1
00:00:00,270 --> 00:00:06,600
OK, so in this video, I will show you how to use a V framework with your captive portal web page to

2
00:00:06,600 --> 00:00:09,360
gain control over the target web browser.

3
00:00:10,470 --> 00:00:17,100
So first off, make sure we have beef install on your system, and in my case, I have beef installed

4
00:00:17,100 --> 00:00:18,150
from GitHub.

5
00:00:19,080 --> 00:00:26,160
So here in the build directly, I will dive dot slash beef to start the browser exploitation framework.

6
00:00:27,330 --> 00:00:30,570
Now you can see the hook and the UI link.

7
00:00:31,380 --> 00:00:38,700
So in order to attack a browser, you need to include the JavaScript hook URL in a web page, and the

8
00:00:38,700 --> 00:00:41,670
UI link is the web interface for the tool.

9
00:00:42,660 --> 00:00:50,930
So I will start the web interface by open the link and here the user name is beef and password beef,

10
00:00:52,110 --> 00:00:58,710
and on the left is the Hook Browsers panel, and I do not have any target hooked for the moment.

11
00:00:59,730 --> 00:01:03,490
So let's see how to hook up browser and to do that.

12
00:01:03,510 --> 00:01:11,850
I'll go back to the terminal and open a new tab and change directory to slash forced flash WW slash

13
00:01:11,860 --> 00:01:12,700
HDMI.

14
00:01:13,740 --> 00:01:19,050
This is the location for the Apache Web server where I have the captive portal files.

15
00:01:19,920 --> 00:01:29,340
So I would list all the files using s and no, I will open index dot html using Nannerl and the name

16
00:01:29,340 --> 00:01:30,330
of the file.

17
00:01:31,170 --> 00:01:35,480
And in the third section you will need to add the Hulk URL.

18
00:01:36,360 --> 00:01:45,840
So all TypeScript is RC equal and go to beef and copy the whole QR code and pasted here.

19
00:01:46,680 --> 00:01:49,560
And closed the script and saved the foil.

20
00:01:50,840 --> 00:01:59,400
OK, so let's go to the victim's machine and connect the access point, and not the victim will be automatically

21
00:01:59,400 --> 00:02:04,280
directed to the login page, which contains the malicious JavaScript hook you are in.

22
00:02:05,310 --> 00:02:12,150
And to understand better, I will use right click and select View Page Source, and in the hidden section

23
00:02:12,150 --> 00:02:19,920
you can see the JavaScript hook, which is executed when the victim loads the web page or key knowledge

24
00:02:19,920 --> 00:02:23,730
swashbuckling machine and go to Beef Control Panel.

25
00:02:24,450 --> 00:02:27,900
And here to conceal who browser with the IP address.

26
00:02:28,830 --> 00:02:31,950
So at this point, you can exploit the victim browser.

27
00:02:32,880 --> 00:02:40,800
And to give you an example, I will go to comment and search for alert and select Create Alert, and

28
00:02:40,800 --> 00:02:41,310
I will you.

29
00:02:41,310 --> 00:02:45,030
This is a fake network and click the Execute button.

30
00:02:46,290 --> 00:02:52,920
OK, now let's go to the victim machine and here can see the alert message has appeared.

31
00:02:53,670 --> 00:02:55,260
So that's it for now.

32
00:02:55,290 --> 00:02:58,410
Thanks for watching, and I will see you next time.