they tell Michael he can't say anything inappropriate.

[@asapbembyy4614]

Maybe a better idea is to try to make passwords seem legit, also adding random names or literally the whole dictionary, cuz not everyone makes their passwords in symbols, but instead words or phrases, so if he just scrolls through the yahoo and passwords lists and find a combination that seems unique, he will know which one is the real one and which one is not.

[@4esv]

@badrobots statistics, like how 2/3 of doctors are male or how 3/4 of all software engineers are men

[@jar3040]

@badrobots tmw genz

[@martinchki]

or he can just delete all of the emails and passwords starting from -email- and as password, -password-. The 2 ints he used to see where emails and passwords go.

[@Ramsesian]

@badrobots yikes

[@Shezza_1212]

@badrobots Cool, but who cares

[@setnaffa]

504 Nigerian Princes disliked the video...

[@hurshiej7208]

Mike Morgan they just want to share their millions of dollars is that really so hard to believe

[@blameburr8722]

AC3 Of Cards Error 404: Millions of dollars not found

[@nathanielluke2084]

Mike Morgan dude, some nigerians are still stuck at the moon

[@feliciameyer4530]

Is it bad that it took me legit ten seconds to realize 504 meant the amount of dislikes and not a joke about timeout errors?

[@parveensingh3834]

Don't forget us Indians :p

[@IAmTheRealKen]

A way to make this more convincing would be to have a 1000 most common passwords json file and a 10 most common email providers json file (or just a list), load those and it will be very convincing. Also, you could make it randomly sleep or get it done in batches as well if he stores a created_at time.

[@EngineerMan]

There's definitely going to be some better ways to do it.

[@IAmTheRealKen]

Yep, and I bet there's probably even better ways than what I came up with. Such is life. :) Nice video, btw.

[@WadeMeredith]

Eh, this statement applies to literally everything in life. This vid was fast and got the point across. Awesome stuff. Subbed.

[@nickfarley2268]

Engineer Man like using python 3

[@hedleypanama]

On the new python 3.6 you can write in the last line print(f'sending username {username} password {password} ')

[@slydog784]

You need to run this as a service across multiple IPs over several days/weeks so he can’t easily delete your responses.

[@cardinal9009]

I bet that website is one of hundreds he uses unfortunately

[@mrjpz]

@@cardinal9009 never ever have i seen someone else use this for a pfp. I cropped my pic up more though

[@cardinal9009]

@@mrjpz first time I've seen someone like that as well. one more word and I'll crop my pic up more too.

[@mrjpz]

@@cardinal9009 kzbin.infoUgkxIq_FBPgezSOpIPVl0WiQd0mrzAFjGsik if you watch this clip you can see we're multiplying

[@Mmmkay..]

awww look guys twins 😊

[@gazehound]

You know this mans legit because he uses incognito mode

[@TraceguyRune]

I use it all the time on public computers. Don't have to worry about logging myself out. No cookies, no cache, no history, I'm safe

[@DontBeSynical]

Apathy FBI OPEN UP

[@jerejere69]

TraceguyRune key loggers

[@MrHippi1234]

shows how ignorant you are about incognito mode.

[@michael2775]

Shows how stupid you are. Jokes are a thing, you know?

[@tylermorris84]

I think this is my new favorite channel... My apartment complex made us register times to use facilities during Covid. They released the availability to register for gym/spa/exercise room EXACTLY 7 days in advance, and they all got booked immediately through the UI- it was very competitive. So, I back-engineered the site and wrote a python script to sign up for whatever future gym times I wanted. It never failed. I love to see other quality abuses of python!

[@midnari]

I've been learning C for the last two months and I'm so damn happy that I can understand what you're doing. I doubt I could implement it right now, but just understanding it is so cool to me.

[@zaftmonkeynuts5052]

Yeah, one thing I’ve learned from programming is understanding the code and actually implementing it to something are totally different.

[@midnari]

@@zaftmonkeynuts5052 That's the point of studying, isn't it? Learning, enjoying, practicing the code. Yeah, I can't use Python, but I'm learning the foundation necessary to pick it up in the future. I can craft little things in "C" at the moment, and yeah... It's a different syntax, but the same fundamental rules apply. The joy is that - two months ago- I couldn't even program a "Hello World" script. I can now. Shoot, I've made some extremely awesome things that would take YOU two seconds to do. Even then, Good Lord, I see the vast difference between me in December and me now. Feels good, man.

