BeEF is a great exploitation Browser based tool. But in some cases, unknowingly people get Hooked due to beef when it's hook.js is kept in Invisible Iframe of an HTML source. So How, can we detect that our Browser is actually Hooked by BeEF Communication server or not ? If we have been Hooked, than what are the Measures to remove the Hook ?

Moreover, How could a Person's browser infected with BeEF can reverse and find it communication server (The place where the outgoing traffic is sent like server:8080/ui/panel )


There are Yara rules submitted by SANS ISC to detect BeEF, and these could be repurposed by yarashop for the network layer as a early-warning detection system. The author shows how to utilize Volatility to read into a memory capture and look for BeEF-related signatures and communications -- https://isc.sans.edu/diary/When+Hunting+BeEF%2C+Yara+rules+%28Part+2%29/20505

In order to remove a Javascript hook, such as BeEF, you would typically only need to clear reopening pages/tabs, history, and cache before restarting all browser processes. However, in some persistent BeEF scenarios, you will also need to consider other offline browser stores, such as HTML5 offline cache.

You are right to want to look for BeEF, but you will also want to dig a little deeper. It is easy to obfuscate Javascript and can be difficult to modify your detectors to catch these obfuscations. Other Javascript-hooking packages, such as XSSF, Scanbox.js, or the metasploit-framework's auxiliary/gather/browser_info module can be utilized instead of BeEF.

Emerging Threats, recently acquired by Proofpoint, has a set of Snort rules -- https://rules.emergingthreats.net/open/snort-2.9.0/rules/ -- many of which cover BeEF, XSS, Scanbox, et al. You will especially want to check out the emerging-trojan.rules and emerging-web_client.rules files. There are specific entries for BeEF and Scanbox, as well as generic ones to catch active XSS from the client (i.e., browser) perspective.

Here are two articles that discuss how threat communitiies are converging on these Javascript-hooking technologies -- https://www.helpnetsecurity.com/2016/04/28/attackers-use-open-source/ -- http://www.securityweek.com/attackers-increasingly-abuse-open-source-security-tools


If the sole concern is "hook.js" browsers such as Mozilla, Firefox have script blockers addons (e.g. noscript), if you're using IE, you could enable script blocking which would render any javascripts moot. As for tracking the communications server, you could use netstat:

netstat -an | findstr 8080

That would only work if whomever set a port to 8080. Your best bet would be to change findstr to ESTA. Which will show established sessions. If there is a browser with an established session, you could use netstat with the pid variable and look at the PID in task manager:

netstat -ano | findstr ESTA

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.