A guy on Facebook tried 'grooming' my 15 year old daughter! Wrong person to 'Hit'!

My 15 year old daughter has numerous friends on Facebook, and she adds people without checking on them first. Well, on Monday a person called "Paul Gibson" added her and said he age was 25! :angry: - We've always told her, to be careful, so she called me to her room.

I said keep him talking for a few more sentences then appear offline to him. While she did this I traced his IP address, regardless of what chat people use, you still have the Windows command prompt. And by using it, you can easily log any ports being received data on!

So, I fired up cmd.exe in admin mode from the Run box and then entered netstat -a this starts logging all IP address coming in and out of the machines in Facebook Messenger. But if you want to track a person from any other messenger service like Yahoo, Skype, etc you use netstat -nbt

You will get a list of IP addresses, but one will start standing out from the rest which will be the pervert!
Then just copy and paste it into a place like http://www.ip-address.org/ to find their location.

If you calll the police and you state you have a IP address that was logging all messages, they will probably want a copy for their records. The guy didn't even hide his real town, bloody idiot!

I hate these sicko's! - No one messes with my daughter! Hiding behind a keyboard does not work - this even applies to VPN's and Proxies! People think they are totally anonymous, that is a myth! It works with companies, but if a person wants your real IP they will gget through a VPN!

Trouble is from what I have read the old bill don't even want to know unless he/she tries to arrange a meet.

I hope you named and shamed to all his facebook friends . The cunt.

There was only 5 friends... I am assuming the accounts are all fakes - but you cannot fake the full IP and MAC address - I did grab that at the same time, with my little USB Toolbox Penning Tools! I have quite a few USB sticks, some are just cutdown Linux, others contain all the tools I need to bypass any security! ;)

Well, the Police was on the phone for over an hour with my daughter. With Facebook in most cases it is basically useless, unless threats are made, but these must be very serious as my niece found out by her ex-husband trying to blackmail her - that isn't taken lightly. The cops gave him 3 warnings not to contact her again, but as soon as they we will arrest you if you try in any form of communication with her. That was frightened him to back off. That story hit the national headlines in the UK, but it was years ago - and there was much more that went on.

Facebook is so dam false - who wants to know what you have done through your day? I certainly don't.

Good to see your valuable input Oracle but really we all want to know is how we get Chaturbate girls IP's so we can hack into their webcams hehe

But seriously seems some good information you providing Oracle ;-)

Can't say I've bothered looking closely at how facebook works, but surely the messages are all going via a facebook server?

If that is true then how will netstat help?

Is this the same kid that googled very large dildos from another thread ?

http://digital-forums.com/images/df2...quote_icon.png Originally Posted by Black Oracle http://digital-forums.com/images/df2...post-right.png My daughter looked them up on Google, at first she checked the price of over £110...

Then she check Google Images - and was shocked because they were used mostly by MEN! lol She said "Now, that is totally GROSS!" hehe

Quote:

---

Originally Posted by Over Carl

Can't say I've bothered looking closely at how facebook works, but surely the messages are all going via a facebook server?

If that is true then how will netstat help?

---

If you run netstat -n you will see the Protocol which in theory should be TCP, followed by your Local IP then you will see the Foreign IP and then the State
Now, if you check that list, you’ll see every Foreign IP is attached to every sent command from the other users device, not Facebook.
Netstat does have a lot of important switches and syntax types, hence the following:
netstat [-a] [-b] [-e] [-f] [-n] [-o] [-p protocol] [-r] [-s] [-t] [-x] [-y]

Depending on the command switch defines not only data you can view, but also you can control the established connection time.

The command line in Windows is pretty powerful, but not as much as Linux! Especially, Kali Linux which is specifically a build for ‘penning’.

Quote:

---

Originally Posted by Mickey

Is this the same kid that googled very large dildos from another thread ?

http://digital-forums.com/images/df2...quote_icon.png Originally Posted by Black Oracle http://digital-forums.com/images/df2...post-right.png My daughter looked them up on Google, at first she checked the price of over £110...

Then she check Google Images - and was shocked because they were used mostly by MEN! lol She said "Now, that is totally GROSS!" hehe

---

I didn't Google very large dildo's though, that was my daughter when she seen that post, when I was on this forum.

That was me! But that was unreal! Who the hell buys something like that?

The point being your letting a 15 year old look at images like that.

