Using browser autopwn

An interesting auxiliary module for performing client-side attacks is browser_autopwn. This auxiliary module works in the following sequence:

1. The attacker executes the browser_autopwn auxiliary module.
2. A web server is initiated (on the attacker's system), which hosts a payload. The payload is accessible over a specific URL.
3. The attacker sends the specially generated URL to his victim.
4. The victim tries to open the URL, which is when the payload gets downloaded on his system.
5. If the victim's browser is vulnerable, the exploit is successful and the attacker gets a Meterpreter shell.

From msfconsole, select the browser_autopwn module using the auxiliary/server/browser_autopwn command, as in the following screenshot. Then, configure the value of the LHOST variable and run the auxiliary module:

Figure 6.22 – Using the browser_autopwn auxiliary module

Running the auxiliary module will create many...