[rand0]

Awesome share. I will most certainly get into this when I actually get more time to hack. I'm uber impressed by your 1337ness sir. Keep up the good work. Bookmarked :)

[orunu]

i just got one question :/ how does a victim become "active"?

[Hooded Robin]

by visiting a page where you have injected your XSSF link into. Might be persistent or not. You can use whatever syntax works on your particular site but it needs to point to the URL provided at XSSF startup (or if you check). Once a visitor visits the malicious link or injected page their browser will be hooked. Once hooked you can have fun doing what you want. You can use the test page that gets setup at load time to test how things work and how the hook makes a target become active. Hope this helps.

[orunu]

by visiting a page where you have injected your XSSF link into. Might be persistent or not. You can use whatever syntax works on your particular site but it needs to point to the URL provided at XSSF startup (or if you check). Once a visitor visits the malicious link or injected page their browser will be hooked. Once hooked you can have fun doing what you want. You can use the test page that gets setup at load time to test how things work and how the hook makes a target become active. Hope this helps.

yea i found out i could use a hidden iframe with a link to the testpage and have auto attack setup = pwned

and im using no-ip.biz instead of my external ip :) safer that way lol

[DD0Sed]

This still works right?
I also read you could connect nessus with XSSF+metasploit.

[Hooded Robin]

Yes it still works, very well in fact!

You can incorporate Nessus into Metasploit, but dont really see how that is going to help you with XSSF, your better off finding XSS vulns manually while Nessus is a beast at finding other vulns you can exploit. That is also a entirely another subject so please start a thread with your questions on Nessus in the Pentest section if you have more questions or want to know more about it.

@orunu - I had not tested yet with NO-IP but seems like a no-brainer idea. Thakns for confirming that setup works well!

[matt_]

Awesome demo on this. Not really something i've looked into before but this has caught my attention now. Thanks.

[Fabric]

nice tutorial man this is the first time i saw this thanks

[Greyersting]

I am getting uninitialized constant msf:xssf
What does that mean?

[Hooded Robin]

to be honest I am not really sure. Did you properly extract all of the XSSF documents into the MSF3 directory before running the load command? I assume your getting error at load, if not provide some more info and I try to help you get things working

[DΛЯK 0DIП]

Great tut however:

Secondly - run your choice method of opening MSF
[*]Armitage or ./msfconsole

It is recommended by Rapid 7 to just run armitage or msfconsole from a terminal, and not from the directory.

[Infinity.]

Great tutorial mate..:) will try this sooner , bookmarked this..:)

[fred goffa]

Hey dude nice tut, but next time can u please show hacking external ip, not a local ip please, because it drives me crazzy when people say they can hack in videos, but when doing it over lan prooves nothing, all lan hacking proovs is ur a script kiddie :\

[DΛЯK 0DIП]

but when doing it over lan prooves nothing, all lan hacking proovs is ur a script kiddie :\

This is one of the most ignorant statements I have ever heard.

[Vikta_]

Great tutorial. Going to bookmark this for later use ;-)