Instructor: Okay, now let's have a look
on a social engineering plugin
that'll allow us to steal usernames and passwords
for accounts.
So basically the way this works is, it'll dim the screen
and it'll tell the person that,
you got logged out of your session,
so please login to your account again
so you can get authenticated.
So this will allow us to bypass HTTPS, HSTS,
all security that's used by the target account page.
For example, if you're trying to get username and password
for Facebook then you'll be able to bypass all the security
that Facebook uses. Because what you're doing is,
you're actually just showing a fake Facebook page.
So the user will never actually get in contact
with Facebook.
So let's just click on this.
And you'll see that you can click form form here,
you can click what account that you want to hijack.
So let's say we're going with Facebook
and you can select what the backlight will be.
So we're just leaving that as gray
and we're gonna execute this.
And when we go to our target
you'll see that they're being told
that they go logged out of their session
so please login with your username and password.
So I'm gonna put my username as zaid.
Then I'm gonna put my password as 123456.
And Enter.
And if we go back here,
you'll see we got our username,
was zaid and the password was 123456.
So you can use this to hijack a number of accounts.
For example. Let's just have another example.
If we go with YouTube...
Again you give it an execute, come back,
you see the YouTube logo and you can try to login.
Put a username, password, sign in and that'll be captured.
So again, this is a really good way of gaining access
to accounts.
Because even if the user is not planning on logging in
to the account that you're trying to steal
then you'll kind of force them to enter their username
and password to be logged back in into their account.
And then you'll be able to capture the username
and the password.