How to Hack Gmail: Everything You Need to Know

Gmail is one of the most popular email services in the world right now. Naturally, this makes it a major target for hackers, but it's also a tough cookie at the best of times. So how exactly can one hack a Gmail account? That's what we'll try to find out in this article.

Before I go any further: Gmail hacking is illegal!

The point of this article is not to encourage you to hack someone's Gmail. We want to give you insight from the attacker's perspective so that you won't be a victim in the future. With that in mind, let's get down to it.

Successes are Slim

Let's be realistic here. Google has been working diligently to patch up every security hole the hacking community comes up with. This is, of course, as it should be, but it means the prospect of hacking a given Gmail account successfully isn't all that large. It requires quite a bit of luck and some quick thinking. Yet there is no such thing as a foolproof system.

Getting Gmail Passwords

All of these attacks assume that you already know the Gmail address of your target. Getting someone to give you their email address is usually not that hard. Even if someone won't give you their address directly, it's likely if you google their name, you'll find it somewhere. I leave the details of this particular hunt for you.

Go Phishing

We've written quite a bit about phishing on Technadu. That's mainly because it's such a popular method of getting user credentials. Basically, you send an email pretending to be from (in this case) Google that leads to a replica site. The user is tricked into entering their username and password. You then redirect them to the real Gmail site, and they'll often just think it was a weird glitch. You can learn more about how phishing works in our article on it.

Use a Keylogger Attack

A keylogger is a piece of malware that records every keystroke made on the target computer and then periodically sends a log to the attacker. Obviously, the challenge here is to get the malware onto the target's system.

If you have physical access to the computer in question, you can use a hardware keylogger. Alternatively, you can install it on the target's computer if they forget to lock it. In the case of a hardware keylogger, you should plug it in where the user is unlikely to look often. Giving you an opportunity to retrieve it.

If you don't have physical access, your only remaining choice is to trick them into installing it themselves. Sending people file sharing links, fake email attachments, and other traditional means are an option here, but your mileage may vary.

Check Against Cracked Passwords from Other Sites

It's an extremely bad habit, but plenty of people use the same password across multiple sites. This means when major password databases are cracked and published, you might find a few folks who are a little lazy when it comes to passwords.

These databases are often found in places hackers hang out on the internet and can be a treasure trove of reused Gmail passwords. One quick way to figure out if your target's email has been included in a public data breach is to head over to haveibeenpwned. Type the target's email address in and see if something comes up.

Rip it Straight From Chrome

If you have access to a person's computer and they use Google Chrome, you can actually extract ALL the passwords they use from its password manager.

How, well, just follow Google's official instructions. This only really works if you also know the local computer login password or if this user doesn't password-protect their user account. Still, it's a useful trick to know.

The Problem of Two-factor Authentication

OK, so now you have the actual password, but when you try to use it, Google brings up the need for "two-factor authentication". What gives?

Two-factor authentication simply means that the second level of verification is done in order to keep the user's account secured. Two-factor authentication is a very strong security measure since it means you actually have to compromise two unrelated systems. That's hard, but it's not impossible.

If you manage to get access to a user's SMS messages, you don't even need their password, to be honest. You can reset the password to whatever you want, but this will expose you. If you just want a look without changing anything, then the best use of the SMS service is simply logging in from a new machine.

Use Trojan APKs (Android)

If your target is using an Android phone (which is most people), then you can create a trojan horse APK file that will install a backdoor on their phone. This is a hack that can be perpetrated over a LAN or over the internet. This means you just need to somehow trick the person into installing the APK file.

I'm not going to link to direct instructions here, but anyone with Google can find them easily enough if you are curious about how it works.

The backdoor will allow you (among other things) to get a dump of their SMS messages. This would include 2-factor authentication messages.

SIM Cloning

SIM cloning is exactly what it says. It's making a copy of someone's SIM card. This can't be done remotely, but if you have access to someone's SIM card for 20 minutes and the right tools, you can make a copy and receive the same SMS messages they do. Once again, I advise you to Google the specifics on your own.

Use Some SMS Social Engineering

This last method is the easiest from a technical perspective but requires a rather gullible target. If you know the phone number of the target, you can send them a message (not from your own number!) asking for their authentication key.

• Go to Gmail and request a password reset using two-factor authentication.
• At the same time, send a message to the target saying that "there's been suspicious activity on their account. Please reply with the code"
• The target sends you the code and then you use it to reset their password.

If you want to cover your tracks further, then send them another message with the new password you've chosen. Say it's temporary and that they can change it later. You know, have a window of opportunity to look through their emails or set up a forwarding rule so that all future emails go to an anonymous email box you've set up.

Hiding Your IP From the Target

Whenever someone logs into a Gmail account, Google logs their IP address. If the login is from a region that's strangely far from where the user usually is, then they get a flag with the IP and location as well.

Either way, anyone attempting to hack a Gmail account would be well advised to use a VPN to mask their location. If you know where in the world the target lives, you can even choose a VPN location that's close to them. That way, if they get a login notice, it will look legit at first glance. We recommend ExpressVPN, which is currently our favorite all-around VPN service.