[@Solaceon]

I feel this completely! I have to understand something and set an objective in mind in order to learn it. As a little kid, those connections were formed by Neopets. I picked up a really impressive amount of HTML and CSS for a 6-8 year old. I was aiming to learn Python next, but alas life had other plans. I had a passion, but as I got older nothing helped make things "click". I lost that passion for years. But then KZbin started recommending me these more advanced "taking down scammers" videos and for the first time in forever I'm forming these connections and I'm absorbing it all like a sponge. I'm so freaking excited! The other day I made a simple little thing in Python that responds to birthday posts on Facebook with a "thank you" so I didn't have to do it myself. Such an easy little project but I did it myself and it feels so damn good!!

[@TrueComboKing]

@@midnari I agree, it’s literally the same feeling as listening to someone bad mouth you in a foreign language and you coming eight back at them and speaking that same language. It just feels good. By all regards, coding in all its forms, is a new language and the feeling you get from understanding it and learning to implement it is the best feeling in the world.

[@tcg1_qc]

I understand most of it but I don't really know Python so I was a bit confused at some of the things he did, like the .join(random + for loop). How does that work? You can just put a loop inside a function parameter and it will make the function execute every time it loops? Or does it make the random function execute 8 times and add the characters together?

[@casewhite5048]

he is just going to delete everything from yahoo during that time span

[@casewhite5048]

As long as they all come in at different times during the week night and day yeah that could work otherwise simple sorting could clear them

[@TheRijintube]

from random import randint as r random_provider = ['@gmail.com', '@yahoo.com', '@hotmail.com', '@outlook.com'][r(0,4)]

[@edism]

Nonce validation would have prevented this issue from occurring. However he could be logging IPs and other request data along with the form values.

[@bextract0]

it's quite easy to filter out as they were all sent in a short time span, all with a yahoo email from the same address, not to mention that they all follow the same structure for name generation, and that the passwords use special characters in passwords (which im not sure craigslist does).

[@SimonNitzsche]

the scammer also could store the ip addresses, to prevent this attack if the whh is not using a ton of proxies.

[@duanesmeckert6079]

A couple extra ideas: 1) I did similar, but I grabbed tom sawyer off Project Gutenberg and used it for usernames. 2) The user agent can be long, like 2k long. The user agent gets logged. The log is often on tmpfs, Which is smaller than the user space. (It just crashed, Idon't know why. ) 3) randomly generate the domain from the same words so he can't just delete all yahoo addresses. 4) the domain is hosted on godaddy, you should report it to godaddy abuse.

[@goharjoa]

Excellent. Excellent. If I had your skills, I'd do the same to these scammers and con artists. Keep up the good work.

[@ohtug]

con artist gives them too much credit lol

[@jacobhinger5039]

He shows us the code and how to implement it yourself.

[@2oqh]

@@jacobhinger5039 only applicable to a very specific situation, he probably wants to know how to do it for a more diverse list of scams, etc

[@djangogeek]

I don't know anything about coding and I don't know anything about python. But I also hate scammers. And I found the speed and clarity of this presentation very satisfying. Especially the part where all the fake emails start popping up to waste this guys time lol 10/10 l33tHax0r ^^

[@reflectionsofme]

same

[@djangogeek]

lol Not django as in the programming language or the bounty hunter but django as in the character in my avi from the gba series boktai =)

[@Balloonbot]

Same. I work with coders and they seem like geniuses to me

[@joshplant]

This comment pretty much sums up my reaction to this video lol

[@bananaconsaging8864]

The one thing is. I like to study programming start with HTML and C# just to start of but hell the tutorials on yt are a bunch of indians with cringy-monotone english accent. Creepy it is.

[@natec.2346]

This is the first video I’ve seen of yours and it definitely won’t be the last. Keep up the great work!

[@lohithArcot]

Nate C. Same here

[@samlugo6450]

Nate C. me too😎😎

[@dewybmt]

As someone new to python and still relatively inexperienced with programming this was a fun video to see work in action and the context made it entertaining to think about. I want to find more videos of contextual coding that are more demonstrative like this and less about "the technicality of the programming process'. It gives me ideas to try!

[@leonenaj]

I love this because it literally only took 5 minutes of your time, and yet it is such a nasty little trick. Bravo sir

[@TNTxCreations]

He definitely had some planning off camera and maybe even tested it before. Still a cool idea and didn't waste any time showing the viewer.

[@Arteafact]

This is honestly not that hard to do and doesn't require that much knowledge, maybe he prepared for it, but if you know how to send requests in python, then it's completely feasible to write this sort of thing off the top of your head

[@varbaek]

CabinDoor A seasoned security professional could do this without Python in 10 secs if there are no CSRF tokens present. Maybe a minute or two if you need to provide a valid CSRF token. It's that easy.

[@EngineerMan]

I'll be waiting for the 10 second video. Let me know when you post that on KZbin.

