What is BeEF?
BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.
Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.
First navigate to beef by: applications>backtrack>Exploitation tools>Social engineering tools>BEEF XSS Framework
If this is your first time running BEEF you will want to click the install option first!!!!
So, after installing start beef!! it should look like this:
Then we will copy the UI URL near the bottom, and paste it into our web browser
It will prompt a login screen the default login is
- username: beef
- password: beef
Once logged in, we will have to hook a browser. For tutorial purposes, I will use the demo hooked page, but later on you will be able to incorporate the BEEF hook into pretty much anything you like. Take the Hook URL with the ‘js’ and use an address shortener so it looks a little less conspicuous and a little more like a URL. Of course, this will only work if you are on a real IP address. If you have a local 10.xxx.xxx.xxx or 192.168.xxx.xxx IP, you will have to setup port forwarding. It would probably also be a good idea to setup some tunnels, and proxies around the world to misdirect.
As long as the victim stays at the BEEF hook page, we have him by the balls! When he leaves the page, the connection will be lost. However, there are all sorts of persistence tools to infect all tabs with the BEEF hook, Sweet!
The advanced BEEF demo page looks like this:
As you can see, I have visited the hooked page and am now an ”online browser.”
That’s pretty much it!!! BEEF is a super simple amazing tool and I hope you found this helpful. I’m sure you can come up with all sorts of interesting ways to use this for legal penetration testing, right?
The following are some supplementary pictures to show you a number of the exploits held within for your Hooked Browsers: