Instructor: Okay, so now we know 2 2
how to discover XSS vulnerabilities. 3 3
We haven't seen a good way of exploiting it though. 4 4
All we were doing is injecting a very simple code 5 5
that just displays an alert on screen saying 6 6
that this website is vulnerable. 7 7
What I want to do now is I wanna do something more advanced, 8 8
I wanna be able to control the victims 9 9
and do stuff on the targets computers, 10 10
on the people that visit the vulnerable pages 11 11
where we inject our code. 12 12
We're going to use BeEF to do this. 13 13
We had a look on BeEF before, 14 14
and what we're going to do is, 15 15
we're gonna use the BeEF hook URL, 16 16
and we're gonna inject it into the stored XSS page. 17 17
So that everybody who visits that page, 18 18
will be hooked to BeEF, 19 19
and then we'll be able to run all the commands 20 20
that BeEF allows us to, on the target computer. 21 21
So I'm gonna start BeEF here. 22 22
Now, as you can see, logged into the main screen. 23 23
Very simple screen. 24 24
And if we look at the online browsers, 25 25
we have no victims at the moment. 26 26
So in order to hook victims to this framework 27 27
and gain access to the functionality of BeEF, 28 28
you need to inject this particular script 29 29
instead of the alert. 30 30
So remember the way we were injecting an alert script 31 31
into a URL, or into the page, 32 32
we're gonna be injecting a script that does the following, 33 33
so that contains the following. 34 34
So I'm gonna copy this. 35 35
And then I'm gonna go to my vulnerable website. 36 36
Remember this could be a popular website, 37 37
or a website of a company which you're doing a pen test for. 38 38
I'm just gonna make sure the security is set to low. 39 39
And I'm actually gonna use the stored XSS. 40 40
And I'm going to put the name as BeEF, 41 41
and we'll put the comment as the hook 42 42
that we got from the terminal. 43 43
And I'm gonna modify the IP here to my own IP address. 44 44
So instead of just IP, I'm gonna put my IP address, 45 45
which is 10.20.14. 46 46
And now it's not letting me add any more characters, 47 47
because this field is configured in a way 48 48
that it doesn't allow more than this number of characters. 49 49
But we can bypass this very easily by right-clicking, 50 50
and going on Inspect Element. 51 51
And we're gonna modify the max length 52 52
to instead of 50, I'm gonna set it to 500. 53 53
And that's it, now I can add more stuff, 54 54
so I'm gonna close that, and I'm gonna say to 10.20.14.207, 55 55
which is my current IP. 56 56
Now I can get my current IP by doing ifconfig. 57 57
10.20.14.207, just to confirm. 58 58
And I'm gonna Sign Guestbook. 59 59
And that should make it work. 60 60
Now if I go to my target. 61 61
Now, right now you can see 62 62
that I have my Linux computer right here, 63 63
has been hooked as a target. 64 64
Now obviously, this is not my target, 65 65
this is just me, and the hook has been executed 66 66
on my browser. 67 67
So, our target's actually this Windows device, 68 68
or any person who is going to be visiting 69 69
this XSS stored page. 70 70
So because this is a stored XSS just like we explained, 71 71
the code will be executed on any person 72 72
who visits this page. 73 73
Now if we go back, we should see 74 74
the Windows device right here, as you can see. 75 75
And it's showing up in the online browsers, 76 76
so we basically have hooked this device, 77 77
and we can run a large number of functions 78 78
that BeEF allows us to do. 79 79
So I'm gonna click on my target, 80 80
and I'm gonna go on the Commands. 81 81
So, right now, I just wanna run a specific command, 82 82
which is just an alert command like we were doing before, 83 83
just to confirm that everything is working. 84 84
So I'm gonna go on this one, 85 85
which is create an alert dialogue. 86 86
And you can set the text in here, 87 87
so you can put any text you want. 88 88
I'm gonna leave it as BeEF Alert Dialog, 89 89
but I'm just gonna click on Execute. 90 90
So if we go on our tiny computer, 91 91
we can see that the alert dialogue is working. 92 92
Now I just did that to show you 93 93
that everything is working perfectly. 94 94
Now anybody who browses our target website, 95 95
the vulnerable website, will get hooked to BeEF, 96 96
and you can run all the commands that we seen before, 97 97
so all the commands that we seen in the client-side attacks, 98 98
like in Full Access using a fake notification bar. 99 99
You're using the Pretty Theft, getting the screenshot, 100 100
injecting a keylogger. 101 101
You can do all of these attacks on any person 102 102
who visits the vulnerable page, 103 103
because we injected our hook into that page, 104 104
not into the browser, and it's part of the page, 105 105
so every time the page loads by anyone, 106 106
they will be hooked to BeEF.