[@varbaek]

Engineer Man Not even going to bother showing how this is done in Burp. I do testing like this for a living.

[@bawad]

Nice regex trick, I'm going to steal that! I would have used a vim macro, but I like the search and replace better.

[@EngineerMan]

Steal away man!

[@MrDevianceh]

Hi +99baddawg, I like your videos. Keep it up!

[@ronyan]

Yeah I don't know why I forgot you could do this in replace, saves a lot of time.

[@robin888official]

In general better search for line endings, though, before forging a pattern for your lines..

[@Microphunktv-jb3kj]

is that some addon/plugin.. ? how can i do it in vscode?

[@elijahhayes8349]

I work in computer repair and I get numerous people coming in and calling due to scammers. This just brings me all types of joy. Keep up the good work.

[@cassiusspacetrain2852]

cool but he'll just filter the @yahoo.com since they will be sequential. a better way to pwn this cockgoblin would be to randomize the concatenation of the email service, and set a random timer to drip post into his form. so he might get one in 5 minutes, or 2 hours. let it run in the torrent computer since that thing just sits all day, and maybe run a dynamic VPN as well. that would cripple any data collection effort due to the inability to validate submissions

[@keep7smiling]

Or you could just mine bitcoin with the same computer instead of scamming a scammer without any profit

[@f0rhex831]

Thorsten Böhme where in the wolrd was he "SCAMMING" a scammer?

[@oh1125]

Mine bitcoin? This video has nothing to do with making money. He doesn't like being scammed, so he fucked with the scammer's day. Also, this isn't 2017. It's almost 2019. Who the fuck mines bitcoin and wants to degrade their computer over time and have an electricity bill of $150+ every month? You are clearly a child.

[@FlanneryYT]

Thorsten Bohme, Mining Bitcoin is actually no longer profitable. If this was 2010, maybe, but it's not.

[@josephguzman4737]

What are you talking about? I mine bitcoin on the weekend for fun in nevada. I always fine thoes shiny coins in abandoned silver mines

[@IFGchannel931]

Nice! To make it even better, the e-mail domains could be randomized, passwords could be less random (there are too many special characters in them), maybe some longer then others, and you could space out the rate in which the info is sent.

[@TheTrueSmitch]

Next time, run with different emails other than Yahoo as well in order to prevent them from filtering. Ideal solution would be Proxies, run it for at least 24 hours, and the email ending change in order to prevent ANY form of filtering out the results you placed . Because right now if I was that scammer, I’d just remove all emails ending in Yahoo that were sent in within a time frame, or just remove by IP.

[@TheTrueSmitch]

Sounds illegal :D

[@commonsense31]

You just became my number one creator.

[@andyengle]

Nice job! Similar story: I was being texted non-stop from some outfit in Miami that said "we buy junk cars!" in English and in Spanish, along with their phone number, which was a disposable Metro PCS mobile number. After repeatedly asking them to take me off of their spam list, they ignored me every time; they hung up on me, never took my name off their list, and kept texting me. So I thought, if they want phone calls, they're gonna get some phone calls. I opened a Twilio account and put $20 on it, then wrote a script that told them what my number was and that I wanted it removed from their spam list. I wrote a simple PHP script to call the Twilio APIs and then put it to work, calling every two minutes for hours on end. I never heard from them again.

[@EngineerMan]

Haha, I love this.

[@theowinters6314]

Should have thrown in a couple Bobby Tables into the list, just in case he isn't sanitizing his data.

[@EngineerMan]

Little Bobby Tables.

[@jpe1]

For those who don’t read xkcd, the suggested username would be: Bobby’); drop table usernames; drop table passwords; Depending on the Webserver and back end database this might possibly work, though probably not.

[@thatsamorais584]

@@jpe1 I like this idea as a concept better, using the request url to attack the hacker's data, over littering the data.

[@8BitShadow]

Mmm yes. Using SQL injection, but for the greater good lol. But alas, let's be honest, he's probably just ripped the code from somewhere and hardly edited it at all, which most likely would have sanitation already implamented.

[@jpe1]

dragon spirit(aka shadow999999) good programmers write good code; *great* programmers steal great code. (The actual line from Eric Raymond’s *The Cathedral and the Bazaar* is less pithy, something like “great programmers know what to rewrite and reuse” but I like this version better)

[@WayDorian]

This is amazing content and I’m about to binge all your coding videos. I reallllly appreciate you telling us the logic behind each step. I’m also appalled at the idiots in the comments, please keep making these! I learned more in 5 minutes than an entire semester of CS freshman year 😂

[@EngineerMan]

Thanks for the kind words. That makes two of us (re: comments).

