Questions tagged [beef]

Browser Exploitation Framework Project

Filter by
Sorted by
Tagged with
0
votes
2answers
131 views

Can antivirus software detect if your PC is hooked to BeEF?

I recently discovered BeEF with which someone can gain access to another PC through XSS. I was wondering if antivirus software can detect when a PC get's hooked to BeEF.. An online search doesn't ...
1
vote
1answer
685 views

Beef+ bettercap injection failure?

I am trying to inject beef's hook.js in browser on another pc on my local network. After starting beef and login to the UI I started bettercap in terminal and executed the following command: sudo ...
2
votes
1answer
604 views

How to set up a beef hook on another VM's browser in a NAT Network in VirtualBox

I'm reading "Practical Web Penetration Testing". I'm using VirtualBox to run two VMs: Windows 7 with Mutillidae and KaliLinux where I want to use Beef. Both are connected to a Nat Network 10.0.2.0/24. ...
4
votes
1answer
946 views

BeEF XSS - internal working

I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request. So, in some ...
-4
votes
1answer
2k views

How to use beef-xss on ports other than default 3000?

I want to use BeEF-XSS Framework over WAN (for educational purposes). The only problem is that my ISP is blocking port 3000. So, after some research, I found this page that says: However, beef-xss ...
5
votes
1answer
352 views

Can BeEF hooking be stopped with Content Security Policies

I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop ...
2
votes
1answer
373 views

BeEF - What are the Indicators of Compromise (IOC)

If a phishing email came through with a link to a website hosting BeEF (or another such framework) what would be the Indicators of Compromise for such an attack. Additionally, if systems were ...
4
votes
1answer
101 views

Beef on Multiple Campaigns

I use the Autorun Rule Engine (ARE) in BEEF to run some some targeted modules upon being hooked and this works great, but how about if I want to run two separate campaigns? Those sent to webpage A ...
3
votes
1answer
794 views

BeEF Server over VPN

Is it possible the run BeEF (Browser Exploitation Framework) on the WAN through a VPN? IF so, how would I modify to config.yaml file? I assume I would need to open some ports on my VPN service, ...
2
votes
1answer
1k views

Restriction to ui panel on BeEF+Bettercap generates error login

I'm not sure if I discovered a possible bug. I already reported to Bettercap's staff on their Bettercap's Github but as you can see on that link, it seems the problem is not on Bettercap's side. Maybe ...
3
votes
1answer
231 views

Invalid beef hook id: the hooked browser cannot be found in the database?

So I've just installed beEF on my centOS server, but so far it hasn't been working on any page that's not in the same browser that I'm logged into. The beEF admin panel only works on the demo pages ...
5
votes
1answer
431 views

How does BeEF do a portscan and ping?

I'm wondering how can BeEF do a ping request, port scan or other things that heavily rely on interacting with lower levels of the operating system (OS)? I used to think that JavaScript cannot ...
4
votes
1answer
2k views

XSS filter bypass to hook BeEF

I found a vulnerability on a website which allows me to trigger XSS. It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step. ...
22
votes
4answers
19k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...