WEBVTT - This file was automatically generated by VIMEO 1 00:00:08.200 --> 00:00:11.200 Hello everyone. Welcome back. Let's take a look at the 2 00:00:11.200 --> 00:00:14.500 last attack on, as man, the browser. As 3 00:00:14.500 --> 00:00:17.700 a name suggest that Argo is trying to compromise the 4 00:00:17.700 --> 00:00:21.000 browser. The user is using. Since 5 00:00:20.100 --> 00:00:23.300 it's a client that attack that was selling will 6 00:00:23.300 --> 00:00:26.500 try to exploit vulnerabilities that may be present 7 00:00:26.500 --> 00:00:29.200 on the version or any of the script that 8 00:00:29.200 --> 00:00:29.900 can execute. 9 00:00:30.600 --> 00:00:33.600 Begin full or partial access by doing. So that 10 00:00:33.600 --> 00:00:37.000 hacker is trying to gain control the sensitive information 11 00:00:36.200 --> 00:00:40.300 that's being saved in the browser or 12 00:00:39.800 --> 00:00:42.700 can be used for any fishing 13 00:00:42.700 --> 00:00:45.200 scenarios. Now, let us take a look at 14 00:00:45.200 --> 00:00:48.400 the common attack vectors as to how my interposer 15 00:00:48.400 --> 00:00:49.200 can performed. 16 00:00:50.200 --> 00:00:53.200 The most common scenario would be creating browser 17 00:00:53.200 --> 00:00:54.000 extensions. 18 00:00:55.400 --> 00:00:58.600 Most common major industry browser such 19 00:00:58.600 --> 00:01:02.100 as Chrome Firefox. They have Multiplex 20 00:01:01.100 --> 00:01:04.200 engines available. So that 21 00:01:04.200 --> 00:01:07.800 a cow can create malicious extensions and distribute it 22 00:01:07.800 --> 00:01:10.500 to the users and expect them to install it. 23 00:01:10.300 --> 00:01:13.200 Once extensions are installed. They 24 00:01:13.200 --> 00:01:16.800 would need some privileges from the browser side in 25 00:01:16.800 --> 00:01:19.700 order to gain control. The 26 00:01:19.700 --> 00:01:21.600 second Vector, would be a pi O King. 27 00:01:22.600 --> 00:01:25.300 All browsers would be using OS 28 00:01:25.300 --> 00:01:28.800 based apis in order to interact with acidic protocol and 29 00:01:28.800 --> 00:01:31.800 to render the content and display to the victim. 30 00:01:31.600 --> 00:01:35.100 So that would be scenarios where 31 00:01:34.100 --> 00:01:37.700 the attacker is able to create malicious apis, 32 00:01:37.200 --> 00:01:40.800 that are hooked onto the browser process and 33 00:01:40.800 --> 00:01:41.500 gain access. 34 00:01:43.300 --> 00:01:46.400 And one of the most easiest and common way is 35 00:01:46.400 --> 00:01:49.600 to execute malicious content on the web page itself. 36 00:01:49.300 --> 00:01:52.500 So that using social healing 37 00:01:52.700 --> 00:01:56.000 scenarios in that account distribute selling. And 38 00:01:55.200 --> 00:01:58.500 once the website is a 39 00:01:58.500 --> 00:02:01.200 run on the client side of the victim, the 40 00:02:01.200 --> 00:02:02.600 taco will gain access. 41 00:02:04.100 --> 00:02:05.900 Now, let's jump on to the devil. 42 00:02:07.800 --> 00:02:10.600 For this particular demo, we will be using a tool called 43 00:02:10.700 --> 00:02:13.700 beef is also known as browser exportation 44 00:02:13.700 --> 00:02:17.600 Facebook. This is something that is available 45 00:02:17.600 --> 00:02:20.600 in colleague environment in case. If it 46 00:02:20.600 --> 00:02:23.300 doesn't compare install, it can be downloaded from 47 00:02:23.300 --> 00:02:24.300 the color Repository. 48 00:02:25.800 --> 00:02:28.300 So the first step would be to initiate the 49 00:02:28.300 --> 00:02:29.000 framework. 50 00:02:36.900 --> 00:02:39.200 So once this particular framework is 51 00:02:39.200 --> 00:02:42.300 initiated the two, common URLs 52 00:02:42.300 --> 00:02:45.600 that were interested would be the hook dot JS and 53 00:02:45.600 --> 00:02:47.300 second would be 3y panel. 54 00:02:48.400 --> 00:02:51.100 So Jess is the malicious script that has to 55 00:02:51.100 --> 00:02:54.700 be injected on the vulnerable or malicious website, 56 00:02:54.600 --> 00:02:57.900 and that particular website is 57 00:02:57.900 --> 00:03:00.600 what would be distributed to the victims. And 58 00:03:00.600 --> 00:03:04.200 once they visit the website, particular 59 00:03:03.200 --> 00:03:05.800 browser would be compromised. 60 00:03:08.100 --> 00:03:11.900 So in order to do so, I have op already injected 61 00:03:11.100 --> 00:03:14.600 this particular who plot J is in the demo website. 62 00:03:16.400 --> 00:03:18.900 The Second Step would be visiting. The you I panel. 63 00:03:26.100 --> 00:03:30.300 This is 30 fault, login page for the be framework. So 64 00:03:30.300 --> 00:03:32.100 let's login with the credentials. 65 00:03:40.700 --> 00:03:43.100 So this is the administration page, the caca would be 66 00:03:43.100 --> 00:03:47.500 using in order to monitor the different victims. Correct? 