[@Johnzors]

Really? from this video you learned more than your entire first freshman semester? Your school sounds like garbage..

[@toxicity4818]

First of all, semesters are half a year. Secondly, a class of ~30+ can make actually learning/overcoming mental blocks almost impossible when discussing certain topics/sciences. If something was pointed out in a 5 minute video that was entirely skipped over or not thoroughly covered in a class of a few dozen people, then it can be very easy to learn more from a video than a class. Try thinking logically instead of being a smartass.

[@Johnzors]

@t0xcity You're actually dumb if you think this video is better than an entire semester of CS. If you learned more from this video, then you did in a class, where more than one topic is explained in detail, then coding really isn't for you. If you can't focus, being around 30+ people, then going outside isn't for you. I can tell you've never even been to a university by your profile picture alone, and i'm honestly guessing you're 15. You really think if you have a coding interview, you'd have a better chance knowing how to solve it by just watching this video? It's a cool video sure, but it's nothing compared to a university education.

[@Johnzors]

@0f392k49fg91h7fg893j the original comment was " I learned more in 5 minutes than an entire semester of CS freshman year". I understand youtube videos can be a good tool to help reinforce what you learn, but this guy specifically said THIS VIDEO, this ONE VIDEO, was better than his entire first year CS Semester, which it's obviously not. You sound like a conspiracy theorist. Try not to be so cynical all the time, and I guarantee you'll be happier. Also forsen is haHAA

[@Mrkonc]

You know, even almost 5 years later I still use this video and what it taught me. Thanks Engineer Man!

[@Berryss]

I know im gonna need requests I know im gonna need os I know im gonna need random I know im gonna need string I know im gonna need json

[@TraceguyRune]

I'm more of a Java guy. Why was OS needed?

[@AbCd-kq3ky]

os.urandom (docs.python.org/3.5/library/os.html#os.urandom)

[@hybby]

BoliBerrys so needy

[@amethystjean1744]

This is awesome. Thank you for doing this. I also love seeing inside python as I don't know how to do that but it makes it seem like something that would be cool to learn more about.

[@dheibeljr]

No time like the present to learn! Python isn't that hard and there are TONS of resources and the learning curve has been made so shallow, you could totally teach yourself if you wanted to. You got this!

[@nAna36628]

The scammer seeing a bunch of emails getting logged in just 2 minutes: interesting

[@kuba_ota5154]

what I thought a python was gonna eat him I didn't understand a single word

[@oldbatwit5102]

Yeah. Where is the snake?

[@libanabu6222]

I thought he was gone send real python over the computer to them with 2 day delivery

[@kuba_ota5154]

Liban Abu exactly. Maybe the coding he did is to build a robot snake?

[@bqfilms]

he basically created like a file full of names, for each name he generated a random 8 character password and sent them all out to the scammer page using the url he got from the chrome console

[@juggalo184]

Not only that but his punctuation was awful.

[@dukedongflap]

This is amazing!!! I dont know how I found this but you have my sub sir. Thank you.

[@EngineerMan]

Excellent username, to be sure.

[@KennyJacobs]

Me: Stumbles on to this video Me: Heads on over to my spam folder Me: Opens the first email that looks like a phishing attempt Me: Let's the fun begin... Thanks for this awesome tutorial. I haven't laughed this hard in a long time.

[@LilYet]

ok

[@Lykon]

From the console right click on "copy as curl". After that simply go and convert curl to python request. So you can skip the basic request code part.

[@omegaz2398]

Improvement: 1. hide your IP address using tor network to prevent the scammer blacklist out your IP. 2. randomize 'yahoo.com' email with more email providers. 3. deploy to cloud server, randomize the intervals and bomb that service for a couple of days. HAHA.

[@ArjenJongeling]

Omega Z there’s always an IP address. Scammer groups list on IP addresses and ignores entries where the count is 2 or more.

[@ryanmickelwait1521]

Arjen J but tor uses random ip

[@Palewhitegamer]

I would personally use a list of common passwords alongside legit emails: currently, this input is too easily filtered out just from the uniform password length, but also the non-legit emails. Something like this will only work as a time waster if it has a shred of believability.

[@philipphoehn3883]

Arjen J he's talking about hiding YOUR IP address

[@Palewhitegamer]

...in the context of making this seem more legitimate for the scammer, which changing your IP address would do, but you'd have to change it for *every* 'upload' of this to the form; and ensure none of it is repeated, which is an ass unless you have a spare server lying around. And RE your previous comment - that's an oversimplification of how Tor works. You're basically bouncing your traffic through everyone else's, making it harder for an external individual to see what your traffic has been to someone else's, but it's not perfect.

