Instructor: In the previous video 2 2
I showed you how to hook a target to BeEF 3 3
using a basic hook method, 4 4
using a HTML page. 5 5
In this lecture I want to show you 6 6
a better way of doing this. 7 7
If you are able to intercept connections. 8 8
So as I showed you in the network hacking section, 9 9
we can inject JavaScript code in the target browser 10 10
if we are able to become the man in the middle. 11 11
And since BeEF uses JavaScript to code, 12 12
to hook targets, we can actually use 13 13
the exact same method we learned earlier 14 14
to inject BeEF's hooked code 15 15
in every website the target loads. 16 16
This will allow us to hook targets 17 17
and keep them hooked 18 18
without directly communicating with them. 19 19
So I have BeEF already running in here 20 20
and like I said in order to hook targets 21 21
we're gonna have to inject BeEF's JavaScript code 22 22
into the browser that they load. 23 23
So to do this I've included custom JavaScript code 24 24
in the resources of this lecture, 25 25
so first of all download it from there. 26 26
I already have it downloaded here. 27 27
And before using this, 28 28
I'm gonna double click it to modify it. 29 29
So as you can see, it's actually very very simple code. 30 30
It's gonna create a new element in every page, 31 31
which will load BeEF's code 32 32
and it will append this element to the head of the page. 33 33
So the only thing you need to modify right here 34 34
is your IP and you wanna replace that with the IP of the 35 35
carling machine that is running BeEF. 36 36
As you know, you can do IP config to get your IP. 37 37
I already know what my IP is, 38 38
so I'm gonna put it here. 39 39
10. 40 40
20. 41 41
14. 42 42
207 43 43
So I'm gonna save this, Control+S 44 44
and quit it, Control+Q. 45 45
Now our JavaScript code is ready 46 46
and all we have to do is literally inject it 47 47
exactly as I showed you before, 48 48
when we injected the simply alert JavaScript code. 49 49
So all we have to do right now 50 50
is put the location of this file 51 51
in the hstshijack caplet. 52 52
I'm going through this quickly 53 53
because I spent a full lecture showing how to use this. 54 54
So if you don't remember how JavaScript injection works. 55 55
Please go back and revise that lecture. 56 56
So I'm gonna go to location 57 57
where I have the hstshijack caplet. 58 58
Which is as shown before 59 59
in user, share, bettercap, caplets. 60 60
This is the modified one. 61 61
The one that I included in the resources of that lecture. 62 62
Not the one that comes with bettercap. 63 63
Cause as I mentioned, the one that comes with bettercap 64 64
does not work as we want it. 65 65
So what I wanna do right now, 66 66
is modify the hstshijack.cap file 67 67
As you know if we want to inject a custom JavaScript code, 68 68
we have to modify the payload in here 69 69
and as you can see it's already injecting 70 70
a JavaScript code called keylogger.js 71 71
So we want to add our custom JavaScript code. 72 72
So I'm gonna add a comma, 73 73
followed by the location of the file that I want to inject. 74 74
Which as you know, I have my file in downloads. 75 75
In here and it's called inject_beef.js 76 76
So first of all I'm actually gonna add a star+colon 77 77
to say that I want to inject this file 78 78
into every page the target loads 79 79
and then I'm gonna put the full path to my JavaScript file. 80 80
Which is as I showed you, 81 81
in root/Downloads/inject_beef.js 82 82
It's as simple as that. 83 83
I'm gonna save it, Control+S 84 84
and quit, Control+Q 85 85
and perfect, so that's done 86 86
and all we need to right now, 87 87
is run bettercap to inject this file into every website 88 88
the target loads. 89 89
So we're gonna run bettercap using the exact same command 90 90
that we used to use before. 91 91
We're setting the interface to the interface 92 92
that's connected to the target network 93 93
and I'm gonna giving it a caplet to load 94 94
and the caplet that I want to load, 95 95
is this spoof caplet 96 96
because as I showed you earlier, 97 97
this caplet will run in a IP spoofing attack 98 98
putting me in the middle of the connection. 99 99
And perfect. 100 100
As you can see the caplet runs with no errors. 101 101
So right now I should be intercepting connections 102 102
and the next thing I wanna do, 103 103
is to load the hstshijack caplet. 104 104
So I can bypass HTTPS. 105 105
Partially bypass HSTS 106 106
and inject the JavaScript code that we just configured. 107 107
The code that's in the inject_beef JavaScript file. 108 108
So I'm just gonna type hs 109 109
and press Tab to auto complete. 110 110
Hit Enter and everything runs with no errors. 111 111
So that's perfect. 112 112
Now I should be intercepting all the data that's sent 113 113
and received by the target 114 114
and because we configured bettercap to inject the hook code 115 115
in every page that loads. 116 116
We should be able to hook our target to BeEF, 117 117
as soon as they load any website. 118 118
So let's go to the target computer 119 119
and it's actually always a good idea 120 120
to test against normal HTTP pages first. 121 121
Against the simplest case 122 122
but I've already tested this before 123 123
and I know it works, so I'm gonna go ahead 124 124
and test it against a HTTPS page straight away. 125 125
It's also a good idea to remove the browsing data 126 126
but I've already done that. 127 127
So I'm just gonna go to stackoverflow.com 128 128
as you can see the page is loading in normal HTTP, 129 129
even though it uses HTTPS by default. 130 130
That means our hstshijack is downgrading HTTPS to HTTP 131 131
and it should have also injected my inject_beef code. 132 132
So let's go to BeEF to confirm 133 133
and see if we hooked the target. 134 134
And perfect, as you can see we have a new online browser 135 135
showing up in here. 136 136
Which we can communicate with 137 137
and run commands on, 138 138
as I'm gonna show you in the next lectures. 139 139
So now the BeEF hooked code would be injected 140 140
in every website the target loads. 141 141
This will work against HTTP websites, 142 142
HTTPS websites 143 143
and even partially work against HSTS websites, 144 144
like I showed you before. 145 145
If the target goes to HSTS website 146 146
to a search engine that only uses normal HTTPS.