User-driven Web Drive-by Attacks

Cobalt Strike makes several tools to setup web drive-by attacks available to you. To quickly start an attack, navigate to Attacks and choose one of the following option:

Java Signed Applet Attack

This attack starts a web server hosting a self-signed Java applet. Visitors are asked to give the applet permission to run. When a visitor grants this permission, you gain access to their system.

The Java Signed Applet Attack uses Cobalt Strike’s Java injector. On Windows, the Java injector will inject shellcode for a Windows listener directly into memory for you.

Navigate to Attacks -> Signed Applet Attack.

figure 45 - Signed Applet Attack

ClosedParameters

Local URL/Host/Path - Set the Local URL Path, Host and Port to…