-: Okay.
So now we know how to discover XSS vulnerabilities.
We haven't seen a good way of exploiting it, though.
All we were doing is injecting a very simple code,
that just displays an alert on screen saying that,
"This website is vulnerable".
What I want to do now is,
I want to do something more advanced.
I want to be able to control the victims,
and do stuff on the target computers,
on the people that visit the vulnerable pages
where we inject our code.
We're going to use Beef to do this.
We haven't looked on Beef before.
And, what we're going to do is,
we're gonna use the Beef hook URL.
And, we're gonna inject it into the stored XSS page.
So that everybody who visits that page,
will be hooked to Beef.
And then, we'll be able to run all the commands
that Beef allows us to on the target computer.
So, I'm gonna start Beef here.
Now, as you can see, logged into the main screen,
very simple screen.
And, if we look at the online browsers,
we have no victims at the moment.
So, in order to hook victims to this framework,
and gain access to the functionality of Beef,
you need to inject this particular script
and set up the alert.
So, remember the way we were injecting
an alert script into the URL?
Or into the page?
We're gonna be injecting a script that does the following.
So, that contains the following.
So, I'm gonna copy this.
And then, I'm gonna go to my vulnerable website.
Remember, this could be a popular website,
or website of a company which you're doing a pen test for.
I'm just gonna make sure the security is set to low.
And, I'm actually gonna use the stored XSS.
And, I'm going to put the name as
Beef.
And, we'll put the comment as the hook
that we got from the terminal.
And, I'm gonna modify the IP here, to my own IP address.
So, instead of just IP I'm gonna put my IP address,
which is "10.
20.
14".
And, now its not letting me add anymore characters.
Because, this field is configured in a way,
that it doesn't allow more than this number of characters.
But, we can bypass this very easily by right-clicking,
and going on inspect element.
And, we're gonna modify the max length.
To, instead of 50, I'm gonna set it to 500.
And, that's it.
Now, I can add more stuff.
So, I'm gonna close that.
And, I'm gonna set it to, "10.20.14.
Two.
O.
seven",
which is my current IP.
Now, I can get my current IP by doing a config.
"10.20.14.two.o.seven".
Just to confirm.
And, I'm gonna sign guestbook.
And, that should make it work.
Now, if I go to my target.
Now, right now,
you can see that I have my Linux computer right here,
has been hooked as a target.
Now, obviously this is not my target, this is just me.
And, its, the hook has been executed on my browser.
So, our target is actually this windows device, or,
any person who is going to be visiting this XSS stored page.
So, because this is a stored XSS, just like we explained,
the code will be executed
on any person who visits this page.
Now, if we go back, we should see the windows device,
right here, as you can see.
And, its showing up in the online browsers.
So, we basically have hooked this device.
And, we can run a large number of functions
that Beef allows us to do.
So, I'm gonna click on my target.
And, I'm gonna go under command.
So, right now, I just want to run a specific command,
which is just an alert command,
like we were doing before.
Just to confirm that everything is working.
So, I'm gonna go on this one,
which is "Create an Alert Dialog".
And, you can set the text in here.
So, you can put any text you want.
I'm gonna leave it as, "Beef Alert Dialog".
I'm just gonna click on execute.
So, if we go on our target computer,
we can see that the alert dialog is working.
Now, I just did that to show you
that everything is working perfectly.
Now, anybody who browses our target website,
the vulnerable website, will get hooked to Beef.
And, you can run all the commands that we seen before.
So, all the commands that we seen
in the client site attacks.
Like, getting full access using a fake notification bar,
using the petty theft, getting the screenshot,
injecting a key logger.
You can do all of these attacks on any person who visits
the vulnerable page.
Because, we injected our hook into that browse.
Into that page, not into the browser.
And, its part of the page, so every time the page loads,
by anyone, they will be get, they will be hooked to Beef.