do you want to see something scary i'm
going to send my wife an email with
pretty dangerous link inside there it is
looks harmless right let's see if she'll
click it
so far it looks harmless totally a
website she would visit but what she
doesn't know is that i now have control
of her browser i now know pretty much
everything about her system i can send
her fake password props and then steal
those passwords and i can even redirect
her to a website of my choosing
and even worse this opens up the door
for some serious attacks and the
scariest thing about this is that it's
not that hard to do the tool i'm using
is called beef i smell like beef and
don't the name fool you this thing's
crazy in just a few seconds you can spin
up a fake website with malicious code
baked in and all you have to do is send
a link to that fake website to your
target and if they just open that link
in their browser malicious javascript
code will run and it will hook their
browser the hooks me buckle beware the
hooks giving us control to do all kinds
of crazy things they dangle down and
draw you close they grab you by the
bridges in this video i have two goals
first yeah i'm going to show you how to
do this and it doesn't take much you'll
have it up and running in 10 minutes and
second i want to show you how dangerous
it is to open up any link that you don't
recognize and they may even look legit
they may have an ssl certificate it
doesn't matter they can still be back so
please take this as a lesson for
yourself and then tell everyone you know
now disclaimer do not do this to anyone
for any reason without explicit
permission this is
sure trick your mom your dad your sister
your friend your brother whoever have
fun with it but that's it educational
purposes only for fun if you try this
with ill intent you'll get caught and
you'll probably go to jail because this
is a real tool that real ethical hackers
will use to test the security of
companies that have hired them so if
that's not you don't do it okay first
what do you need to make this happen
pretty much all you need is a linux
server and preferably one in the cloud
and thanks to our sponsor lenode this is
wicked easy to do and pretty dang cheap
and if you use my link below to set up a
new account you'll get 100 free credit
for the first 60 days which means you
can basically do this for free and don't
worry if this sounds like really
intimidating like i have no idea how to
set up a linux server i'm going to walk
you through every single step now of
course if you have something like kali
linux or ubuntu in your house on your
computer or whatever that will work beef
even comes pre-installed on most kali
linux instances that was hard to say
cali linux instances cali linux and i
can't do it but you will have to do some
port forwarding to make it work if you
don't know what that is and it's kind of
confusing i do have some videos up here
somewhere but if you do it in the cloud
with lenode it'll work just like that
the second thing you need is a victim
which is kind of the fun part again
friends family or it can just be your
browser on your computer or another
computer or even dude you can do it on a
phone a phone's browser which is scary
and then finally like all things in it
and hacking a good delicious cup of
coffee
coffee okay step one let's get our linux
server set up so if you haven't already
head out to lenove.com forward slash
network chuck and either set up a new
account or get signed in and once you're
there let's click on create at the top
left and click on lenode because we're
creating a node now from here things
kind of get stupid easy we're going to
go to the marketplace tab right here
it's going to do all the work for us
check it out and we're going to search
for beef and it's right here using the
marketplace beef will just come
pre-installed on a server that we launch
we don't have to worry about it so
select that and then we'll scroll down
just a bit to add some settings for some
config here we'll have our beef options
and the first thing we'll do is set up
our beef account user password i don't
know why i said it like that so just put
in something for yourself and then just
below that put in an email address this
can be any email address and really i'm
not sure it's used for this installation
it's just required so you have to put
something in there anyways let's
continue okay next and this is just good
practice best practice we'll create a
limited sudo user to be created for the
lenode so just create whatever user
account and then create a password for
that user everything else is optional
but just pointing out here real quick
lenovo will help you set up a domain for
this so you can go a little bit crazy
but anyways it'll do some cool stuff by
default so don't worry about that so
let's go down and do a few more things
first our region where we're going to
put this thing put it somewhere close to
you i'm in dallas next we'll select our
node plan i like my shared cpu because
they're cheaper and i'll choose the
cheapest option a node one gigabyte five
bucks a month so even if you're not
getting this for free that's as much as
you're gonna be charged for this month
and then we're almost done we have to
label our box real quick on the mine
attack beef and then a password for my
root user and that is pretty much it
we'll go and click on create lenode and
that sucker's gonna bake and we're gonna
take a quick coffee break now one quick
thing you'll see at the top left your
lenode is baking it's gonna be
provisioning and then it will finally
get to running but it's not quite done
yet we'll give it about five more
minutes to finish installing beef so
i'll take one more little coffee break
no harm in that and i'll see you back
here in a bit okay i think it's baked
long enough smells done so let's go
ahead and grab this ssh root command
right here just click on that little
copy clipboard on the side and then
launch command prompt if you're in
windows
