Now, the Web page that we made so far is not very good because it still asks the user to change their
username and password and the user still picks what username and password they want to use.
So now we're going to modify our code one more time.
And with this time, we're actually going to make everything invisible and we're going to make this
code to be submitted automatically once the user browse the page.
So the first thing to make everything hidden, we're going to convert all the inputs and we're going
to add to them type equals hidden.
So you can see we have an input here.
And I'm going to add an argument saying type equals hidden.
I'm also going to add to this input right here, which is the input that confirms the password.
So we're going to set that to then as well.
And we're going to change the last input which submits the code, as you can see here, it's called
change.
We're going to change that to hidden as well so the user won't see this input either.
This is the submit button.
And I'm going to remove everything written on the page so you can see that in here, it says confirmed
password.
So I'm going to remove that.
And we can see that in here, it's also asks for the new password, so I'm going to remove this part
as well.
And I'm going to remove this tag.
And now I have my three inputs and I have my form, so I only have the important parts of the code.
So we have our first input and it's set to hit and this is the first input that the user puts the password
in and we have the second input right here, which is the confirmed password, and then we have the
submit button.
Now we're going to remove the tapes from here, from the input from the password input's.
And instead of that, we're going to add a value, so we're actually going to set the value for the
new password.
And this time we're going to sell it to six sixes.
So one, two, three, one, two, three.
And I'm going to do the same with the confirm with the confirmed password input.
So we're going to set its value to six six six six six six because we've already changed the type to
hidden.
And I misspelled type in here.
So I'm going to save this and I'll just open this in my browser just to see what this website looks
like now.
Now, as you can see, the page is actually empty, but if we view the source, you'll see that we still
have our firm's.
So you can see I'm just going to zoom on this.
You can see that still submit submitting the form to the right place.
It has the input which is set to hidden and then it has the new password.
The value is set to six sixes.
We also have the confirmed password.
It's also said to hidden and the value six sixes.
And we have our input, the one that changes everything.
And this one is set to hit then as well.
So all of this good.
Now, the last thing we want to do is we want this to be executed automatically when the user clicks
the file.
So we don't want the user to hit anything.
We even made our input, the submit button.
We made it hidden.
So we want the user as soon as they are on this file, they get redirected to the page that will change
their password.
To do that, we're going to need to use a JavaScript code that will automatically submit this form,
so once the page loads, it will automatically submit this form.
So the first thing we need to do, we're going to need to set an ID for this form so that JavaScript
can identify this form.
So I'm going to give it an idea and I'm going to set that to, let's say, for one.
And I'm going to place the JavaScript code in here, and to do that, we're going to need to put it
between two JavaScript tags.
So we're going to start with the script and we need to close that tag as well.
So it's a slide script.
Then we're going to do a document to access the current document.
Don't get element by ID, so we can access the form that we just created and we called it for one.
Then we're going to place the idea that we just created and we called it for one right here, so we're
going to change that to here so we can say for one.
So the code so far will access the current document and it's going to look for an element that has the
idea of number one, then we're going to tell it what we want to do with that element, with that form,
and we're going to want it to submit.
So we're going to say DOT submit.
So the code is very simple, we just added an I.D. to the current form, we called it form one and then
we added a JavaScript code, starting with a script and ending with a forward slash script.
And we said the document and we want you to get the element by ID.
We want you to get form one and we want you to submit it.
Now, once the user double clicks this file, the file will be executed automatically without the user
having to do anything.
So let's see this in action, I'm going to come now, I'm going to close this.
And I'm going to close this one as well.
And I'm just going to double click my new file right here.
And as you can see, automatically I got a new page and this page is telling me that the passwords have
been changed so the user didn't click anything, the user didn't put any password, and the page was
executed from a place that's not on the same Web server.
So it was executed from the local machine.
But still, it submitted the information, the website accepted the information, and the website changed
my password to the new password.
So my password, now the admin password have been changed to six six six six six six.
So if I log out.
And try to log in, I'm going to put my username as admin and the password to six six six six six six
hit enter and you'll see that I logged in with the new password instead of my original password.
Now it's all up to you and how smart you are with with tricking the targets, with how to get them to
run your file.
So now it's all down to social engineering, how you're going to send it, what you're going to pretend
that the file is going to be one way is to send the file as it is as HTML.
The other way is just to host the file on a hasty e-mail web hosting so you can upload it to any Web
hosting.
There's a lot of free ones and then you can just send the URL of the file instead of even getting the
target person to download the file, which will be much less suspicious.