So far we saw a number of things that we can do once we become the man in the middle.
So we saw how we can see anything.
Target computer does on the network.
So we were able to see the Web sites the usernames the passwords the images anything they load on their
browser.
We also saw that since we're the man in the middle we're able to redirect them to other Web sites.
So whenever they request a domain we can redirect them to somewhere else by doing a DNS spoofing attack.
Another really cool thing that we can do is modify the hasty e-mail modify the pages as they load on
the target browser.
Obviously this is all possible because we are the man in the middle because we're able to intercept
all this data so we can wait for the hasty e-mail code which is the code that's responsible for loading
web pages.
And as it flows through our computer we can insert any piece of code that we want on the browser will
execute this code.
Now hasty e-mail is only responsible for rendering the elements that you see on the web page.
So it's responsible for the buttons for the forums for the text.
It doesn't really allow us to do much but modern browsers can execute javascript code javascript is
a powerful program in language that we can use to do so many things we can actually modify the whole
page remove elements or add elements into the page we can replace links.
And this is actually what I did when I modified the HST s plugin so I added code that would replace
the TTP s with TTP and I also added code that would replace the actual link the actual domain name with
this poof domain name with the one with the DOT corn or whatever you set it to in the script.
You can even use it to hook the browser to other Browser Exploitation frameworks which we can use to
further exploit the target and even gain full control over their computer.
And we'll see that later on in the course but for now I'm going to show you how to inject a very simple
javascript code into the loaded pages and then we'll build up on that in future lectures and see how
powerful and useful this can be.
So right here I have my Kelly machine.
And before I run buttercup and show you how to inject javascript first of all we need to have some javascript
code to inject into the target browser.
So I'm going to open a text editor and I'm going to write a very very simple javascript code like I
said we will see how we can use this to run more useful code.
But for now we're keeping this simple just to see how we can actually run javascript code.
So all I'm going to do is alert open up bracket quotation mark and I'm going to say javascript test
I'm going to close the quotation mark and close the bracket and add a semicolon.
So right here this code all it's going to do is it's going to display a warning message an alert message
saying javascript code.
So since we're going to try to inject this code into all pages every time we load a web page we should
see a message saying javascript test.
Now I'm going to save this.
So I'm gonna go to file save and I'm going to put this in my root directory and I'm just going to call
it alert dot J S I'm going to hit enter and that is saved.
Now in my root so if I quit it we can see we have the file right here so this is the file that contains
the code that we want to inject into any web page that loads on the target computer.
The next step is to go to our H S T S hijack plugin.
So as I showed you before this was in user share Buttercup couplets H HST yes hijack.
Make sure you use the one that I included in the resources not the one that comes built in with better
cup because the built in one will not work as you wanted.
So in here we have the H S T S hijack dot cap file.
This is the configuration file for the whole plugin.
So I'm going to right click this and open it with my text editor and in here what we want to modify
is the payloads right here.
So as you can see in here it's already injecting a javascript file called key logger dodgy yes.
But we also want to inject our own code.
So I'm going to add a comma here and I'm going to add star followed by a column.
We added this tile right here to say that I want to inject my script into any page that the target loads
if you want to inject your code into specific domains.
Then you can remove the star and just lists the domains that you want to inject this code in right here.
But like I said we want to inject this into all pages.
So I'm going to put this as a star.
And after the call on I'm going to put the location of the javascript file that I want to inject into
the browser.
So if we look back in here this is the file that we just created which is in root in my home.
And it's called a letter G S so I'm going to put in here I'm just going to say forward slash root followed
by alert that J S and that's it.
I'm gonna save this control s and quit it control Q And we are ready to go.
So I'm gonna go to my terminal.
I'm gonna run Buttercup using the exact same command that we've been using so we're just giving it the
interface as 88 0 and we're giving it our spook file to automatically run the ERP spoofing attack putting
us in the middle of the connection and as you can see this is working with no ers so everything is perfect.
Well I also want to do right now is run my s t s hijack plugin and as you know all we have to do is
just type H S and tab this will auto complete I'm gonna hit enter and everything is running with no
errors at all.
So everything is perfect.
And as you can see in here it saying that the payloads it's loading the javascript payloads are the
key logger.
This is the default one that the file already was loading and the one that we just specified which is
in route alerts DOJ s.
So now anytime our target loads any web page the whatever code we put in the alert the G S should be
injected in the load this page and it should get executed the result of that should show us a simple
message saying test javascript.
So let's go to the target.
And as usual a good idea is just to remove the browsing data just to make sure that nothing is cached.
And I always like to first test with the simplest case and then move on to more complex scenarios.
So first of all I'm going to test it against a normal hash TTP page so that there is nothing to bypass
no encryption whatsoever.
So we're just going to go to worldwide dot com and perfect as you can see we have an alert message in
here telling us javascript test.
So basically this means the javascript code in my alert or G as file got injected into this page so
now that we verified it works against normal hash TTP pages.
Let's go ahead and tested against a page that uses hash TTP as such as stack overflow dot com.
Perfect.
It's working as expected.
Another example would be linked in dot com keep in mind these Web sites use hash TTP as and as you can
see we're able to load them with no hash TTP s in here so over hash TTP only.
So even if you log in right here you'll be able to get the user name and the password as shown before
finally let's go and tested against h s t s website using the partial HST s bypass method that I showed
you.
So for that to work we'll need to go to Google first of all and we need to go to a Google domain that
does not use h s t s similar to Google that I eat.
This is actually the local Google Web site for Ireland.
And as you can see the code works.
This is fine.
Google on uses hasty CPS anyway.
But let's look for Facebook.
Now we know Facebook uses heat as T S and because s t s is used.
We should not be able to inject anything on the Web site because the browser will only loaded over a
hasty G.P.S. but using our partial bypass method.
If I click on Facebook from here as you can see the code gets executed because what we're loading right
now is Facebook dot corn not Facebook dot com and as you can see we get a normal Facebook page again
that looks identical.
And if you log in you'll be able to get the user name and the password so Isaac can see.
This will work against ETP on page 2 TPM speeches and even hitch as t as if the target searches for
that Web site.
Not if they put the domain name in here.
So if the target comes in and literally types Facebook dot com manually and hit enter the browser will
force the haste to G.P.S. connection.
As you can see in here because like I said it has a preloaded list of Web sites that it can only load
overhead TTP s and because the browser is established in a hasty CPS connection the data will be encrypted
and therefore we won't be able to inject anything in it.