[@dude_adm]

That's awesome thank you for this. Mechanical engineer here, always wanted to work more on the little coding knowledge I have this has been inspiring and entertaining. Subscribed

[@rottsrool]

Love what you do, thanks from all us non tech savvy people 👍

[@theentirestateofalaska.4983]

Non programmers you mean.

[@SimonASNG]

Scammer see's what's going on and just deletes all the data from Yahoo emails. But yea, the videos are great, keep 'em coming. If you spent a heck of a lot more time making the plan more devastating to the spammer, it would make the videos too long (perhaps unwatchable) and you'd just get fewer comments (bad for the all mighty algorithm). Good job.

[@pluto9000]

You think one day we will all be controlled by the algorithm? 😅 Maybe it made me type that. 😵‍💫

[@SimonASNG]

@@pluto9000 The algorithm just makes sure you never see any videos that don't appeal to its whims... More of a filtering out process than a control process. But yea, you are probably totally under the algorithms control at this point. ;)

[@luckydannumber2]

Easy way is to randomize the Yahoo emails to gmail, outlook and all the free ones, This would prompt him to delete all the free emails and lose all the legit ones. Its an extra two or three lines of code as it's python.

[@julesssssssss]

@@singu7arity run this all day, with random time delay between entries by 3 seconds to 2 minutes or smth

[@kricku]

"Wow. All these people with random passwords of the same length logged in at the same time from the same place" :P

[@manorothpitlordextraordina4041]

Would have been cool to add variable lengths in the passwords / emails so that the submissions aren’t so uniform. It would be fairly trivial for him to purge the database of all email/password combinations of a certain length.

[@dead_protagonist]

right.. most people use gmail anyway

[@MotorcycleRebuilds]

he could just filter the yahoo emails out

[@Spinxaslt]

Not sure if anyone mentioned, but you could have tried SQL injection, as he might not be escaping it. Could blow up the whole database if you wanted to.

[@jpriddy]

I thought that's what he would be doing, but this is pretty cool too.

[@abramspamers6456]

You probably don't want to upload videos of yourself committing a crime on the internet. Sending fake logins to a scam site to be annoying is quite different from attacking it.

[@0x8badf00d]

My middle name is "'); DROP TABLE loot;". How is that illegal? :-) I wouldn't consider a little SQL injection as attacking, it's more like poking and anything this simple that can't tolerate it deserves it. But probably not a good idea to tell anyone that you're the hero of the day.

[@grooviec]

how do you know there's an sql database behind this login page?

[@v380riMz]

roma98 yeah, mostly it’s just a simple html which sends the input to a .txt file on the phishers pc, or in some cases just shows it on a command prompt.

[@joalltaeuber8065]

Great Video. Just found it 4 years later. Clearly, it's a timeless one. Thanks.

[@Stoney_Eagle]

You learn something every day... Didn't know you could regex replace in a code editor. Awesome!

[@ghenulo]

It depends on the editor.

[@nikhilsingh6759]

what editor was it though? coz i don't think you can do it in IDLE

[@Stoney_Eagle]

@@nikhilsingh6759 he's using atom

[@richmo619]

I missed the part after you said "hello everyone". ha ha ha

[@ethanpet113]

Should probably have tested also ';DROP TABLE USERNAMES;

[@dniam9859]

Ah... SQLi

[@soldiergaming2722]

Lol That must pissed him off, and you did that in a matter of minutes! You're good!

[@EngineerMan]

I certainly hope it pissed him off! Ha.

[@blasttrash]

lol if his backend is tracking your ip, he can delete them away using a simple regex db trick too. :P you should use multiple ips on top of multiple vpn proxies to confuse the scammer even more.

[@giakomoventura2088]

blasttrash using prohy trought python for each request ... beter using random dns ... that dosent request password

[@Lykon]

That form name and url seems a random code. Are you sure the request is always the same? That may be used as a unique ID. If that's the case your code isn't doing anything, but simply overwriting with a new username and password all the time. I would have verified that those fields and url were always the same. Or, if they changed, also looped that with random shit inside my code. Field names could just be part of a "any" type data structure accepting all sort of shit. This means you can maybe even do more damage.

[@F39Productions]

ya those look like csrf tokens

[@pluto9000]

Totally

[@YISTECH]

my thoughts exactly

[@Christian-mn8dh]

hmm

[@Imwright720]

Some kind of fun. I have only a basic understanding of what you did but I love it when people scam back.

[@TamirYankevich]

Dude this is savage, way to restore justice in the world 😁🙌🏽

[@kopjjipj5743]

unfortunately it's just a minor inconvenience, no matter how many fake combos you put in the hackers use an automated tool to test them anyways, it won't take long to find the real ones.

