XSS Tutorial Demonstrates Browser Control and Credential Capture

Summary

A lab walkthrough injects JavaScript into a chat app to hook and control a browser session, then demonstrates fake login prompts that capture entered credentials.

Key points

The presenter injects JavaScript into a lab chat application to test an XSS flaw.
A browser exploitation framework uses an injected hook script to gain control of the visiting browser session.
A social-engineering module displays a fake Facebook login prompt and captures the test credentials entered.
The demonstration redirects the browser to a fake Google login page and records the submitted credentials.
The presenter inspects browser network activity to verify when the hook script is loaded, then restarts the app without the injected script.

Article Details

Topics: [00:00] XSS tutorial introduction and credential-capture preview
[00:49] Injecting JavaScript into a web-based chat application
[01:19] Setting up the browser exploitation framework and hook
[04:34] Demonstrating fake login prompts and credential capture
[05:37] Redirecting to a fake Google login page
[06:28] Inspecting network activity to verify the injected hook

MITRE ATT&CK

T1056.003 · Web Portal CaptureThe presenter uses fake Facebook and Google login prompts to capture credentials entered in the demonstration.

Summary

Key points

Article Details

MITRE ATT&CK

Related Articles