Hello everyone. Welcome back. Let's take a look at the
last attack on, as man, the browser. As
a name suggest that Argo is trying to compromise the
browser. The user is using. Since
it's a client that attack that was selling will
try to exploit vulnerabilities that may be present
on the version or any of the script that
can execute.
Begin full or partial access by doing. So that
hacker is trying to gain control the sensitive information
that's being saved in the browser or
can be used for any fishing
scenarios. Now, let us take a look at
the common attack vectors as to how my interposer
can performed.
The most common scenario would be creating browser
extensions.
Most common major industry browser such
as Chrome Firefox. They have Multiplex
engines available. So that
a cow can create malicious extensions and distribute it
to the users and expect them to install it.
Once extensions are installed. They
would need some privileges from the browser side in
order to gain control. The
second Vector, would be a pi O King.
All browsers would be using OS
based apis in order to interact with acidic protocol and
to render the content and display to the victim.
So that would be scenarios where
the attacker is able to create malicious apis,
that are hooked onto the browser process and
gain access.
And one of the most easiest and common way is
to execute malicious content on the web page itself.
So that using social healing
scenarios in that account distribute selling. And
once the website is a
run on the client side of the victim, the
taco will gain access.
Now, let's jump on to the devil.
For this particular demo, we will be using a tool called
beef is also known as browser exportation
Facebook. This is something that is available
in colleague environment in case. If it
doesn't compare install, it can be downloaded from
the color Repository.
So the first step would be to initiate the
framework.
So once this particular framework is
initiated the two, common URLs
that were interested would be the hook dot JS and
second would be 3y panel.
So Jess is the malicious script that has to
be injected on the vulnerable or malicious website,
and that particular website is
what would be distributed to the victims. And
once they visit the website, particular
browser would be compromised.
So in order to do so, I have op already injected
this particular who plot J is in the demo website.
The Second Step would be visiting. The you I panel.
This is 30 fault, login page for the be framework. So
let's login with the credentials.
So this is the administration page, the caca would be
using in order to monitor the different victims. Correct?
Two different layers that are available to
offend browsers. Would be the list of victims to
sir have already been compromised and not currently
online. And the second list which we are
actually interested is the online browsers.
This is the list of victims were, actually online. Visiting
this vulnerable page.
So, let's just click on this.
Once we click on this we see a list of browser
extensions and capabilities that is script as
fetched from the endpoint.
So, one of the tab that were interested
is known as a Command Staff.
Just like like any other major Frameworks such as Metasploit. This
beef framework also comes with a
ton of inbuilt malicious scripts and those have
been categorized under different scenarios. So
these particular modules can be used based
on the different type of payloads that we want to execute. It
could be based on the vulnerability of the browser or any
other whose basic Sports as well.
What? Simplicity, let's take a simple example of social engineering?
I'll go ahead and just click on Google fishing.
So this particular payload will
actually push a fake Google, login
screen.
And once the browser executes that the victim
will go ahead and fill in
the username credentials, expecting it to be achievement login page.
And that particular content would actually be stored in
the be framework.
It's one of the parameter that we look at is the who
you are. I so this would be the return you, alright or
the URL that we want the browser to
send back once the victim sensor credentials.
So I'll just go ahead and give a demo website.
And once I click on execute, we
can see that this particular page automatically
refreshed and gave a fake Google phishing
page.
So, in a typical social nearing, we expect the victims to
type in the credentials.
Once I click on sign-in, this particular page would
redirect.
So, let's go ahead and look at the locks.
So, as we see, we are able to see what are the characters that
we use a type based on the inbuilt keylogger.
So the user name is Ping test and
the password is test at that one, two, three. So
this is a simple scenario where a fishing exercise
can be used and the browser can be compromised. Now
just to reiterate the scenario where the
attacker is trying to send the malicious URL.
That s already been compromised.
Using beef or any other malicious script. And
obviously, based on the
compromise or the axis, the
attacker can gain full or partial access to the browser.
And hoping a scenario where the user again goes
ahead and sends out any sensitive content on
the malicious website. The user can access it.
That's it for this video. Thank you.