[@bcoda]

*social justice *0.00001% of the world

[@spike4850]

Tamir Yankevich wtf? What has this got to do with restoring world justice? Lmao

[@TraceguyRune]

Daniel Hernandez I found 10,000 names, and ran it twice. The more we do the more time it takes scammers to run their automated process.

[@Draghful]

I'm gonna be totally honest here... These videos are the most satisfying thing I've seen in the past 3 years. :)

[@elementalsigil]

Thanks for fighting a battle that many of us do not know how to. Scamming takes good money and confidence out of consumers and does significant damage over time as we lose faith in good commerce.

[@justjosh1400]

Great video idea. I think a more efficient approach would be to send it over time. Because what he's going to do as a scammer is see everything that came in at a start time and end time notice that he got 10000 or so while phishing. Most likely he will just delete all the data that came in during a certain time frame.

[@bobfromwork]

I mean sadly it's gonna be easy for him to just exclude all emails from yahoo with 8 chars of password, but it's a decent idea.

[@ZacklFair]

you can always do more or less chars in between. takes 1 change in the code. or add more randomness i suppose. but thats not for a 5 minute video i guess :>

[@guitarmeetsscience]

Nice! Maybe randomizing a set of emails (yahoo, gmail, aol) etc would really add to his confusion. I like it!

[@Arkryal]

A great example of data poisoning. Obviously, you could randomize the send interval, the email domain, and proxy-hop to obfuscate the origin of each request. Another technique I've had fun with... submit the Anti Virus test string, lol. This rarely works, but when it does, it's hysterical. They store the collected data as plain text and upload it to cloud storage like Dropbox, google drive etc, where it's flagged as a virus and promptly deleted. It confuses the fuck out of the novice scammer. Looking at the unconvincing password phish, I'd assume either your target had no discernible skill, or they were specifically targeting idiots (which may be the case... you can run a scam for longer if tech-savvy people just ignore you). In a more advanced attack, if you knew anything about their collection methods and how the data was processed after collection, you could do a lot more damage. SQL injection for example. Even seemingly trivial things like using UTF32 characters (especially hybrid glyphs like the Ninja Cat emoji) can really fuck up the collection, and a lot of scammers don't regex those things out, or they do it in the java script on the form page which you can easily bypass. One thing to be aware of.... they may validate email addresses before committing them. They have a mailing list, they bait those specific people and only collect passwords from people who they sent messages to. In many real-world scenarios, this wouldn't work all that well in practice. For that reason a simple DDOS would be of greater utility. This is probably a phish specifically for craigslist accounts for use in spamming. If it were a general cred-sweep targeting email accounts, you could have some fun with that by honey-potting an account and handing it over. A RAT in your Dropbox, maybe some bullshit "classified emails" between US intelligence officers, something that will let you screw with them once they take the bait. I know the point here was to fuck with them quickly, but sometimes it's fun to draw out the engagement.

[@jeanclaudevanslamme]

It would've been a bit more effective if he used a list of common street and pet names to generate passwords, although if the scammer has a script to verify phished login creds then this didn't do much anyway =(

[@helxis]

Cute, but you didn't perform some basic checks. Given that the username and password elements appeared to be named randomly, it is possible they are generated dynamically per each request of the main page (as well as the submission URL). The web server could simply be accepting your requests but not recording them as a result. Also, the email addresses are formulaic enough that they could be easily stripped out. I would have gone for a dictionary and a large pool of domain names.

[@bloodless2010]

Yep. First thing I saw was this, chances are it was some anti-CSRF PHP script making the fields for the POST vars randomised. Everyone is complaining about how easy it would be for the guy to remove them from his db, I doubt they even got there in the first place!

[@alakani]

*tags your username with {{Citation needed}}* :P Nah that's a good point though. Either way, the whole domain is down now

[@babybirdhome]

This guy missed step one: send a report to the hosting provider. By spending time coding this first, the site gets to exist longer and harvest more legitimate accounts. The fake accounts don't do anything to protect the victims. It's as trivial to test fake accounts as it is to generate them in the first place.

[@kyranmountain1877]

So glad I stumbled on this video. Awesome video dude.

[@G0ingN0va]

I've only just come across your channel and I'm amazed at how swiftly you deal with scammers. Have you ever considered teaming up with Jim Browning or, Scambaiter et al? If any of you guys combined you'd destroy scammers globally in a matter of minutes! Great channel. Subscribed!