cmd or if you're on mac or linux it'll
be your terminal i'll paste that here
hit enter accept all fingerprints yes
and then put in my root password the one
we set when we set up our linux and
we're in now past this point it's
remarkably easy to do this it's
honestly kind of scary but let's let's
keep moving first we got to find out
some information about our beef server
so let's go ahead and do cat type in
cats and we're going to cap the file
forward slash root forward slash beef
dot info and hit enter perfect if you
see this you know your beef insulation
was successful if it wasn't give us some
more time it's got to bake some more but
right here and this is what's cool about
using lenode we have a
legit website url ssl which is kind of
crazy so anyways i'm gonna grab mine
real quick it's gonna copy that sucker
put it into a notepad for safekeeping
and also at this point we just go out to
our web browser
paste in that url hit enter and we're
there we have our beef server running
well node made that super easy i know
now if you're not using lynode maybe
using ubuntu or kali linux i'll have
some more videos and the link below to
help you get started with that and some
documentation and walk through so yeah
check that out anyways we're here let's
get logged in the username will be beef
no big surprise there and then the
password you use when you set up lenode
and this is for your beef user one of
the first ones we did so i'll enter mine
and
we're in okay here we are we have beef
running but now what well let's hack
someone right now it's already set up
check this out here in beef we have our
getting started section and you'll
notice that we have two links right here
a basic demo page and an advanced page
we'll go ahead and use the advanced link
and this right here is a pre-built fake
website that has malicious code that's
what's cool about beef is we don't have
to do much it's already set up so let's
try it out what do you say we hack
ourselves real quick so what i'm gonna
do go over here and copy this link right
click copy link address and actually
before we do that notice over here on
the left we have online browsers and
offline browsers these are browsers that
we have hooks into we cut off some
dishes i don't know if that's a thing
anyways so now with my link copied i'm
going to open up a dummy computer hey
dummy browser open up chrome and here we
go sucker here we go i'm gonna paste
that in the address bar and hit enter
now at first glance this seems harmless
enough right it's just a standard
website where you might want to buy some
beef but if we go back to our beef
console
show this out would you look at that
right here we have a hooked browser and
it was as simple as that just using that
demo website having them load that up
bam we have them so now what can we do
with it let's have fun come on check
this out first thing we'll do is we'll
just click this browser here our online
browser click and here under details
whoa look at everything we know about
this sucker i mean we know everything
about it screen size os version so
that's powerful but now let's click on
commands let's actually do something and
it's it's so easy it's it is scary watch
watch click on commands let's try
something simple i'm going to click on
the browser folder right here let's do a
simple alert dialogue i'll just type in
hey
you
just got
hacked now here we go i'm gonna click on
execute
and watch what happens ah look at that
a scary message hey you just got hacked
now you may not want to let them know
they just got hacked because you're
trying to trick them right let's try
some more things so i'll just go oh okay
i'm scared what do you say we try some
social engineering so let's uh minimize
our browser over here our browser folder
click on social engineering and this is
kind of crazy check this out i'll do my
favorite one the google phishing page
i'll click on execute the bottom right
and watch what happens whoa suddenly no
more beef i'm on a different page looks
like i need to log into google let's go
ahead and do that
bernard.hackwell
gmail.com and my password and click on
sign in this is weird i don't know what
this is let's close that but i'll go
back to the other page it just took me
to the google sign in this is actually
the legit google sign in but but if i go
back to beef if i click on the history
of that command look at that i have the
username and password
that my target entered that's pretty
crazy like be honest would you fall for
that maybe not would your mom fall for
that your grandma your sister probably
yeah so please use this as a chance to
educate them after you mess with them
show them how easy it is anyways let's
continue now the scariest thing about
this right notice it did go offline
because it's no longer on that domain so
it's now an offline connection let me
get them back online i'll go back to
getting started copy that link once more
and get them back home back to beef
there we go now they should be hooked
again now if you did this through lenode
what's even more dangerous is
it has an ssl cert already now sure this
looks a bit weird because uh it's not a
typical website probably the website
you're going or you meant to go to let's
try one more social engineering attack
this one's pretty cool a fake lastpass
which could be very very dangerous
access to pretty much all their
passwords if i click on execute on that
and i go back to my
oh there it is look it looks like
lastpass right get logged in
go and like it seems like you did
something right and you don't seem like
you got hacked but man on the back end
we got you if i click on that command to
see what happened what's even crazy
check this out it records each keystroke
until we get to the end where we have
the full information so even if like
they partially put it in we got it all
right here at the end and what i mean is
if they partially put it in we will
still get something isn't that awesome
man then i want to show you one more
