Instructor: Okay, now let's have a look 2 2
on a social engineering plugin 3 3
that'll allow us to steal usernames and passwords 4 4
for accounts. 5 5
So basically the way this works is, it'll dim the screen 6 6
and it'll tell the person that, 7 7
you got logged out of your session, 8 8
so please login to your account again 9 9
so you can get authenticated. 10 10
So this will allow us to bypass HTTPS, HSTS, 11 11
all security that's used by the target account page. 12 12
For example, if you're trying to get username and password 13 13
for Facebook then you'll be able to bypass all the security 14 14
that Facebook uses. Because what you're doing is, 15 15
you're actually just showing a fake Facebook page. 16 16
So the user will never actually get in contact 17 17
with Facebook. 18 18
So let's just click on this. 19 19
And you'll see that you can click form form here, 20 20
you can click what account that you want to hijack. 21 21
So let's say we're going with Facebook 22 22
and you can select what the backlight will be. 23 23
So we're just leaving that as gray 24 24
and we're gonna execute this. 25 25
And when we go to our target 26 26
you'll see that they're being told 27 27
that they go logged out of their session 28 28
so please login with your username and password. 29 29
So I'm gonna put my username as zaid. 30 30
Then I'm gonna put my password as 123456. 31 31
And Enter. 32 32
And if we go back here, 33 33
you'll see we got our username, 34 34
was zaid and the password was 123456. 35 35
So you can use this to hijack a number of accounts. 36 36
For example. Let's just have another example. 37 37
If we go with YouTube... 38 38
Again you give it an execute, come back, 39 39
you see the YouTube logo and you can try to login. 40 40
Put a username, password, sign in and that'll be captured. 41 41
So again, this is a really good way of gaining access 42 42
to accounts. 43 43
Because even if the user is not planning on logging in 44 44
to the account that you're trying to steal 45 45
then you'll kind of force them to enter their username 46 46
and password to be logged back in into their account. 47 47
And then you'll be able to capture the username 48 48
and the password.