We haven't yet seen a good way of exploiting XSS vulnerabilities; all we have done so far is inject a very simple code that displays an alert on the screen saying that this website is vulnerable. What we are going to do now is something more advanced. We want to control the victims and do stuff on the target computers, on the people that visit the vulnerable pages where we have injected our code. We're going to use the BeEF browser to do this. We had a look at BeEF in previous chapters. What we're going to do here is use the BeEF hook URL and inject it into the stored XSS page so that everybody who visits that page will be hooked to BeEF. Then, we'll be able to run all the commands that BeEF allows us to run on the target computer.

Let's start BeEF. If we look at the online browsers, we have no victims at the moment. So, in order...