Quote:

---

Originally Posted by Black Oracle

If you run netstat -n you will see the Protocol which in theory should be TCP, followed by your Local IP then you will see the Foreign IP and then the State
Now, if you check that list, you’ll see every Foreign IP is attached to every sent command from the other users device, not Facebook.
Netstat does have a lot of important switches and syntax types, hence the following:
netstat [-a] [-b] [-e] [-f] [-n] [-o] [-p protocol] [-r] [-s] [-t] [-x] [-y]

Depending on the command switch defines not only data you can view, but also you can control the established connection time.

The command line in Windows is pretty powerful, but not as much as Linux! Especially, Kali Linux which is specifically a build for ‘penning’.

---

As I mentioned, I haven't analysed communication to facebook.

However from what you are saying, that would mean Facebook chat messages are sent P2P - i.e. not via a central server.

So how can people send messages to each other when the recipient isn't logged in?

Well, I suppose if you look at like that, it does look bad. But these days, girl's are more grown up, than they were back in my day. Our daughter has had the same boyfriend for over a year now, and is not far off 16 years old (in September!).

But she's been brought up with her two brother's in their twenties - she doesn't attend a school, shes at an academy, leading to college and finally University.

But, she's shown us worse on Facebook posted by her friends - In my teens, our parents would be shocked - these days society has changed so much, and in some respects not for the better either!

Quote:

---

Originally Posted by Over Carl

As I mentioned, I haven't analysed communication to facebook.

However from what you are saying, that would mean Facebook chat messages are sent P2P - i.e. not via a central server.

So how can people send messages to each other when the recipient isn't logged in?

---

Facebook uses SSL, and you have to be logged in, and any person must be added to your friends list in the first place to be able to chat or call the other person. The Police said she should not just add people she doesn't know, which is true, but do teens ever listen? Nope!

Any way to track messages etc on instagram - does the session cookie thing still work? I know someone who's been having a similar issue with his daughter and he want's to keep an eye on it.

Quote:

---

Originally Posted by hoponbaby

Any way to track messages etc on instagram - does the session cookie thing still work? I know someone who's been having a similar issue with his daughter and he want's to keep an eye on it.

---

Does his daughter only use Instagram on the home network? You can always setup a "man-in-the-middle-attack" - this allows you to collect data incoming and outgoing from any device on your network. You can do this by making yourself as a wireless public login, once she connects you can take over access, but this would look too obvious, so a setup of "listening ports" is all you need.
:wink2:

Quote:

---

Originally Posted by Black Oracle

Facebook uses SSL, and you have to be logged in, and any person must be added to your friends list in the first place to be able to chat or call the other person. The Police said she should not just add people she doesn't know, which is true, but do teens ever listen? Nope!

---

You seem to be dodging the question.

Are facebook chat messages sent using some p2p type mechanism? If so, netstat could help you track down the sender of a message.

Or are they sent via facebook servers? If so, would it not be true that netstat would only show the ip address of the server relaying the message to you as the remote address (along with other communication that is irrelevant to our discussion)?

Quote:

---

Originally Posted by Over Carl

You seem to be dodging the question.

Are facebook chat messages sent using some p2p type mechanism? If so, netstat could help you track down the sender of a message.

Or are they sent via facebook servers? If so, would it not be true that netstat would only show the ip address of the server relaying the message to you as the remote address (along with other communication that is irrelevant to our discussion)?

---

I don't think it is p2p, but XMPP. A thread on it here:

http://security.stackexchange.com/qu...-even-possible

Quote:

---

Originally Posted by CzarJunkie

I don't think it is p2p, but XMPP. A thread on it here:

http://security.stackexchange.com/qu...-even-possible

---

From what I understand with XMPP is that it is all down to how it is configured as to whether IP addresses are included in the comms.

I was looking at a way of showing how it all works, but p2p is not the protocol used in Facebook Messenger - you can find the protocol if you use Pidgin IM, when you click on Add Facebook actually comes up under XMPP.

The server order on an netstat -a or -an switch shows:

Facebook in California first, followed by Facebook Ireland both are on SSL dedicated IP's, then you see the IP address of the person on Facebook Chat uses which port 5222, by the time you see the hit on their device.

It's quite a privacy issue that I'm surprised hasn't been made more of, especially as people love to bash Facebook on privacy issues.

Quote:

---

Originally Posted by piggzy

From what I understand with XMPP is that it is all down to how it is configured as to whether IP addresses are included in the comms.

---

Can you expand on that?