I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request.
So, in some way we are able to force the the user browser to include the following hmtl tag:
The browser does not complain about it, as the src attribute can contain any domain, not just the one that the user is surfing. Then, as I understand it, hook.js is not opening a port on the client as it is not supported by JS, but it pulls commands doing a XMLHttpRequest from the BeEF server (which is hardcoded in the hook.js).
Then it executes the commands in the browser and send back the result (of course there must be a sort of internal protocol that the BeEF server understands). The reason it works, is that the BeEF server sets the following items in the HTTP header:
I sniffed this when trying everything in local, so basically there is the directive
Access-Control-Allow-Origin by which the user browser will allow this communication.
Is my thinking correct?
Also, do you know if hook.js can be fetched from server A, but then pointing to Server B? Otherwise, you basically are showing the address of the machine in which the hook.js is hosted and also you must have access to that machine.