In BeEF, a ping is not an ICMP ping request, and a port scan does not mean a SYN scan (or any of the other common port scanning methods you'd find in nmap for instance). Instead BeEF uses standard web APIs that make layer 7 network requests (HTTP/FTP/WS) and measures the timing of these API calls to determine whether a host was up or a port open.
There are three different techniques BeEF uses for this purpose:
- Cross-Origin XMLHttpRequests
- HTML Image elements with onerror/onload event listeners
The ping module uses Cross-Origin XMLHttpRequests only, while the port scan module uses all three. BeEF never accesses OS-level networking functionality and cannot send ICMP ping requests or do a TCP SYN scan.