67 00:03:46.500 --> 00:03:49.900 Two different layers that are available to 68 00:03:49.900 --> 00:03:53.400 offend browsers. Would be the list of victims to 69 00:03:53.400 --> 00:03:56.700 sir have already been compromised and not currently 70 00:03:56.700 --> 00:03:59.500 online. And the second list which we are 71 00:03:59.500 --> 00:04:01.400 actually interested is the online browsers. 72 00:04:02.500 --> 00:04:06.200 This is the list of victims were, actually online. Visiting 73 00:04:05.200 --> 00:04:07.400 this vulnerable page. 74 00:04:09.100 --> 00:04:10.200 So, let's just click on this. 75 00:04:12.300 --> 00:04:15.500 Once we click on this we see a list of browser 76 00:04:15.500 --> 00:04:18.500 extensions and capabilities that is script as 77 00:04:18.500 --> 00:04:21.100 fetched from the endpoint. 78 00:04:23.900 --> 00:04:26.400 So, one of the tab that were interested 79 00:04:26.400 --> 00:04:28.100 is known as a Command Staff. 80 00:04:29.100 --> 00:04:33.100 Just like like any other major Frameworks such as Metasploit. This 81 00:04:32.100 --> 00:04:35.200 beef framework also comes with a 82 00:04:35.200 --> 00:04:38.100 ton of inbuilt malicious scripts and those have 83 00:04:38.100 --> 00:04:42.200 been categorized under different scenarios. So 84 00:04:42.200 --> 00:04:45.500 these particular modules can be used based 85 00:04:45.500 --> 00:04:49.200 on the different type of payloads that we want to execute. It 86 00:04:49.200 --> 00:04:52.400 could be based on the vulnerability of the browser or any 87 00:04:52.400 --> 00:04:54.700 other whose basic Sports as well. 88 00:04:55.700 --> 00:04:58.600 What? Simplicity, let's take a simple example of social engineering? 89 00:05:01.100 --> 00:05:03.300 I'll go ahead and just click on Google fishing. 90 00:05:04.800 --> 00:05:07.100 So this particular payload will 91 00:05:07.100 --> 00:05:10.800 actually push a fake Google, login 92 00:05:10.800 --> 00:05:11.300 screen. 93 00:05:12.500 --> 00:05:15.500 And once the browser executes that the victim 94 00:05:15.800 --> 00:05:18.100 will go ahead and fill in 95 00:05:18.100 --> 00:05:21.300 the username credentials, expecting it to be achievement login page. 96 00:05:22.300 --> 00:05:25.600 And that particular content would actually be stored in 97 00:05:25.600 --> 00:05:26.600 the be framework. 98 00:05:27.900 --> 00:05:30.400 It's one of the parameter that we look at is the who 99 00:05:30.500 --> 00:05:33.900 you are. I so this would be the return you, alright or 100 00:05:33.300 --> 00:05:36.800 the URL that we want the browser to 101 00:05:36.800 --> 00:05:39.400 send back once the victim sensor credentials. 102 00:05:42.300 --> 00:05:45.600 So I'll just go ahead and give a demo website. 103 00:05:45.500 --> 00:05:48.800 And once I click on execute, we 104 00:05:48.800 --> 00:05:51.500 can see that this particular page automatically 105 00:05:51.500 --> 00:05:54.600 refreshed and gave a fake Google phishing 106 00:05:54.600 --> 00:05:54.900 page. 107 00:05:57.500 --> 00:06:00.600 So, in a typical social nearing, we expect the victims to 108 00:06:00.600 --> 00:06:01.800 type in the credentials. 109 00:06:08.700 --> 00:06:11.800 Once I click on sign-in, this particular page would 110 00:06:11.800 --> 00:06:12.500 redirect. 111 00:06:13.800 --> 00:06:16.000 So, let's go ahead and look at the locks. 112 00:06:19.100 --> 00:06:23.300 So, as we see, we are able to see what are the characters that 113 00:06:23.300 --> 00:06:26.800 we use a type based on the inbuilt keylogger. 114 00:06:26.200 --> 00:06:29.900 So the user name is Ping test and 115 00:06:29.900 --> 00:06:32.200 the password is test at that one, two, three. So 116 00:06:32.200 --> 00:06:35.700 this is a simple scenario where a fishing exercise 117 00:06:35.700 --> 00:06:40.200 can be used and the browser can be compromised. Now 118 00:06:40.200 --> 00:06:43.500 just to reiterate the scenario where the 119 00:06:43.500 --> 00:06:46.900 attacker is trying to send the malicious URL. 120 00:06:46.100 --> 00:06:48.700 That s already been compromised. 121 00:06:48.900 --> 00:06:52.300 Using beef or any other malicious script. And 122 00:06:51.300 --> 00:06:54.600 obviously, based on the 123 00:06:54.600 --> 00:06:57.400 compromise or the axis, the 124 00:06:57.700 --> 00:07:00.400 attacker can gain full or partial access to the browser. 125 00:07:01.500 --> 00:07:04.300 And hoping a scenario where the user again goes 126 00:07:04.300 --> 00:07:07.700 ahead and sends out any sensitive content on 127 00:07:07.700 --> 00:07:10.500 the malicious website. The user can access it. 128 00:07:11.800 --> 00:07:13.700 That's it for this video. Thank you.