[@TrueComboKing]

I’d love to see them do more than ruin a scammers day. Those scammers in India are the absolute sickest people I’ve ever heard speak. The second they don’t get their way, they start cursing the other party out and….idk why but they always like to add insults about the other parties mom, lol. These guys are insanely good at what they do. I’d love it if they took it one step further and messed with the temperature control settings in one of those “call centers”. I don’t know if that’s possible though, they probably don’t have a smart thermostat to hack. It would be funny though to turn their heater up to the highest setting and watching them squirm as they try to turn it down, lol

[@anuragpramanik6095]

The whole world uses vs code and it’s auto completion. This legend still uses Atom and rocks. Great video man.

[@PedroCristian]

Real programmers use butterflies...

[@polarcat0156]

@@PedroCristian real programmers write it on paper and use ocr to get the code

[@itsyaboivoid]

​@@polarcat0156real programers use punch cards and assemble everything theirself

[@BrianAndersonTT]

I have 0 experience with this but the way it is presented makes it so understandable.

[@mikenephilly]

I just wasted time looking at this video thinking you were going to troll a scammer with Monty Python quotes.

[@EngineerMan]

Sorry to have let you down.

[@coolamp]

I would love to see what you could do to the fake steam websites that scammers on rocket leuge use. they get people's steam accounts, steal people's items, and sell them off for real money. it's super effective because of all the little kids that play rocket leuge, and they use websites like steomcommunity-profiles-32327.000webhostapp.com/tommy, since website preveiw in steam DMS only shows the "steomcommunity-profiles" part people could easily misread it.

[@VenalityAF]

Damn dude he apologized, you should feel like shit, not like you would've had anything better to do anyways

[@UncleKennysPlace]

something, something, dead parrot, something.

[@threynolds2]

There IS a video of someone trolling a scammer with movie quotes on KZbin. I saw it the other day.

[@robertgoss4842]

You're amazing. You are doing noble work. Just glad you're on the side of goodness and light.

[@f1f1s]

Initially, I read it as “Showing a Craiglist scammer, and this scanner is a boss using Python”. Nice garden path sentence!

[@desireisfundamental]

Where is the python ? I thought you were going to release a python to some scammer on the street !?

[@ForsakenClarity]

you're probably joking but if you aren't, Python is a coding language

[@FIGNAS83]

Hahahahaha, good one 😂

[@robinranabhat3125]

are you one of those "SHOW BOBS AND VEGENA" or "BORAT" kind of guy ?

[@rkaynedsalt4392]

python is a programming language

[@nathanquoin]

haha lol

[@jdavis460]

Wish I was that cleaver to write those programs would love to keep flooding the scammer’s with junk.

[@MrSavindrasingh]

This one video is enough to get a glimpse of your skills. You earned a subscriber.

[@GAS.M3]

I wish I was as smart as you with computers. Awesome work 👍🏻

[@snø_music0]

alxM3 stop wishing and learn something then . dont be lazy

[@GAS.M3]

lil trap thnx mom I will

[@Templarfreak]

There's a difference between being having so little understanding of something that you don't even know where you should begin and thus anywhere you try to start is just an impossible hell, and being lazy. It just so happens that with programming, it's basically impossible to start anywhere that feels productive and like you're actually learning something especially when most people go around berating people that are trying to learn and points them to extremely overly complicated thick manuals and online resources that don't get to what you're trying to learn until 100s of hours of reading that also requires college-level understanding of math and computer science to begin to understand said thick manuals anyway thus making it totally pointless, when all someone really needs is some help. Wow what a rant LOL But that's why channels like this are so awesome, these videos are actually really helpful in learning the concepts involved while showing production and payoff immediately for something you may want to do.

[@devonc3948]

Templarfreak I started to type something similar and gave up, but the starting point and direction is absolutely a deterrent to many in any new expertise

[@Lalaland.001]

Python, SQL, JAVA, PHP, C++and other programming languages take about three months to really learn, there are a plethora of tutorials here on youtube. The books are for absolute nerds that want to go really deep, but to get the basics of a programming language down takes three months max. After that you get to learn the intricacies of the language on the job. There are plenty of ICT companies looking for interns and people willing to learn it for free. They will give you the courses needed for free and you get a job to boot. see what I did there... anyways stop bi&^%% about something being hard, it's only hard, if you never get of your lazy ass to actually give it a shot and by shot I mean you actually go out and do something about it.

[@raquelocasio8588]

I love this. Someone needs to create a meetup where coders get together once a week and hit scammers like this over coffee. Great job!

[@turboflush]

I don't know why you would thumb down this. Thank you for doing this for those that are powerless against these scammers

[@filipoda123]

Bro the comments dissapeared lol

[@Intikus]

The scammers got him back

[@filipoda123]

@@Intikus HAHHAHA BEST WHAT IVE SEEN TODAY LMFAO

[@popular_dollars]

How apropos that the json file probably included "Jason" somewhere.

