I'm mainly server sided. I haven't worked with JS that much before.

My coworker was talking about BeeF and how it basically controls the victims browser just by a simple xss attack.

I was wondering how it's possible. Javascript only executed when the user is on that page correct? So when the user leaves that page, how can they still be controlling their browser if the JavaScript isn't running? Because BeeF documentation says the malicious javascript checks for commands every once in a while but it's not possible if the user isn't on that page with the malicious javascript.


BeEF has 4 ways to keep user browser hooked -

  1. Create popup under the browser to keep BeEF js code executing,
  2. Prevent closing tab with BeEF code running by asking confirmation
  3. Open new pages in foreground iframes
  4. Capture all link clicks and load new pages through ajax, without reloading page.

Details are here: BeEF Persistence

Not the answer you're looking for? Browse other questions tagged or ask your own question.