Hello, everyone, welcome to another video of our man in the middle attacks.
Today, we're going to use better cap to inject a JavaScript into a Web page using the inject gas module.
We are going to combine better cap with beef excess beef excess, as is a browser exploitation framework.
It has many features and we will use some of them in later videos.
But in order for us to hook the target's brother.
With beef, we need to inject JavaScript into the page.
The target is visiting without him realizing.
First, let's install beef excess.
And, Kelly, we can use beef, we can sell beef excess using the command and beef exercise, and in
this video we are going to use better version two.
In the last video, we used better version one.
Better version two is much better.
Since there are a lot of performance improvements, also, the language itself is is different from
the version one.
After you sold beef dash exercise, you can just simply launch it by beef.
The expert says unless you sold it in your directory, you just go to your territory beef and make sure
you change the username and password first and
that.
It's not the default password, so changed mine.
Once you're done, you just type B dash excess exercise.
But I'm going to do this from my Mako's virgin.
I'm already inside maybe from maybe if territory, so I'm going to use our pvm sutta, that would be
beef.
Now, let's make sure that we can visit the control panel first and login with our username and password.
Go to this URL.
Unlogged.
Very good, as you can see on the left side.
We will see any browser and online browsers.
If they use or closed the browser, it will go to the offline.
All right, perfect.
Now we go to Kelly to to install and run better Cabarita, you can so easily by just type install better.
And I will install the latest version.
After you saw it, you couldn't run better.
You can also use my face for the interface and then land that one zero four zero if you're using Ethernet.
So if it's
OK, we're going to use this trip like from the Virgin Virgin, one from the least the last video we
had, but this time it's going to be different.
The interface of Better Kapper into is kind of different from version one, because version one doesn't
have Ulli or doesn't have this command line interface.
So you can just follow my commands except HTP.
Or I would rather say, if you want to first find help, they help you find all the modules here.
So we're going to use HTP proxy.
If you remember from version one, we just use Desh proxy.
But here it's different.
If you want to get more information about a module, you just type help HTP proxy.
It will give you all the parameters that you can configure luggage to be poured.
Agha's blacklists and of course, inject you gas, which we used in the past and other stuff.
You can also have a script here, JavaScript.
So in our case we want to use.
There is a cell strip, right, it's it default default for so we can we make sure we use it to make
it true.
So set to be a proxy cell strip.
Let's also make sure our Puf internal is on, so we do set our spoof internal truth in our hearts,
Wolf, we need to specify a target, said AAFP Puf.
You can also press tab for completion, for auto completion.
So Target.
And then here you specify the address of your target.
We go here from the IP address from the last time should be the same.
It hasn't changed so much.
I think it's the same zero dot.
Forty seven.
So we can do here.
Also, let's use our JavaScript, inject gas.
So send proxy dot checks, JavaScript, and then we go here, we copy the URL, which is this one.
OK, if you want to turn on the network sniffer, you can do it, that's fine, but I'm not going to
do this.
Also, make sure you do set net net snip.
That shows false just to not show you a lot of information on your screen.
But I'm not going to do this.
I said, OK, since we have everything ready, let's turn on if you could type help.
We still have our modules now running, so let's run them.
So type the proxy on.
And then are those who've also Paul.
Now, let's switch here.
If we go to our target and opened up Web page, Amazon.com, for instance.
See, it's very.
We got the data right, we were able to strip the URL, let's make sure it's hooked or not.
Go here.
It's not over yet.
Let's try again.
We have to send the.
Correct IP address here.
Let's do it again.
Page, SOAPnet again.
OK, yep, we were able to hook the target here, we can go target commands, we can do a lot of stuff
here, like, for instance, we can.
Go to like Google fishing, just execute.
Now, if you go here, see this page has turned to Google blog and you just type Tuzer, one, two,
three, four, five, six, signing.
And then you click your command, see, you've got these are going the password, you can do also like
other stuff like maybe like fake flash updates.
But before we do this, but keep in mind that our browser is not correct anymore because it redirected
Daza to something else.
So let's go back to our page or any page.
Doesn't matter because we're using better tap to intercept the traffic.
Let's make sure that we are hooked again.
We hooked up, we are hooked again.
We're back in business.
So if you go to Flesh Update's, so this is going to be the payload, your URL.
So if you click execute and see what happens.
Now, it didn't work for a reason.
Yeah, there are a lot of things here that we can use.
One of them also is the fake notification bar code.
So here you can set the URL of your dropper through your file that you want to the user to download
and then you can just execute.
Of course, I have this from now.
I'm just doing something.
And I think it's just, you know, you can see it if you click install missing plugins here, you will
be redirected and download the file from our server, like from this URL.
But of course, we have this this will be in our next video.
Right.
So there are tons of features here.
You can do also the browser.
So you have features here like Playtime's and.
Look, what can you can also unhook it from your from your beef.
There are a lot of things you can do here, so just play around with it and we'll see you in the next
video.
Thanks for watching.
See you.