[@Jivvi]

Jayson, Jase, and Jace, but no Jason.

[@Davioc04]

I dream of a World where everyone has an app being fed with codes like that, running in background for just a few seconds a day.

[@roboppi6368]

I just want you to know that thanks to you and your videos, I finally know what to study. Thank you. I was so lost but just watching you work cleared everything for me.

[@andrentaz]

Some random Luke: "nice! I hate scams too!" Also, some random Luke seeing his email being randomly generated: "well, that explains a lot 🧐👀" Great vid though :)

[@MAN-hk9wq]

I have absolutely no clue what he is talking about, but a good deed never goes unnoticed

[@louiseboyle9618]

Well if your IP is logged when you post your form, it will be easy for him to figure out which credential are legit or not 🙄

[@LuminousWhispers11]

In which case hopefully, he was using a VPN or proxy.

[@nicktohzyu]

should use a list of top 1000 passwords instead

[@TraceguyRune]

and it goes like this (if you use more or less than 1000 passwords) passwds = json.loads(open('passwd.json').read()) aPasswd = random.choice(passwds)

[@take87chris]

Exactly, picking out real passwords from that least wouldn't take much time.

[@john_avernia]

I'm a beginner, I know nothing about programmer until several months ago when I started doing CS courses for fun. And man, I'm so happy that I could actually understand about 70% what he was doing in this video. After more courses and finishing more fun programming projects, hopefully, my understanding would've reach 100%. Awesome video and fuck those scammers!

[@SpanishFluency]

the scammer can add in the php file these: $subj = "Login from".$ip." "; in now he can delete all the fake logins, that came from the same ip address. ;) and he can also prevent you from entering his fake website by blocking your IP using IP deny Manager in cPanel :D The Best way to make a scammer crazy is by reporting his Phishing Page to Google Safe Browsing and spambots. and the phishing page will be down in 24 hour.

[@whydafuck]

but what's the fun in that?

[@thegiddyjoy]

Then you actually get to fuck with him...

[@justinstar9710]

I suppose the real question is, would you rather watch this, or a guy on the internet reporting sites to Google?

[@SymphonyOfTerror]

You're overestimating the intelligence of a phisher that literally mashes their keyboard to generate entropy. Check out all the "asdasdasd" in the URL and form keys at 1:35.

[@NOLlFE1]

Now we can use proxy list to prevent that :)????? ezpz

[@teksaucee]

not all heroes wear capes lol

[@roysnider3456]

I love that your giving it back to those scumbags.

[@jesvinpalatty9112]

Hey Cool work, You could have also made an array of email domains and randomly assign it to name strings to confuse the scammer more. Coz he may simply filter the @yahoo domain guys now but with randomizing the domain the scammer will be more confused

[@bradarmstrong3952]

I love the casual way he uses the scammer's setup against the scammer!

[@johngillespie4116]

Keep it up. I feel better now you got a scammer. Thank you, John.

[@arnoldcaines9012]

I like your vids. They're short and to the point. I don't know any better so I'll trust that you're actually being a headache to scammers. Maybe you'll encourage other with similar skills to do the same and life will become difficult for scammers.

[@markaholt]

This is f'n awesome.

[@bickertonwayne]

This might be my favourite video on YT

[@stiljohny]

nice work man... you could have create an array for the email domain and randomly take from there , cause now he has loads of yahoo, easy pattern !! nice video!

[@longnaaaaaaaaaaaaaaaaaaaaame]

yeah slighlty more dedication wouldve ruined the scammers career

[@SensSword]

What's he doing logged in as root in terminal?

[@djmarkalmond]

you are a genius... thank you from all of us non tech people who've been scammed in the past!

[@Aaron_b_c]

Why not just use a faker library?

[@EngineerMan]

No reason I couldn't have.

[@ISZAudio]

Is no one else going to talk about this guy running his python interpreter as root or not including a shebang at all? No? Just me? Alrighty then...

[@avova]

Yeah, I loled hard. Dude runs stuff as root and think he is a "hacker".

[@biiki007]

avova how does he think he is a hacker? 😂😂

[@Davesoft]

Hehe, yeah, it's a script kiddie video. Beards don't visit ad-laden websites for a simple list of names

[@Twat2024]

you guys are extremely arrogant , i have no idea about code , but you guys just sound like a bunch of jerks

[@Davesoft]

Sky "i have no idea about code" there there, one day you'll see what we see :) Imagine seeing a crowbar next to your front door, and the door is still closed. Nomatter what you do with that crowbar, the criminal is looooong from here and entirely unaffected by what you do. That's what this video is. Waving a crowbar around telling people he's batman. The counter-scam bubble is worth tapping, it seems.