Now the web page that we've made so far is not very good because it still asks the user to change their
username and password.
And these are still pics what username and password they want to use.
So now we're going to modify our code one more time and when this time we're actually going to make
everything invisible and we're going to make this code to be submitted automatically once the user browse
the page.
So the first thing to make everything hidden we're going to convert all the inputs and we're going to
add to them type equals hidden.
So you can see we have an input here and I'm going to add an argument saying type equals hidden.
I'm also going to add to this and put right here which is the input that confirms the password.
So we're going to set that to hidden as well.
And we're going to change the last input which submits the code as you can see here it's called change.
We're going to change that to hidden as well.
So the user wants this input either.
This is the submit button
and I'm going to remove everything written on the page so you can see that in here it says confirm password
so I'm going to remove that and we can see that in here it's also asks for the new password so I'm going
to remove this part as well.
And I'm going to remove this tag and now I have my three inputs and I have my form so I only have the
important part of the code.
So we have our first input and it's not hidden.
This is the first input that the user puts the password in.
And we have the second input right here which is the Confirm password and then we have the submit button.
Now we're going to remove the types from here from the inputs from the perswaded inputs and instead
of that we're going to add value.
So we're actually going to set the value for the new password and this time we're going to set it to
6 6 so one two three one two three and I'm going to do the same with the confirm with the confirmed
password input.
So we're going to set it's value to 6 6 6 6 6 6 because we've already changed the type to hidden and
I misspelled type in here.
So I'm going to save this and I'll just open this in my browser just to see what this website looks
like now.
Now as you can see the page is actually empty but if we view the source you'll see that we still have
our forms.
So you can see I'm just going to zoom on this you can see that still submit in the form to the right
place.
It has the input which is set to head in and then it has the new password the value is set to 6:6.
We also have the confirmed password.
It's also set to hidden and the value is 6:06 is and we have our input.
The one that changes everything.
And this one is set to hidden as well.
So all this good now the last thing we want to do is we want this to be executed automatically when
the user clicks the file so we don't want the user to hit anything.
We even made our input the submit button we made it hidden.
So we want the user as soon as they were on this file they get redirected to the page that will change
their password to do that.
We're going to you need to use a javascript code that will automatically submit this form.
So once the page loads it will automatically submit this form.
So the first thing we need to do.
We're going to need to set an ID for this format so that Javascript can identify this form.
So I'm going to give it an ID and I'm going to add that to that say for one and I'm going to place the
javascript code in here.
And to do that we're going to need to put it between two javascript tags.
So we're going to start with a script and we need to close that tag as well.
So it's a sliced script
then we're going to do document to access the current document
that get element by ID so we can access the four that we just created.
And we called it for one
then we're going to place the idea that we just created and we called it for one right here.
So we're going to change that here so we can say for one.
So the code so far would access the current document and it's going to look for an element that has
the ID of number one.
Then we're going to tell that what we want to do with that element with that form and we're going to
want it to submit.
So we're going to say that submit.
So the code is very simple we just added an ID to the current form.
We called it form 1 and then we added a javascript code starting with a script and ending with a forward
slash script and we said the document and we want you to get the element by ID.
We want you to get form one and we want you to submit it.
Now once the user clicks this file the file will be executed automatically without the user having to
do anything.
So let's see this in action I'm going to come now I'm going to close this and I'm going to close this
one as well.
And I'm just going to double click my new file right here.
And as you can see automatically I got a new page and this page is telling me that the passwords haven't
changed so the user didn't click anything the user didn't put any password on the page was executed
from a place that's not on the same web server so it was executed from the local machine.
But still it submitted the information.
The website accepted the information and the website changed my password to the new password so my password
now the admin password had been changed to 6 6 6 6 6 6.
So if I log out and try to log in I'm going to put my user name as admin and the password to X X X X
X X and enter and you'll see that I logged in with the new password instead of my original password.
Now it's all up to you and how smart you are with how with tricking the targets with how to get them
to run your file.
So now it's all down to social engineering.
How you're going to send it what you're going to pretend that the file is going to be one way is to
send the file as it is as HDMI out.
The other way is just to host the file on a hasty Al web hosting so you can upload it to and you are
posting.
There's a lot of free ones.
And then you can just send the or all of the file instead of even get the target person to download
the file which will be much less suspicious.