I have searched forums and found posts dating back to '13 and '12 asking how the BeEF framework exists, how it is able to hook the browser to execute malicious code. Though, I have not, however, found any posts about that lately and wondered if, as a penetration testing tool, BeEF is still as versatile as it was years before? I would of imagined browser manufacturers, Google, Mozilla, would have released fixes for bugs like these. If this still works, how can javascript be so flawed?


BeEF as the name suggests is the The Browser Exploitation Framework. That being said it only makes sense that it comes with lots of exploits for lots browsers. While it does still work in the sense that some of the exploits are not patched or that lots of the exploits are not patched in older browsers it is not as powerful as it once was. It used to be very powerful but you can still execute some attacks. Another reason it is less powerful is that it was developed primarily in a time where SSL/TLS was much less common and it was much more easy to intercept and replace traffic. So in short, it does still work however it is not as powerful as it once was but is still a nice framework.


I used BEEF today on a Ubuntu system which had been updated running Firefox so yes it still works.

You could always try it out on the browser version you have in mind to see which pieces of functionality work? I used DVWA to deliver the XSS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.