Once he finished the website was the payload inside.
He will start the handler and the handler is just a listener to this computer so if any web any victim
open a website he will receive the connection and you will see a metropolitan station running here.
Now this is the IP that you shouldn't you should send to the server.
Now how can I convince a victim to open or to click on you are.
This is a different subject.
You can use spoofed e-mail.
Like I explained before you can use social media.
You can use it in a different way for doing that.
And even there is some Web site that will change this IP to you.
You are going to see one after this lecture.
So once he's giving you this message that he started as a payload handler I just need to convince the
victim to open so you are in.
So assume that I did that and let's see what will happen.
So we're going to go here and I'm going to choose one of my machine sets one for instance click here
and let's open the browser.
Again this would be a social engineering skills to you know to convince him to click on the link.
So I assume that you already did that and he opened this IP which is the Kelly Linux IP 1 6 3 1 4 3.
Now as I told you earlier this may take one or two attempts.
I mean you know he tries it on different computers and different platform and see on which browser is
working and which browser is not working just to be able to get the idea.
So we can run.
We'll take a few seconds or a minute and let's see what will happen.
Here we go.
This is what I was talking about.
This is a message showing that Java is not running on this Web site and the Web site is running Java.
And he's asking you to click on it.
This is applicable on any operating system.
Now here is the point.
If you are using that on an old operating system like Windows 7 I'm sorry Windows XP or invest our even
seven.
Uh you'll get this message and for regular user you know he can just click on Don and many people is
doing that.
But if you buy a certificate and embed the certificate into your Web site you will not even receive
this message.
And the system will be compromised right away.
So it's a kind of attack that depends on your target.
Do you need to invest money in this attack or not.
So I assume that you know the victim got the message and wrote an ad click on run.
What will happen.
Back on our victim machine on our Kelly Linux machine.
Let's go back to the clinics.
And as you can see amateur protestation has been created and a session has been established with this
victim machine.
It's a reverse session in the sense that the victim has replied back to me.
So even if the victim had the fire.
You know it didn't prevent this attack.
So clicking on enter and let's check type sessions
and as you can see I already have a solution to this victim machine.
Now next lecture muggings I'm going to explain how to use this method preposition because we'll be using
it in many attacks during this course.
So I'm going to show you how to submit a procession which is an amazing tool and
we'll see how you can get everything from the machine including downloading File Uploading file migrate
your process so if not it will not be discovered to do a lot of things using the method.
One last point I want to mention here in this attack that you can do that on different victim on the
same time.
So I can send this link to 100 people and if they open the link I'll get 100 session.
Now there is a very important point to clarify here that
if I can compromise one computer inside the network this would be more than enough to compromise the
full network and we're gonna see how we can from this compromised computer because it was not a patched
computer or maybe it has an old operating system or whatever the reason or maybe the user didn't give
attention to any email and click on the link.
But whatever the reason was and I was able to compromise the system all the remaining computer even
if they were secure I still can compromise them.
So that's confirm that any weak point inside your network represent a risk to the whole network not
just to this machine.
So let's see how to use this method pretty precision.