Welcome to this lecture in this lecture we're going to talk about interesting exploitation tool entities
beef free smoke.
It is also known as the Browser Exploitation framework so you can see that we have this little icon
over here and this is saying that it is a beef we accesses framework and you should have guessed that
it has something to do with the java script.
So basically how do we do is we have this javascript hook JavaScript file that will hook the client
browser to our browser which is clearly next a browser.
So this is a very important and exciting tool.
So let's start.
So first of all let me just press here.
That is the icon and it will give you the terminal and after you load that terminal it is going to just
bring us one basically all interface in the browser.
So in my case it is showing the authentication over here.
And I have to give the user name and password so the user name is a beef and the password is also beef.
So type that first which is user name and password.
So when I just log in it is going to give us this interface.
In your case there won't be any online browser and there won't be any offline browser too.
But in my case I have this online browser that is hooked to the scholarly Linux.
I saw you in this in the next to lecture how to just hook the browsers from the different matter to
our colleague Linux.
So there is a mainly three ways but we are going to talk about one ways in this Alexa.
So first way is to just to hook from the web browser.
So basically what happens is if users go back to the terminal and here is a hockey script.
So what we are going to do is basically will just inject this hook a script in our terminal and basically
in our webpage so that anyone who will just visit that web is will be hooked to our D so web browser.
So this is the one way and the second way is through the ATP poisoning which is obviously the man in
the middle attack will discover that in the next lecture.
But for now you can see the one method is to this graph.
This is script and we'll just make changes because this is the local IP so we have to this at our college
next IP over here and thus we have to inject this code on our servers so that anyone who visits that
web is will be hooked to our browser.
So this is the one way to do so let's see how we can this pour from this.
So first of all what you need to do is you have to go to your web server.
So in my case it is in Nevada WW and estimate.
So go to this location.
And after that I'll just open the terminal over here.
I want to just open this index dot estimable which is our guest email file and this is my estimate file.
You can see away here.
And if you see it has only the one heading which is saying welcome to hacker worlds.
So here what I want to do is I want to just copy this script which is responsible to inject the hook
to our browser weapons and let's copy this first.
So in order to copy you can simply copy from here.
And after this center I'll just pasted down here so you could see this is our IP or basically this is
the local host.
So we have two things from this local host to this Kali Muhsin IP.
So let's go over here and let me type I have config to get this double n0 interface.
And here I want to just copy this which is basically the IP address of this guy limousine.
So go by here and you have to change the IP now.
So I'll just say that now IP is 1 9 2 1 6 8 dot one dot eleven.
So this is the IP address of the limousine.
You can clearly see over here.
You can also use this interface of the ITU 0 which is this IP address.
And now our webpage is ready so in order to save this press control or in this heat into and control
links to exit.
So now we have save our index file with the Google script.
So anyone who visits this space will get hooked to this web browser now.
So let's see how we can this hook now.
So let me go to the Clinton machine.
First of all it makes you that web server is running in the color Linux.
So in order to do that you have to first type service and a party to start.
So this the command to start your party server.
And in my case I really started.
So I won't do this.
So let's go in the Windows machine and let's type the IP address of that limousine which has the hoagie
script.
So this is the IP address which is 1 92 168 One eleven.
And you could see this has only this headings saying welcome to heckle what if you go back to this galley
missing then you'll see that in this browser you could see now there will be one online browser which
is the same as in having the IP so if I just go back to this window machine and let me just saw here
that is IP config.
Then you go see the IP address is not showing here because this has this Internet adapter connected
to this machine.
So let me show you the IP address I have can fake.
Okay.
What am I typing.
I can fake IP config note I have config IP config and you could see the IP address of dismissing is
the same which we have this hooked here.
So let's go back to our Kelly missing and see this browser.
So in order to interact with this browser you have to simply press on this IP address and now it will
just give you information about that.
So you can see what is the browser version and everything.
So in your case you will see that the hostname operating system it is running and the CPO and everything
the information that you need to just ignore information about that browser because it is only the exploitation
tool for the browser.
But we can just make some payload that can be exact from this hook so that we have the whole access
to that client computer.
So next thing what I want you to do is go to this command section right next to that of log and these
are all the list of command that you can execute.
Now on that Windows machine.
So basically it is on the windows machine and it is for the browser.
So this will only be executed on the browser because this beef is a browser exploitation framework.
So let's see what the browser exploitation tool over here.
So you could see that is webcam can also be opened and you can see everything over here.
So one interesting thing I can do here is let's redirect now so let's source for this redirect and press
into
then you could see that we have this information of saying that redirect browser are basically all of
this information.
And I have told you before that go through this get it started manual.
And this has shown some of the lights over here saying that this information or this command has some
more top operates and basically if you see this green then this command is likely to work against the
target and it is having a high probability then these three.
And if you see this audience one this has more probability than of these two white one and this red
one has less chance of working against the target in our case it is window dressing.
So less going into the browser and the list could come on again.
And let's now use this redirect which is one command so you could see we have this redirect Bozell express
this.
And now you can just see that grid Eric you are a lawyer here.
So this makes sure that when the spots here maybe Facebook dot com so listen Facebook dot com and now
this will be executed on the window.
If I just press here and they execute so you could say the right hand side corner you have this execute
button.
So let me just suppress that execute.
Now let's go back to our window machine then the new see now Facebook has been this Facebook page has
been rendered.
So this is the one way that basically you can just hook.
That is creepy.
Now on these web page and anyone who visit this Web page will be hooked in your browser.
So this is the one way which we normally do and the next way is very important.
We'll be covering that in the next lecture which is done by the air peaceful thing which we normally
call it a man in the middle attack.
So that would be interesting LEXA.
But for now let's try some of these attacks.
So let's go back and let's see what we can do.
So you can see here that we have this persistence.
Let's go for the social engineering let's source for this pretaped attack.
This is my favorite one because this is going to source the information that the Facebook or any pages
are you can go here and see any of these LinkedIn windows you two and yammer and Iowa's citizen has
been out so it will just prompt you a pair of axing that you need to enter.
That is our user name and password because this and heads out.
And in order to connect you have to this give the user name and password.
So let's executed and this so hard.
I'm talking about.
So let's execute here.
Let's go back to the window machine and this was so these were the same information I was talking about.
So you can now enter that is your name over here and let me see the password will be in there to be
negative in it.
Let's log in and let's go back to our colleague next missing.
You could see command 1 and 2 Over here.
So I'll just say come on two and you could see this was the answer which was username and password right
here.
So you could get any information from this putative if you want maybe of the LinkedIn let's execute
it and let's go back to our window missing and it has shown that the season has time now due to inactivity
and something like that.
You can type e-mail you can type your password list signing again and you just get that information
right in here.
So this was you information about the user name and a password so you could clearly see we can now have
control access to this line the browser.
You can also give maybe some of the updated information that maybe these flash update information less
executed.
So here you have this option of costume payload so you can just inject your payload over here and this
will run on the browser.
So let's go over here and let's see.
And it is not giving any information because it has this custom created this object masses so you can
just make your own over here.
And so that message to the user so you can do that and you can also see the Google facing and everything.
So this is one type in order to just hook your browser to the client Rojas.
So in the next lecture will also hook decline to this machine.
But in the next two way of men in the middle.
So let's get into the next lecture.