Instructor: In the previous video,
I showed you how to hook a target to BeEF
using a basic hook method, using a HTML page.
In this lecture, I want to show you a better way
of doing this if you are able to intercept connections.
So as I showed you in the network hacking section,
we can inject JavaScript code in the target browser
if we are able to become the man in the middle.
And since BeEF uses JavaScript code to hook targets,
we can actually use the exact same method we learned earlier
to inject BeEFs hook code in every website,
the target loads, this will allow us to hook targets
and keep them hooked
without directly communicating with them.
So I have BeEF already running in here.
And like I said, in order to hook targets,
we're gonna have to inject BeEF's JavaScript code
into the browser that they load.
So to do this, I've included custom JavaScript code
in the resources of this lecture.
So first of all, download it from there,
I already have it downloaded here.
And before using this,
I'm gonna double click it to modify it.
So as you can see, it's actually very, very simple code,
it's gonna create a new element in every page,
which will load BeEFs code,
and it'll append this element to the head of the page.
So the only thing you need to modify right here is your IP,
and you want to replace that with the IP of the Kali machine
that is running BeEF.
As you know, you can do if config to get your IP,
I already know what my IP is.
So I'm gonna put it here 10, 20, 14, 207.
So I'm gonna save this Ctrl S and quit Ctrl Q.
Now our JavaScript code is ready.
And all we have to do is literally injected exactly
as I showed you before,
when we injected the simple alert JavaScript code.
So all we have to do right now is put the location
of this file in the HSTS hijack caplet.
I'm going through this quickly,
because I spent a full lecture showing how to use this.
So if you don't remember how JavaScript injection works,
please go back and revise that lecture.
So I'm gonna go to the location
where I have the HSTS hijack caplet.
This is the modified one, the one that I included
in the resources of that lecture,
not the one that comes with bettercap,
because as I mentioned, the one that comes with bettercap
does not work as we wanted.
So what I want to do right now
is modify the hstshijack.cap file.
As you know, if we want to inject a custom JavaScript code,
we have to modify the payload in here.
And as you can see, it's already injecting JavaScript code
called keylogger.js.
So we want to add our custom JavaScript code.
So I'm gonna add a comma, followed by the location
of the file that I want to inject,
which as you know, I have my file in downloads in here
and it's called injectbeef.js.
So first of all, I'm actually gonna add a star colon
to say that I want to inject this file into every page,
the target loads, and then I'm gonna put the full path
to my JavaScript file, which is, as I showed you,
in root, downloads, injectbeef.js.
It's as simple as that.
I'm gonna save it Ctrl S and quit Ctrl Q.
And perfect, so that's done.
And all we need to do right now is run bettercap
to inject this file into every website the target loads,
so we're gonna run better cap using the exact same command
that we used to use before,
we're setting the interface to the interface
that's connected to the target network.
And I'm giving it a caplet to load and the caplet
that I want to load is this sproof caplet,
because as I showed you earlier,
this caplet will run an AARP spoofing attack,
putting me in the middle of the connection.
And perfect, as you can see the couplet runs with no errors.
So right now, I should be intercepting connections.
And the next thing I want to do is to load
the HSTS hijack applet, so I can bypass HTTPS,
partially bypass HSTS, and inject the JavaScript code
that we just configured,
the code that's in the inject BeEF JavaScript file.
So I'm just gonna type H S and press tab to autocomplete,
hit Enter and everything runs with no errors.
So that's perfect.
Now, I should be intercepting all the data that sent
and received by the target ad because we configured
bettercap to inject the hook code in every page that loads,
we should be able to hook our target to BeEF
as soon as they load any website.
So let's go to the target computer.
And actually always a good idea to test against normal HTTP
pages first against the simplest case,
but I've already tested this before, and I know it works.
So I'm gonna go ahead and test it
against the HTTPS page straight away.
It's also a good idea to remove the browsing data.
But I've already done that.
So I'm just gonna go to stack overflow.com.
As you can see, the page is loading in normal HTTP,
even though it uses HTTPS by default,
that means our HSTS hijack is downgrading HTTPS to HTTP.
And it should have also injected my inject BeEF code.
So let's go to BeEF to confirm
and see if we hooked the target.
And perfect, as you can see, we have a new online browser
showing up in here, which we can communicate with
and run commands on, as I'm gonna show you
in the next lectures.
So now the BeEF hook code will be injected in every website,
the target loads, this will work against HTTP websites,
HTTPs websites and even partially work against HSTS websites
like I showed you before.
If the target goes to the HSTS website,
through a search engine that only uses normal HTTPS.