1. Can the hijacked browser's history and saved information be viewed?
  2. Is it possible to create a backdoor in the browser? In other words, can it be secretly redirected to any site or downloaded and opened any file without the knowledge of the other party?
  3. Can any changes be made to the browser's settings? And for these, does it matter that the other party's browser does not close?

1 Answer 1


BeEF simply injects javascript into the compromised site, allowing the attacker to remote-control the tab it's running in (so long as the victim doesn't close the tab or navigate away). Therefore, BeEF can do anything that JS can do - read the site's local/session storage and indexed db, access any non-HttpOnly cookies, set cookies, send requests, read responses (if they're same-origin), hook JS functions that already existed on the page, create sub-pages (same- or cross-origin, though it won't be able to directly control cross-origin ones) such as iframes, interfere with closing or navigating the tab by prompting the user (though modern browsers allow blocking this), navigate the page, appear to navigate the page by loading a new DOM, monitor mouse movements and keystrokes sent to that tab (but not otherwise), and so on.

It can't do anything that JS can't do (since it is just JS itself). If an ordinary web page can't do it, neither can BeEF. Therefore, no, it can't directly view your browsing history (though there are attacks which are sometimes possible that can let a site guess and check whether a specific page is in your browser history), it can't create a backdoor in the browser itself (although it could do things like offer you a malicious file download or suggest installing a malicious browser extension, and those could create persistent backdoors or other bad effects if you execute/install them), and it definitely can't change browser settings (except again via tricking you into executing more-privileged code).

In general BeEF is injected via XSS and used for session hijacking - letting the attacker see everything that the victim can see, and do everything the victim can do, in the context of interacting with the XSS-vulnerable site - and if you just wanted to run some specific malicious script, you could make that script itself the XSS payload (rather than BeEF). Alternatively, you could just host the script on a site you control, and try to trick victims into visiting your malicious site. However, by design, the JS sandbox is very restrictive and doesn't allow most ways of attacking the browser/computer, specifically because websites might be malicious.

You can do a lot of harm if you can social-engineer (trick) the victim into taking actions that give you more privileges. JS is allowed to request access to your device location, to your microphone, to your (web)camera, and to various other devices. It can initiate file downloads (though not force them to complete, and certainly not force them to execute after downloading or choose the location they download to), and then try to trick you into running the downloaded file. It can suggest, but not force, installation of browser extensions or cosmetic browser "themes", which might make it hard for the victim to use the browser correctly. However, all of these harms require the victim to consent to doing something (like accessing location or installing an extension); scripts (including BeEF) can't force any of that.

  • #CBHacking Can you just answer yes or no to the questions I asked, 1), 2), 3), 3)?
    – lkk4325
    Commented Feb 4 at 8:21
  • @lkk4325 as the answer clearly explains, it's not a yes/no situation. The answer to each is "it depends on a lot of factors". You are going to have to read this well-explained answer.
    – schroeder
    Commented Feb 4 at 13:34

Not the answer you're looking for? Browse other questions tagged .