Instructor: So far, we saw a number of things
that we can do once we become the man in the middle.
So we saw how we can see anything target computer does
on the network.
So we were able to see the websites, the usernames,
the passwords, the images, anything they load
on their browser.
We also saw that since we're the man in the middle,
we're able to redirect them to other websites.
So whenever they request a domain,
we can redirect them to somewhere else
by doing a DNS spoofing attack.
Another really cool thing that we can do
is modify the HTML, modify the pages,
as they load on the target browser.
Obviously, this is all possible
because we are the man in the middle,
because we're able to intercept all this data.
So we can wait for the HTML code,
which is the code that's responsible for loading web pages.
And as it flows through our computer,
we can insert any piece of code that we want,
and the browser will execute this code.
Now, HTML is only responsible for rendering the elements
that you see on the web page.
So it's responsible for the buttons,
for the forums, for the text,
it doesn't really allow us to do much.
But modern browsers can execute JavaScript code.
JavaScript is a powerful programming language
that we can use to do so many things,
we can actually modify the whole page,
remove elements or add elements into the page,
we can replace links.
And this is actually what I did when I modified
the HSTS plugin.
So I added code that will replace the HTTPS with HTTP.
And I also added code that will replace the actual link,
the actual domain name with the spoof domain name,
with the one with the dot corn,
or to whatever you set it to in the script.
You can even use it to hook the browser
to other browser exploitation frameworks,
which we can use to further exploit the target
and even gain full control over their computer.
And we'll see that later on in the course.
But for now, I'm gonna show you how to inject a very simple
JavaScript code into the loaded pages.
And then we'll build up on that in future lectures
and see how powerful and useful this can be.
So right here, I have my Kali machine.
And before I run better cap and show you
how to inject JavaScript,
first of all, we need to have some JavaScript code
to inject into the target browser.
So I'm gonna open a text editor.
And I'm gonna write a very, very simple JavaScript code.
Like I said, we will see how we can use this
to run more useful code.
But for now, we're keeping this simple just to see
how we can actually run JavaScript code.
So all I'm gonna do is alert, open a bracket,
quotation mark and I'm gonna say JavaScript test.
I'm gonna close the quotation mark and close the bracket
and add a semicolon.
So right here, this code, all it's gonna do
is it's gonna display a warning message, an alert message
saying JavaScript code.
So since we're gonna try to inject this code into all pages,
every time we load a web page,
we should see a message saying JavaScript test.
Now I'm gonna save this.
So I'm gonna go to File, Save.
And I'm gonna put this in my root directory.
And I'm just gonna call it alert.js,
I'm gonna hit Enter.
And that is saved now in my root, so if I quit it,
we can see we have the file right here.
So this is the file that contains the code
that we want to inject into any web page that loads
on the target computer.
The next step is to go to our HSTS hijack plugin.
So as I showed you before, this was in user, local, share,
bettercap, caplets, HSTS hijack,
make sure you use the one that I included in the resources,
not the one that comes built in with bettercap,
because the built in one will not work as you wanted.
So in here we have the hstshijack.cap file.
This is the configuration file for the whole plugin.
So I'm gonna right click this
and open it with my text editor.
And in here, what we want to modify
is the payloads right here.
So as you can see in here,
it's already injecting a JavaScript file
called keylogger.js, but we also want to inject
our own code.
So I'm gonna add a comma here.
And I'm gonna add star followed by a colon.
We added this star right here to say that I want to inject
my script into any page that the target loads.
If you want to inject your code into specific domains,
then you can remove the star and just list the domains
that you want to inject this code in right here.
But like I said, we want to inject this into all pages.
So I'm gonna put this as a star.
And after the colon, I'm gonna put the location
of the JavaScript file that I want to inject
into the browser.
So if we look back in here,
this is the file that we just created,
which is in root in my home, and it's called alert.js.
So I'm gonna put in here, I'm just gonna say forward slash
root, followed by alert.js.
And that's it.
I'm gonna save this Ctrl S and quit it Ctrl Q,
and we are ready to go.
So I'm gonna go to my terminal, I'm gonna run bettercap
using the exact same command that we've been using.
So we're just giving it the interface as eth0,
and we're giving it our spool file to automatically run ARPX
spoofing attack, putting us in the middle of the connection.
And as you can see, this is working with no errors,
so everything is perfect.
What I also want to do right now is run
my HSTS hijack plugin.
And as you know, all we have to do is just type H S and tab,
this will autocomplete, I'm gonna hit Enter,
and everything is running with no errors at all.
So everything is perfect.
And as you can see in here, it's saying that the payloads,
it's loading the JavaScript payloads are the keylogger.
This is the default one that the file already was loading.
And the one that we just specified,
which is in root alerts.js.
So now anytime our target loads any web page,
the whatever code we put in the alert.js
should be injected in the loaded page,
and it should get executed.
The result of that should show us a simple message
saying test JavaScript.
So let's go to the target.
And as usual, a good idea is just to remove the browsing
data just to make sure that nothing is cached.
And I always like to first test with the simplest case,
and then move on to more complex scenarios.
So first of all, I'm gonna test it against a normal HTTP
page, so that there is nothing to bypass,
no encryption whatsoever.
So we're just gonna go to volnweb.com.
And perfect, as you can see, we have an alert message
in here telling us JavaScript test.
So basically, this means the JavaScript code
in my alert.js file got injected into this page.
So now that we verified it works against normal HTTP pages,
let's go ahead and test it against a page that uses HTTPS
such as stackoverflow.com.
Perfect, it's working as expected.
Another example would be linkedin.com.
Keep in mind, these websites use HTTPS.
And as you can see, we're able to load them with no HTTPS
in here, so over HTTP only.
So even if you log in right here,
you'll be able to get the username
and the password as shown before.
Finally, let's go and tested against HSTS website
using the partial HSTS bypass method that I showed you.
So for that to work, we'll need to go to Google
first of all and we need to go to a Google domain
that does not use HSTS, similar to google.ie.
This is actually the local Google website for Ireland.
And as you can see, the code works.
This is fine.
Google only uses HTTPS anyway.
But let's look for Facebook.
Now we know Facebook uses HSTS.
And because HSTS is used, we should not be able
to inject anything on the website,
because the browser will only load it over HTTPS.
But using our partial bypass method.
If I click on Facebook from here, as you can see,
the code gets executed.
Because what we're loading right now is Facebook.corn,
not facebook.com.
And as you can see, we get a normal Facebook page again,
that looks identical.
And if you log in, you'll be able to get the username
and the password.
So as you can see, this will work against HTTP
and HTTPS pages and even HSTS if the target searches
for that website, not if they put the domain name in here.
So if the target comes in and literally types facebook.com
manually and hit enter, the browser will force the HTTPS
connection as you can see in here, because like I said,
it has a pre loaded list of websites that it can only load
over HTTPS and because the browser is establishing HTTPS
connection, the data will be encrypted,
and therefore we want to be able to inject anything in it.