Now I want to show you an example of this story because in my opinion this story is much more dangerous
in this case.
The reason being is you don't have to send anything.
The code will actually be executed in the page.
Now these are just old codes that have injected the code will be execute will be stored in this page
so that every person that just visits this page you don't have to actually send anything to any person.
Whenever someone visits this page the code will be executed.
Another thing is that you won't have this suspicious code in the or out.
So again you can you can just go ahead and send this year if you really want it to someone to visit
it.
But the or else is just going to look as normal you are.
And keep in mind if you find this vulnerability and a famous website or a trusted website then people
will visit it without even thinking twice about it so they'll just click on it no problem at all.
So we're going to inject it again the same way that we were injecting in our video about the store.
So I'm just going to set the name to be if and then we're going to put our code in here so we're going
to put our exploits in here.
I'm just going to copy it again from here.
This field actually doesn't let you write more than 10 characters I think and or 100.
So we're just going to right click and inspect element and we get to set the max length to 500 like
so.
And that will allow us to write more characters.
So just go back and paste it in here.
And we're ready to go I'm going to sign the guest book
OK and that should be running.
So now you can just go ahead and send this your L instead of the suspicious one that we were seeing
in like this case.
So you can literally just send us your e-mail to anybody that you want your code to run on their computer.
And once they click it you'll get them hooked to beef or you can just wait for people to visit that
you are normally as if there wasn't that Web site or whatever.
Once they click on that to you or else they'll be hooked to your beef and again like I said before if
the website is famous if the website has a lot of visitors they will be clicking on that.
Another plus is the web admin probably going to be visiting his Web site's web pages every now and then.
So again you'll get you'll get him hooked and you'll be able to hack him.
And then maybe gain full access to the server or the Web site through this access.
So I'm going to go to my Windows machine and go run my browser
and I'm going to go to the DVD.
And I'm just going to pretend I'm a normal user so and we're going to go to DPW.
Logon.
So I'm just going to go on the security and I'm going to set it too low because on high end nothing's
going to work.
And not this now I'm going to just click on the access start so I'm just pretending to be a normal person
browsing through web pages.
And I'm going to just come across a web page that is vulnerable to start says I could be the web admin
as well just clicking on my own page and you can see these are just the all the exploits the all the.
And now this browser should be hooked without even clicking on anything suspicious again you can see
this is normal.
They didn't really receive anything or anybody asking them to click on anything.
But if we go to our beef here you'll see that we have a Windows machine.
So this is my Linux machine and you can see that we have a Windows machine here not the Windows icon
we can see the IP address of the Windows machine.
And this machine is hooked now so if we click on it it's online and we can run all the commands that
allows us to do.