And the previous lecture we see in how to create a HTML web page that exploits xref vulnerability that
will automatically submit a form and we've seen how we can exploit it to get the target person to change
their password without them even knowing.
So as soon as they double click the file, this form will be automatically submitted.
Changing the password to the password that we want.
One problem with that is it's usually a bit difficult to get people to run files, even though it's
just the HTML file.
And you can use smart social engineering skills to get them to run it.
It's still a bit difficult and it will be much easier if we can just send them a link which will change
their password as soon as they click on that link.
And this is actually really easy because the file we created is a HTML file.
So all we have to do is just upload that file to a web hosting company.
Now, there is a lot of free web hosting online.
You can just upload that file there.
You can use a URL shortening service as well to make the URL shorter and less suspicious.
And then you can send it to the target person.
So I'm going to show you how to do that, but I'm actually going to do it on my local machine because
everything for me here is local, but it works on the external websites exactly the same.
You'll just have to upload the the HTML page on a web hosting.
Doesn't matter if it's free or paid, but there is a lot of free ones.
So I'm going to use my local Apache server right here and then we're going to browse it from our target
Windows machine and we'll see how that is going to be executed and how the password is going to be changed.
So before I do anything, I'm actually just going to reopen the file and I'm going to set the password
to seven, seven, seven, seven, seven, seven instead of six, six, six.
So we just know that the password has been changed to the new one.
And I'll change it in here as well.
And now I'm going to copy this to my local web server in Kelly.
First of all, I'm going to copy the file to my document route.
So the file is stored in desktop now, so I'm going to do CP.
Desktop XREF.
To var w w w html.
And now I'm going to start my Apache.
So I'm going to do Service Apache to start.
Now everything's working, so I'm just going to get my IP address.
And my IP address is ten 2014 to 13.
So I'm just going to go to a Windows machine.
Now in this machine, I'm actually pretending to be a target user.
So first of all, I have to be logged in to my account.
So I'm just going to go to DWA.
So I'm going to log in with my username, which is admin.
And I'm going to log in with my old password, which is or to my current password, the one that we
reset it previously, which is six sixes.
Now, as you can see, I can log in normally.
Now.
I'm going to go I'm going to close this.
Now we're going to browse to the page that contains the forest cref exploit.
So we're going to pretend that I was social engineered and someone gave me a URL to click.
So at the moment we're actually not going to download any file, we're not going to double click any
file.
All we're going to do is literally just browse a URL and once we do that, our password is going to
be changed.
So the page, as I said, you can host it on free hosting.
There's a lot of free hosting online at the moment.
I have it hosted on my machine.
And its IP is ten 2014 to 13.
And then I'm going to put my the name of the page which was set to see SRF dot html.
I'm going to hit enter.
And as you can see, it's telling me that the password has been changed.
And all I did, again, all I did is just run a URL.
So it's all down to you to how you're going to convince your target to execute that URL.
So if I just log out now and log in again.
You'll see that.
My password.
Now I have to log in with admin and I'm actually going to type the password here.
So it's seven, seven, seven, seven, seven, seven.
And I'm going to copy all of this and paste it down there just so that you actually know that the password
has been changed to seven, seven, seven, seven.
So the vulnerable URL was ten, 2014 to 13 forward slash CSF.
Anybody who would run this URL and logged into the Target website, they'll be forced to change their
password to seven seven, seven, seven, seven, seven.
Now you can use this method, as I said, with any website that is vulnerable to XREF and it will force
the user to do any action you want.
All you have to do is just adapt the same method to the form.
So whether it's payment form, whether it's a sign up form, whether it's a submit article for, whether
it's a form that sends a message to a friend, you can just change the website, right click, inspect
the form element, copy the form code, hide everything.
The JavaScript code that submits the website that submits the form automatically.
Then you can send the web, the HTML website as it is to the target person, or you can upload it to
an online hosting and then just send the hosting URL to the target person.
Once they browse that URL, the web page will be automatically executed, forcing them to change their
password or to do the action that you want them to do.