thing before you start playing with this
and going crazy check this out let's go
over here to the network section right
here i'll expand that folder and here we
can do some pretty crazy things like i
don't know scanning their home network
finding out their
ip addresses and what's going on inside
let's try it out so let's see i've got
some identify lan subnets sure why not
let's let's run that execute now looking
back at my hooked browser i'm not going
to see anything going on and in fact
beef will tell you if one of the attacks
here is going to be noticed if i go back
to the getting started page here it has
levels of noticeability for your attacks
so for is that i'm colorblind so forgive
me if i say the colors incorrectly
yellow will not be visible so it's
invisible and green will actually
it may be visible might not so you got
levels anyways let's check on our attack
here i'll go back to my current browser
tab click on the details of that command
see what's happening scan complete and
it didn't find anything and i know why
this particular host i'm connected to
does not have a normal private ip
address network although i did find
these hosts i don't know what that is
let's try a ping sweep using java and
i'll scan the subnet i know that's there
and let's start then we'll monitor that
from here see what happens and give it a
second here and it looks like it's
having some issues no worries let's try
something else let's see all the http
servers on a certain subnet i'll change
that from common to a list shoot let's
also try to fingerprint the local
network with this command let's do it
all now i can get a live view of what's
happening if i look at my logs up here
i'll click on that i can see yeah it's
checking a ton of stuff on each one of
the ip addresses i put in that range and
finally one last thing we got to leave
them a going away present so let's go up
to our browser once more or our browser
folder and we'll click the
redirect browser rick roll let's try it
out execute let's go see what happens
[Laughter]
i love it every time it happens and
notice with this one the url did not
change so what happened is they set up
an iframe on the page and nested this
video or this website inside and that's
one way you can keep control of things
while redirecting their browser and
there's a a bunch of ways to do that
like right here redirect browser using
an iframe so i can direct them to
networkchuck.com execute go make sure it
went there bam look at that and i still
have control i look really worried right
there what's wrong with me now it's time
for you to have some fun and try this
yourself i cannot go over everything
that's in this
uh module tree here all the tools that
are available it would just take too
long but i wanted to showcase some of
the fun ones and to kind of like
get you to think about what's possible
like there are ways to add persistence
to where when they do navigate away from
that tab or close it or whatever it'll
still work you can also integrate beef
with metasploit and do even crazier
things but that's a video for another
time and by the way did i mention that
this works for mobile browsers too let
me show you let me send this link to
myself and actually what i'll do to make
it even more sneaky is just shorten the
url so i'll just search uh shorten
short url there's a free one out there
somewhere yeah this one right here i'll
paste that address here shorten it so it
doesn't look too crazy not too fishy so
that's it myself paste it in my browser
and let's get going so yeah that same
beef website but if you look back at our
beef control panel here
[Laughter]
we have a new device an apple device an
iphone let's try one of our commands
let's try a social engineer myself let's
do a google phishing attack
execute just like that mobile browser
totally works
enter some data blah blah blah doesn't
have to be accurate click sign in watch
this craziest thing ever redirects back
to my google account i think i'm fine
but i actually just got my information
stolen by my attacker
that's so crazy anyways that's about it
let me know what you think of beef the
browser exploitation framework i think
it's a very valuable tool that you can
learn to use if you are on the path of
becoming a hacker an ethical hacker the
only type of one you can actually be
it's also extremely helpful to
demonstrate to your family that and also
friends that they aren't necessarily
safe online in fact they're not safe at
all so if you see a link dude don't open
it if you don't know what it is if it's
not a url that you recognize don't go
there because even if you don't think
something's happening you don't think
you've got a virus behind the scenes
they could have hooked your browser you
could have hooked your family's browser
and they're doing something behind
underneath your browser to your computer
that you don't even realize so anyways
that's all i have today thanks again to
our sponsor lenode for making this video
possible and if you want to see more
videos like this where i'm demonstrating
these random hacking tools i think are
extremely interesting uh let me know
below comment and by the way speaking of
hacking have you hacked the youtube
algorithm have you not make sure you do
hit that like button subscribe
notification bell comment you have to
hack youtube today ethically of course
and for real that's all i have i'll
catch you guys next time oh almost
forgot one thing if you did not want to
use lenode for beef i'll have some
content down below to help you walk
through installing that on a local
machine in your network and even doing
some port forwarding to make it work but
again the easiest way to do it just to
get it up and running is to use lenode
it won't cost you very much if not
anything because it's going to be free
if you are a new account you have that
code you'll get 100 off for the first 60
days did i say it all right i think i
did anyways like for real i'll catch you
guys next time