Hello everyone and welcome back to part 16 of my lean ethical hacking course.
In this part we're going to look at something called the beef hook framework.
This is just another method on how to actually access a computer.
Now this method does not include a payload.
Now you can actually if you think about this and put everything together from this course then there's
many many different ways of using beef.
And the payload together I'm gonna be making a full hacking demo putting everything together in one
video.
It's not going to be in detail.
It's just going to show you how you can actually put everything together.
But importantly watch every part of this course.
So you get an idea then you've just got to say to yourself How could I put this part and this thing
together to sort of make one whole method.
But if you're on Kelly Linux we can actually get started with this b fork framework.
The look on the left and you see this icon it looks like a bolt and same beef you can just click on
it.
Then it's going to open the terminal and start the beef service.
We just gave it a few seconds.
It's going to actually generate the beef service and then it will open the web UI in a few seconds.
Just wait and I'll open the UI.
This is just the user interface and it's the beef authentication.
So for some reason it's opened this twice so I can just close one tab and then it allows for username
password.
Now beef users hates HTML and is required so the the way that you've got to hook people is that they've
got to visit your Web site.
And if we go back to the terminal you can have a look here.
So it says web UI and it uses a user interface.
So this is why it says web UI and this is it.
So there's no command lines there's no commands that you have to type.
It's just all user interface.
So it's very user friendly.
Next is hook and this is the most important part.
Now if you don't know web development then don't worry because I will go through and explain it in brief
detail.
Well essentially this is hitched to Mel.
Now script it.
This is called a script tag.
Now a script tag in each smell anything between two tags will be executed and displayed on the Web site.
Now in this case script tags aren't displayed because it's just JavaScript as you can see here is running
a ust file.
But the script is executed in the background.
And this has got to be placed on a Web site's index page.
Now an index page is essentially just the home page of the Web site.
So if you go to Facebook and the first page you see before you log in that is essentially the index
page because it links every other page inside the directory of the Web site to gather in a room with
back links and links to different pages and navigation bar.
So what we need to do is we need to get our Apache server running and we need to go to the directory
of it.
So like we used for the payloads it's just our server.
So we go to all the locations computer and we go to var w w w h to mail.
And the most important part here is the index to hit small because we need to add this line of code
to our index to our hits.
So if we open this with a no other program we'll open it with leaf pad.
Now you will see something completely different here.
There'll be a long line of different code.
It will be page smell the laughs Some see assessing the.
Don't worry about it just delete everything you see in it.
So just press control if you press control ala highlights everything and then you can just delete it.
So you should have a blank index hit small page.
Now inside here we need to add our hook.
So if we just copy this copy paste it in the first line then what it says I.P. we need to highlight
all of this including the angle brackets delete the and type the IP address of your calling machine.
So it's for me it's 1 9 2 2 1 6 8 1 10 1 2 8.
It's going to use Paul 3000.
And it's the hook jazz.
So every time someone visits this index or hits them on page they will become a zombie and we can actually
execute commands on their computer.
I'm to save this now and we can up some hedge demand to make the website look a bit less suspicious.
So let's just add a each one.
So this each one tag is our heading.
Hey each one is the largest headings so we can say them.
My new blog.
And to actually close off a tag you need a forward slash.
And then each one again you can just copy this and then we'll add a paragraph tag.
So it's the same thing with just p and we'll say Welcome to my new blog.
Please check it out.
There we go.
Close the same.
Close it the same way that we can save this and closing.
So now we've got our innocence aged AML page in quotes oh the search.
There we go.
We've also got our payloads inside of here.
But the most important part we've been folk is the index or his smell.
So now it's all subtle.
We just need to log into beef and to log in.
You just type beef as the user name and beef as the password click log in and it will authenticate then
you can read a little bit about beef in the framework and then the hooked browsers.
Most important part is here.
So all the online browsers and this is the online zombies so everyone who visits this page this index
page will be will actually become a zombie.
