Hi and welcome back to another episode on How to Hack.
So today we're discussing about the use of cross site scripting to actually plan your own JavaScript.
And once you have the browser exploitation stream running on a legitimate site, what happened is that
whenever a user, a legitimate user, dedicated user goes into the site, what happened is that your
JavaScript will be loaded.
And from there on, you'll be able to do a lot more capabilities in terms of finding out what kind of
client browser it is, redirection, even sending them a executable payload to gain access into the
machine directly.
And this is a key concern, especially in terms of cross scripting, which is continue to be highly
malicious within many of these Web application servers are running across the Internet.
So without further ado, let us get started on today's tutorial.
So over here, your colleagues running and we can go ahead and log in to Linux.
So once you log in to colonics, the first thing you want to do is actually just start a browser exploitation
framework so that you have a place to host the malicious hook, a malicious JavaScript hook, so we
can open up terminal and you can actually go ahead and enter Beef Desh access.
So this will be the browser exploitation framework that will be launching.
And this is the part where we will have the management console to actually look at all the browsers
who has been hooked into the JavaScript.
So once it launches into Firefox or Chrome or whichever is your favorite browser, you can go ahead
and log in to the browser exploitation framework management console.
So once you click log in on the left side, we can see all of the other devices which has been connected.
INTUITY hooked it JavaScript before.
So, for example, if I click onto this particular device and we can see all the pass values and we
can see that it was a Chrome browser, it was a window title.
And where was the your eye that had access into Android phone the IP address?
And we can also click onto Network Tap and in a network tab we can actually see how are we connected
or how is the client device connecting over into the hooked and browser.
So again, this is a very simple way, very easy way for you to visualize how the machine's connected
over.
And of course, we can also look at two two one six six six three six nine.
So, again, this is coming from the Internet.
And again, we can see here that we will hosting a JavaScript onto Loy Yang, Young Balkam.
And of course, this was the browser title and so on.
And we can see the information regarding the server, regarding the client device, and we could gain
clicking onto network.
We can see more information, whole services and so on.
So really, really useful tools.
And of course, we can also click onto Zombi.
So zombies, we can actually see that these were the other domains that we were using and we're connecting
over.
So if you've been following the channel, you can look at the past tutorial that we've been doing and
showcasing many of these key capabilities across over onto the Internet because of a lot of demand.
A lot of comments have come in and say that they want to know how can they do all these hacking over
onto the Internet.
So moving forward, we also have made exploitable to running and we can enter MSF, Etman, MSF, administer
password and interactive config.
So this is the Web application server there would be targeting.
So from here we can see the IP address of one or two one six eight one one five.
And going back into the colonics, we can go into one or two one six eight one one one five.
And of course we can go into mutely day.
And I will reset the database because we've been doing a lot of testing prior to this tutorial so they
can learn as much as possible in a cleaner and easier way possible.
So going into Ops top 10, we can go into cross site scripting and we can go into via input getgo so
we can click at to your block.
So this is a typical tax form that you see all the time and it is tax form.
You can see that you can insert some kind of comments into the tax form.
And a lot of times many of these applications are developed.
Whether you're on mobile or and web, they are always unsanitized, the allowed input to go to fully
without checking what kind of parameters, what kind of script has been inserted into the database,
into the Web application server.
So from here, say, I enter ABC, this would actually allow us to save the blog entry.
And at bottom we can actually see that we have the information and we have the comment of ABC here.
And likewise what happened is the hackers would actually use this chance to inject a script into the
browser so that when after legitimate users access into the website, they will look the script and
once the script is loaded, we will get a hooked it browser.
So, for example, going back in the terminal, we can see what is the script that we can use, for
example, over here.
So we can copy this information and we can paste it right here and we can actually change the IP address
of the.
Attacker machine, which is one or two one six, eight, one, two, three.
So over here we can actually go into terminal and we can enter eye of conflict.
And once we hit enter a conflict, we can see that we got the IP address of one or two, one, six,
eight, one, two, three.
And once we have all this information, we can actually click save block entry and immediately we'll
be able to hijack into many other machines.
So in the meantime, what I'll do is I'll launch Windows 10 to demonstrate how we can be able to hijack
browsers of users coming into the site.
So in this case, we can see the Windows 10 is running a booting up.
So in the meantime, going back into colonics, we can click Sieff block entry.
And what happened is that when you write click and click view page source, we can actually do a control
f one or two one six, eight, nine, one or two three.
And we can see that this group has been loaded successfully.
And this means that we would have to hook the browser and going back into we understand we can actually
look and log in into the user account.
So once you log into the user, so this could be a legitimate user going into a legitimate site.
And what happened is that because you're going to a site and a site actually has a malicious JavaScript
running through another site.
So when I click into Add to your block and I go to this site, I have loaded a JavaScript, too.
So going back into colonics, we can go into the left site.
And this is the part where we're looking at online browsers.
So when we're looking at online browsers, we can here on the left side see that we got a new machine
coming in connect.
It is a Windows is running on Internet Explorer and we can see a lot more information about this particular
device.
And likewise, we can go into network to see how we're serving the JavaScript onto the client device.
And of course, this is the part where we can do hacking into the site and we can go into social engineering
and we can actually use Google phishing.
So Google phishing is a great tool that we can use to actually demonstrate how we can surf a Google
phishing site offering fishing login page.
And once we're in, this will allow us to try to get a username and password of the user account.
So over here we can see that this plugin uses an image detector, x SRF cross site request forgery on
a log alberton so we can go ahead and click execute.
So once to execute it on the right site, you can see the automatically brought into the Google login
page.
So the user enter something like Loy Yang Young G.M. dot com followed by their password.
So right now you don't know what a password is, but when I click sign in, I'll be redirected to the
correct account login page.
So sometimes if you remember how you're surfing the web, you get multiple times of login so the users
may not find it so suspicious.
And Onda going back to colonics, we can go into come in number two and when we expand it we can see
that immediately we've got the username and password directly from here.
So they're saying it with a combination of cross site scripting vulnerability as well as the injection
of a JavaScript hook.
We were able to do a lot of capabilities against a particular browser.
And if you'll be looking at the past few videos, actually, in fact, a lot of this hacking techniques,
tactics can be merged together, mashed together, and you come off a new way of actually attacking
many of these devices and assets.
So I hope you have learned something valuable in today's tutorial and you have any questions.
Feel free to leave a comment below and I'll try my best to answer any of those questions and remember
the light share and subscribe to the channel so that you can be kept abreast of the latest cyber security.
Tiriel.
Thank you so much once again for watching.