OK.
So now we know how to discover access s vulnerabilities.
We haven't seen a good way of exploiting it though.
All we were doing is injecting a very simple code that just displays an alert on screen saying that
this website is vulnerable.
What I want to do now is I want to do something more advanced.
I want to be able to control the victims and do stuff on the target's computers on the people that visit
the vulnerable pages where we inject our code we're going to use beef to do this.
We had a look on beef before and what we're going to do is we're going to use the beef hook your URL
and we're gonna injected into the stored accesses page so that everybody who visits that page will be
hooked to beef and then we'll be able to run all the commands that beef allows us to on the target computer
so I'm gonna start beef here
now.
As you can see logged into the main screen very simple screen and if we look at the online browsers
we have no victims at the moment so in order to hook victims to this framework and gain access to the
functionality of beef you need to inject this particular script instead of the alerts.
Remember the way we were injecting an alert script into the URL or into the page.
We're going to be injecting a script that does the following.
So that contains the following.
So I'm gonna copy this and then I'm gonna go through my vulnerable website remember this could be a
popular Web site or Web site of a company which are doing a pan test for I'm just going to make sure
the security is set to low
and I'm actually going to use this stored excesses
and I'm going to put the name as beef and we'll put the comment as the hook that we got from the terminal.
And I'm going to modify the IP here to my own IP address.
So instead of just IP I'm gonna put my IP address which is 10 2014
and now it's not letting me out any more characters because this field is configured in a way that it
doesn't allow more than this number of characters.
Well we can bypass this very easily by right clicking and going on inspect element and we're going to
modify the max length to instead of 50.
I'm going to set it to 500 and that's it.
Now I can add more stuff so I'm going to close that and I'm going to set it to 10 2014 to 0 7 which
is my current IP and I can get my current IP by doing if config
10 2014 to 0 7 just to confirm and I'm going to sign guestbook and that should make it work.
Now if I go to my target now right now you can see that I have my Linux computer right here has been
hooked as a target.
Now obviously this is not my target.
This is just me and it's the the hope has been executed on my browser.
So our target is actually this Windows device or any person who is going to be visiting this exercise
stored page.
So because this is a third exercise just like we explained the code will be executed on any person who
visits this page.
Now if we go back we should see the Windows device right here.
As you can see and it's shown up in the online browsers.
So we basically have hooked this device and we can run a large number of functions that beef allows
us to do so I'm going to click on my target and I'm gonna go on the commands
so right now I just want to run a specific command which is just an alert command like you were doing
before.
Just to confirm that everything is working so I'm going to go on this one which is create an alert dialog
and you can set the text in here so you can put any text you want.
I'm going to leave it as beef alert dialog.
I'm just going to click on execute
so if we go on our tablet computer we can see that the alert dialog is working now I just did that to
show you that everything is working perfectly.
Now anybody who browses our target Web site the vulnerable Web site will get hooked to beef and you
can run all the commands that we've seen before so all the comments that we've seen and decline side
attacks like getting full access using a fake notification bar using the pretty theft getting the screenshot
injecting a key logger.
You can do all of these attacks on any person who visits the vulnerable page because we injected our
hook into that browser and to that page not into the browser.
And that's part of the page.
So every time the page loads by anyone there will be there will be hooked to beef.