Now you can do so many different methods on how you can do this.
It requires a lot of social engineering.
You can clone Web sites you could use DNS spoofing which I'll talk about.
So essentially you don't even need to send them a suspicious link.
You can DNS spoof Facebook dot com for example you send them an email saying please visit this Facebook
dot com it's not working for me.
And then they click on it it will use DNS spoofing and send them to a fake page looks like Facebook
and.
In fact it's got the whole script on it.
I'll also show you sending spoof e-mails.
So if you know someone and you know they friend you could pretend to be their friend and send them an
email.
The e-mail will be exactly the same as their friends or colleagues.
They won't know any difference.
So that's interesting.
You can and the other method is something called Man in the middle that will in hook them and they don't
even have to visit any sort of web site but they've got to be on the same network.
I forgot to mention at the end of the previous video that if you realize now that all these links together
so it's up to you to find out what's the best for you.
So if you like Wi-Fi cracking and you get into someone's Wi-Fi then you can use beef and man in the
middle.
If they are on Facebook it will hook they browser.
And then once you've hooked a browser you could send them a fake update.
They will download this fake update and it could be your payload.
Then you've got Fuller absolute full control.
You could send them a spoof e-mail that includes a link to a new Web site and you say to them visit
this Web sites.
They think it's their friend.
They click on it.
They hooked so many different things.
I will go into more detail once I make more possible for now we'll just go through the basics of beef.
So we've got online browsers here.
So now what we need to do is we need to go to the victim computer.
We'll go to our server 1 9 2 0 1 6 8.
Click enter and it just looks like an innocent shitty web site.
It says my new blog.
Welcome to my new blog.
Please check it out.
So it looks innocent it doesn't look anything suspicious nothing wrong with it.
And now let's say this person walks away from the computer and leaves this open.
So you go back to our Kelly machine if you notice now it says online browsers.
Got any browser.
We click on that.
We can see details about it says preservation or no.
And then it's called browser language.
It's got a platform.
Now this is a little bit shitty.
It's some of the things on it aren't exactly true.
The screen size it's got the screen size the date that's all find the ip address etc. Both the most
important part of beef is commands says come on section and this is we can actually execute commands
execute exploits make fake updates appear for the browser so it will say please update your new name.
This browser there's a new update and critical update which is quite interesting.
This here rider allows you to see HDTV requests and create them accessories allows you to see if the
page at the victims on the zombies on that is vulnerable to access X which is x SS sorry which is cross
site scripting AI packet is basically a terminal for beef so you can just run beef commands here network
will give you an overview of the current network
which you can see right here we'll go back to commands though and we'll have a little look through these.
So if you click browser you can see you can detect certain things you can actually see the web cam with
this beef you can unhook it if you wanted to you can play sound through their computer which is quite
scary yeah.
Like I said You can watch the Web cam you can detect if you've got say in applications you can spider
eyes interesting so we'll have a look at spider eye just really quick.
So you click on Spider eye and as you can see this is description so it says this module takes a picture
of the victim's browser window so you click execute and then if you look at the module results history
click on this one here command results and then the image will appear here.
Now the image may be quite large and it may take quite a while to actually view so we'll go back to
that in a second.
But the image should appear here so if we go down to chrome extensions can have a look at some chrome
extensions you can inject beef again you can take a screenshot
sometimes spot I might not work as you can see there's a traffic light system so if it's red in fact
we could go back to details I think with the homepage if it's red then I don't think it actually works
on their current browser.
Thank you folks.
It depends on what browser because they could be using Google Chrome and spider may work for Google
Chrome but it might not for the.
What's it called Microsoft Edge.
I believe this is or I forgot what this browser is called Internet Explorer that there's a only one
called Edge but I don't use the shit anyway chrome extensions we can overlook there got debug.
I'm not going to go through everything because so many his exploits so this is shellshock cold fusion
as many different experts that can use the most.
In fact I skip to the most important one.
