And the previous lecture we've seen how to create a web page that exploits s.c.s our vulnerability doesn't
automatically submit a form and we seen how we can exploited to get the target person to change their
password without them even knowing.
So as soon as they Doubleclick the file this form will be automatically submitted.
Changing the password to the password that we want.
One problem with that is it's usually a bit difficult to get people to run files even those just a hasty
M-L file.
And you can use smart social engineering skills to get them to run it.
It's still a bit difficult and it will be much easier if we can just send them a link which will change
their password as soon as they click on that link.
And this is actually really easy because the file we created is a hasty XML file.
So all we have to do is just upload that file to our web hosting company you know there is a lot of
free web hosting online.
You can just upload that file there.
You can use your shortening service as well to make the or else shorter and less suspicious.
And then you can send it to the target person.
So I'm going to show you how to do that but I'm actually going to do it on my local machine because
everything for me here is local but it works on the external web sites exactly the same.
You'll just have to upload to the demo page on our web hosting.
Doesn't matter if it's free or paid.
But there is a lot of free ones.
So I'm going to use my local Apache server right here.
And then we're going to browse it from our target Windows machine and we'll see how that is going to
be executed and how the password is going to be changed.
So before I do anything I'm actually just going to reopen the file and I'm going to set the password
to 7 7 7 7 7 7 and serve 6 6 6.
So we just know that the password has been changed to the new one and I'll change it in here as well.
And now I'm going to copy this to my local web server and Cali.
First of all I'm going to copy the file to my document root so the file is stored in desktop now so
I'm going to do C.P desktops if to R W W W H D L.
And now I'm going to start my Apache's so I'm going to do service Apache to start
now everything's working.
So I'm just going to get my IP address
and my IP address is 10 20 14 to 30.
So I'm just going to go to a Windows machine.
Now in this machine I'm actually pretending to be a target user.
So first of all I have to be logged in to my account.
So I'm just going to go to DVD-Video A so I'm going to log in with my username which is admin and I'm
going to log in with my old password which is or to my current password the ones that were listed previously
which is 6:06 is.
Now as you can see I can log in normally.
Now I'm going to go I'm going to close this.
Now we're going to browse to the page that contains the forged C-s are exploit.
So we're going to pretend that I was social engineer and someone gave me a u r l to click.
So at the moment we're actually not going to download any file.
We're not going to double click any file.
All we're going to do is literally just browse a u r l and once we do that our password is going to
be changed so the page as I said you can host it on free hosting there's a lot of free hosting online
at the moment.
I have it hosted on my Callimachi in and it's IP is 10 20 14 to 13.
And then I'm going to put my the name of the page which was set to C-s or aftertaste.
I'm going to hit enter.
As you can see it's still in me that the password has been changed and all I did again.
All I did is just run as you are.
And so it's all down to you to how you're going to convince your target to execute that you are out.
So if I just log out now and log in again you'll see that my password now I have to log in with admin
and I'm actually going to type the password here so it's 7 7 7 7 7 7 and I'm going to copy all of this
and paste it down there just so that you actually know that the password has been changed to 7 7 7 7.
So the vulnerable you are ALWIS 10 20 14 to 13 forward slash CSR.
Anybody who would run this you are l and logged into their target web site they'll be forced to change
their password to 7 7 7 7 7 7.
Now you can use this method.
As I said with any website that is vulnerable to s.c.s or F and it'll force the user to do any action
you want.
All you have to do is just adopt the same method to the form.
So whether it's a payment form whether it's a sign up form whether it's a submit article for whether
it's a form that sends a message to a friend you can just change the website right click inspect the
form element copy the form code hide everything the javascript code that submits the website or that
submit the form automatically.
Then you can send the what the hasty M-L website as it is to the target person or you can upload it
to an online hosting and then just send the hosting your all to the target person.
Once they browse that you are l the web page will be automatically executed.
Force them to change their password or to do the action that you want them to do.