Questions tagged [beef]
Browser Exploitation Framework Project
18
questions
1
vote
0
answers
288
views
Beef-xss Webhooks & Port Forwarding / NAT [closed]
The scenario is:
I am running a test webpage with apache2 with the beef hook embedded on a kali box (VM)
My router has a port forward set to the IP address of the VM and forwarding to the port on ...
1
vote
1
answer
251
views
Can BeEF also work in public?
Is it possible to run the tool called BeEF to do penetration testing on real domains like example.com? As far as I know, BeEF can only be used within localhost.
I can only test my site for XSS on the ...
- 11
0
votes
0
answers
1k
views
How to reliably detect Browser Exploitation Attacks with BeEF and other JavaScript hooking packages?
"Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF ...
user264116
0
votes
1
answer
2k
views
what can a hacker do with stolen cookies?
What if a hacker steals my cookies for example using BeEF or something else. What can they do with this information? Can they get any passwords or something?
- 363
1
vote
2
answers
3k
views
Can antivirus software detect if your PC is hooked to BeEF?
I recently discovered BeEF with which someone can gain access to another PC through XSS.
I was wondering if antivirus software can detect when a PC get's hooked to BeEF.. An online search doesn't ...
- 215
1
vote
1
answer
2k
views
Beef+ bettercap injection failure?
I am trying to inject beef's hook.js in browser on another pc on my local network.
After starting beef and login to the UI I started bettercap in terminal and executed the following command:
sudo ...
- 11
2
votes
1
answer
2k
views
How to set up a beef hook on another VM's browser in a NAT Network in VirtualBox
I'm reading "Practical Web Penetration Testing". I'm using VirtualBox to run two VMs: Windows 7 with Mutillidae and KaliLinux where I want to use Beef. Both are connected to a Nat Network 10.0.2.0/24. ...
- 21
4
votes
1
answer
2k
views
BeEF XSS - internal working
I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request.
So, in some ...
- 130
-4
votes
1
answer
5k
views
How to use beef-xss on ports other than default 3000?
I want to use BeEF-XSS Framework over WAN (for educational purposes). The only problem is that my ISP is blocking port 3000. So, after some research, I found this page that says:
However, beef-xss ...
5
votes
1
answer
1k
views
Can BeEF hooking be stopped with Content Security Policies
I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop ...
- 233
2
votes
1
answer
682
views
BeEF - What are the Indicators of Compromise (IOC)
If a phishing email came through with a link to a website hosting BeEF (or another such framework) what would be the Indicators of Compromise for such an attack.
Additionally, if systems were ...
- 737
4
votes
1
answer
214
views
Beef on Multiple Campaigns
I use the Autorun Rule Engine (ARE) in BEEF to run some some targeted modules upon being hooked and this works great, but how about if I want to run two separate campaigns? Those sent to webpage A ...
- 185
3
votes
1
answer
1k
views
BeEF Server over VPN
Is it possible the run BeEF (Browser Exploitation Framework) on the WAN through a VPN? IF so, how would I modify to config.yaml file? I assume I would need to open some ports on my VPN service, ...
- 185
2
votes
1
answer
1k
views
Restriction to ui panel on BeEF+Bettercap generates error login
I'm not sure if I discovered a possible bug. I already reported to Bettercap's staff on their Bettercap's Github but as you can see on that link, it seems the problem is not on Bettercap's side. Maybe ...
- 5,235
3
votes
1
answer
536
views
Invalid beef hook id: the hooked browser cannot be found in the database?
So I've just installed beEF on my centOS server, but so far it hasn't been working on any page that's not in the same browser that I'm logged into. The beEF admin panel only works on the demo pages ...
- 39
5
votes
1
answer
766
views
How does BeEF do a portscan and ping?
I'm wondering how can BeEF do a ping request, port scan or other things that heavily rely on interacting with lower levels of the operating system (OS)?
I used to think that JavaScript cannot ...
- 59
4
votes
1
answer
3k
views
XSS filter bypass to hook BeEF
I found a vulnerability on a website which allows me to trigger XSS.
It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step.
...
- 2,770
22
votes
4
answers
24k
views
How does BeEF work? (working understanding)
I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...
- 323