So if we get rid of all them apart from like the web cam Well it's not recommended that you actually
use beef to actually do any of that web cam so if the payload is much better for the well closed out
of a lot no no go to persistence.
So man in the browser that will create a persistence confirmed closed tab and you can create a foreground
eye frame
so it will rewrite all the links on the web page to spawn 100 percent by 100 percent frame with a source
relative to the selected link.
We can create a pop under so another node browser will be added to the hook Bradstreet.
Then this module creates a discrete pop up window onto the beef hook so if you click execute this is
going to be persistent.
Now because if you go back to the Windows machine it's blocked a pop up because this is a local same
for so it doesn't usually allow pop ups.
But if we allow once or allow always and most computers will have a pop up allowed this is just hidden
in the background.
And as you can see it's persistent because it's going to keep running this website and it's going to
be constantly hooked.
Obviously if the peasant notices this then they're probably going to just close it.
That's a method of persistence it's not very reliable a phone gap.
We can detect phone gap that's.
I think from gap some sort of app development application.
You can upload a file
so you can upload any file.
You can start recording audio
social engineering.
This is the most important one.
So close out of and close after persistence.
So here is what's most common.
So pretty fast.
This will ask the user for their username a password using a floating div.
I'll show that in a second you got creepy.
This brings up an image and ask the user to do stuff.
This is a fake flash update.
So this is a fake update for a flash player.
This is the fake notification bar for Google Chrome so I'm not going to go through everything.
If we click on hats just click on the IEEE one because that's what the victims are using.
So let's execute and if we go back to the windows 10 machine it says this Web site wants to on upload
Java from Microsoft it continues on this website it must accept the following security Pop-Up.
Click on that.
And essentially what that would have done that would have downloaded the payload but because we didn't
set anything and the actual payload then it won't download anything
there's a fake notification bar for here.
Now these plug in your Ls essentially just the direct download link to your payload.
I was just wondering why this one doesn't.
Phoenix impatient blossoms.
Let's have a look at Google fishing.
I'm not sure why it doesn't actually give you a direct download for the operators for them to Google
fishing.
So this uses this plugin uses an image tag to x s RF the lock up.
I'm not really familiar with this one.
Let's have a look.
Oh basically it's just a fishing page of Google.
Pretty fast.
It's just a good one.
So I ask the user for the username and password using a floating div.
So we'll have a look at this so we'll use Facebook backing Gray and the custom logo so if we click execute
we'll go back to this browser.
As you can see it says Facebook session timed out your session has turned out due to inactivity please
re-enter your username and password so they could log in.
In fact let's do it.
So we'll tape tests at tests dot com and the password can be test.
Now it's just closed but go back to here click on this.
As you can see unset equals test at test dot com and the password test.
So that's a good social engineering method because if people aren't familiar with you know computers
that you will probably panic and actually log into the place videos and this is a malicious Firefox
extension again simple hijacker hijack links.
Clicks On links to display what you want
top nothing.
Let's have a look at this.
The module redirects to a specific you Allah after the tab has been inactive for a specific amount of
time.
So if the leave the computer and go away then it will redirect to somewhere else there's a few fake
notifications here.
So Firefox extension again I'm just quite confused why this one doesn't actually have a security pop
up to continue must accept it.
I'm not exactly sure they stumble right users collect
to show exactly what the point of that one is.
Let's have a look if we can actually just execute this on the AI because the browsers basically using
different browsers.
But let's see what this does.
I'm actually tested this.
Oh there we go.
It's sort of a Firefox update but it's displayed on the edge of the IEEE Internet Explorer browser.
So that looks totally just so fake.
But like I said people who don't understand computers will probably install a plugin.
So that's a good one to use.
And if you think about it now we could actually pull our payload our payload inside of this and when
they click on install plugin they will download the payload so that was it for this video.
That's just a basic overview.
We'll go into more detail in the next part.
So if this did help please if you like comments if you're stuck with anything I'll we're happy to help.
And we'll see you in the next video.