Hello everyone and welcome back to part 16 of my learned ethical hacking course.
In this part we're going to look at the basic commands that we can use with beef.
So those are the commands we've got of victim machine or a zombie still connected to our Web site which
has the hook on a just still hooked.
It's an online browser and we can actually do some commands.
So there's a few basic ones those if you go to browser and then hook to domain we can create an alert
box so haha pockets of civic cringe you.
There we go.
We execute the.
And it sends the execute.
And if you go back it says this site saves hahaha.
Hacked press.
Okay.
That's a simple a layer box you can do.
Create a prompt dialog box.
Attention please.
Check this out.
Think executes.
It sends the command to go back and it does need some input from your piece.
Check this out.
So for example you could say please enter your password or something.
So that's quite useful.
It's very similar to the credentials which we're going to look right in the next video
redirect browser so we can redirect them to a saint Web site.
So if we type in each TGP and then Google will just send them to Google.
Got a Google dot com speech today.
So was executed it can go back and it sends them to Google sorry you didn't see it redirect brash I
can see it's come from straight from that hoped browser to Google that's a simple redirect.
We can deface the Web site so overwrite a particular component of the whole page.
So you have to use a query selector and let's just execute and see if this actually works.
But I don't think we have we don't have a we don't have a had a target inside this Web site so they
hit a small patch that's not going to actually do anything useful to know though it can replace content
so let's click execute and see what this does.
It sends the command.
We go back to the victim and it says beef.
So at least she actually does deface the Web site that they run.
So you could change this and say hacked by an annual whatever your name or alias go back to the Web
site and you can change the contents.
What else is on your web cam.
Play Sound.
I'm going to show you that the web cam don't have a Web cam connected so I can't actually show that
working detect pop up blocker so detects it if it's enabled so let's execute check the results.
It's not actually.
Oh there we go pop up blocker enabled equals false spider.
I say let's execute spider.
And see what they're viewing right now click.
Command three executed
sometimes it's just where concerns I'm just dozens.
As you can see.
Come on to.
And that was that was when I was testing it before but you got a screenshot of what they're looking
at on the Web site.
If you click re execute command I think it may work.
So we execute command three which is the latest one.
Let's have a look at the results.
It's still not loaded.
I don't recommend using spider eye.
The main reason for this beef is because you can send you if you spoof everything can you speak for
DNS.
You can send them to this for them to download your payload it's a very good way of socially engineering
people to download the payload.
So not I wouldn't recommend using everything.
Excuse me.
That's in beef.
There's just a few good ones.
So I recommend the prompt dialog box read in the redirect.
And also while Web cam can be useful play sound it's just more of like a troll type thing.
You can close out the that and then social engineering gets the most important because there's a load
of useful ones here.
So pretty theft we have showed you that it didn't go to much detail but I'll show it.
I'm going to show or make a different video for this so I've showed you the fake notification KP This
is a good one.
So basically it's very similar to the fake notification bar except it says your browser appears to be
able to data and execute this go back.
You can see it up here down here.
So your browser appears to be able to date would you like to upgrade it.
No the reason it's shown or put like that it looks a bit stupid is because we haven't actually added
any images so clearly image directory and we haven't put the payload into the executable direct download
just useful stuff so now we can detect tor using Tor miscellaneous google search so we can search google
with a query without them actually being on Google.
That's meta split.
I've showed you some of them let's have a look here.
Detect Google desktop so you can detect bit different.
I don't really know what the point of that is.
Got an internal eyepiece.
So that's a few of the basic commands.
If you need any help with beef then just leave a comment and I'll be happy to help but I'm going to
make a video shortly on a hacking demonstration.
I know she asked in that video will be the main purpose of beef essentially or is is either still stealing
and using pretty theft and stealing the password and information for Facebook and also the fake notification
bars for them to download your payload so that was it for this video if it did.
How pleasing like comments is to her with anything.
I'll be happy to help and I will see you in the next video.