fake browser update using ipwn

[Markanees]

hey ininjas
i am going to make a tutorial about making a keylogger using ipwn and metasploit using fake browser update
first of all we need
ipwn ( from the repo )
metasploit ( from the repo too )
terminal of course


you need to enter as a root
then open ipwn


choose choice( 4 )  metasploit attack vector
then choose ( 1 ) windows fake browser update
there are many choices that will be disscused  later on another tutorials

enter the port to listen onz which is 80

then we choose ( 1 ) which is a keylogger.exe ( the excutable )


then we will choose the payload you want ( 3 )
you may choose any of them but the meterpreter is the best


the last step is choose the encoding ( 6 )
x86/shikata_ga_nai is the best ( its a japannies word means can't be help ) lol

now wait for metasploit to start

open the other page in terminal and open ipwn again now we need to arp spoof so all traffics redirected to your device
make sure to open lighttpd in sbsetting

now try to open from another browser
it will tell there is update which is recommended to do once the download complete the victim opens the file you are in

this work on victims on your local network

feel free to correct or add anything to this tutorial

[[null]]

Great tutorial! I've used this a couple times at a local park, which has an all windows 98 computer lab. Here's a +1 from me!!

[Ironman]

Very nice tut! I'll add a +1 too!

[Markanees]

thank you

[OneHappyTaco]

Very good! +1. But I would clean up the spelling a lot. Also go into the steps of the arpspoof for people that are new. Finally, please explain what is happening, I always explain what is going on so people don't turn into skiddies.

[Ironman]

Very good! +1. But I would clean up the spelling a lot. Also go into the steps of the arpspoof for people that are new. Finally, please explain what is happening, I always explain what is going on so people don't turn into skiddies.

Good points Taco. But English isn't their first language so some leeway should be given there. An explanation as to what is happening would be awesome. But it's still a good tut.

[OneHappyTaco]

Oh, I didn't know. Thanks for clearing this up Ironman

[Ironman]

No worries Taco. But your points are valid. A good tut is just a good tut. But a great tut is better!!

[Markanees]

thanks onehappytaco for your point
i will try to improve my english
i tried it many times at college but the % to succeed depend on the victim as its easily recognized by antivirus
and depends on will he response to the update and execute the file
at my college it never succeeded so I have tried it at home by disabling the antivires nothing happend too lol
i just made it because someone lucky may try it at public network and succeed with old pc lol

[Ironman]

^ LOL!! It could still be valuable. You never know what will work sometimes. Better to have to many tricks than not enough.

[Markanees]

^ LOL!! It could still be valuable. You never know what will work sometimes. Better to have to many tricks than not enough.

yep true
I agree

[UberN00b]

I guess you could distribute loaded live CDs to noobs;) Inspired by https://ininjas.com/forum/index.php?topic=4133.0

[Markanees]

I guess you could distribute loaded live CDs to noobs;) Inspired by https://ininjas.com/forum/index.php?topic=4133.0

yeah that would be the easiest way to hack a large number lol