9. Next, the right text book contains the URL the attacker wants the victim to
fetch??”for example, http://www.isecpartners.com.
10. Finally, the attacker clicks the Submit button and then clicks the Return To Main
link.
11. The attacker refreshes the main page and can view the results of the force
document fetch by clicking the link when it appears in the Document Results
section.
Chapter 4: Malicious JavaScript and AJAX 91
BeEF Proxy
Popularity: 4
Simplicity: 5
Impact: 9
Risk Rating: 6
Since the XSS-proxy proof of concept tool was released, a number of more fullfeatured
tools have been released. One such tool is the BeEF browser exploitation, written
by Wade Alcorn and available at www.bindshell.net/tools/beef. BeEF offers a number
of improvements over the original XSS-proxy code. First, it simplifies command and
control of compromised browsers via an easy-to-use administrative site that displays a
list of compromised machines. The attacker can select any compromised victim and be
presented with a list of information about the victim??™s machine, such as browser type,
operating system, and screen size. After the attacker has selected a victim in the BeEF
Figure 4-1 The XSS-proxy administrative interface
92 Hacking Exposed Web 2.
Pages:
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193