Questions tagged [beef]

Browser Exploitation Framework Project

Filter by
Sorted by
Tagged with
1
vote
1answer
219 views

Beef+ bettercap injection failure?

I am trying to inject beef's hook.js in browser on another pc on my local network. After starting beef and login to the UI I started bettercap in terminal and executed the following command: sudo ...
2
votes
1answer
337 views

How to set up a beef hook on another VM's browser in a NAT Network in VirtualBox

I'm reading "Practical Web Penetration Testing". I'm using VirtualBox to run two VMs: Windows 7 with Mutillidae and KaliLinux where I want to use Beef. Both are connected to a Nat Network 10.0.2.0/24. ...
4
votes
1answer
703 views

BeEF XSS - internal working

I am studying BeEf XSS as I think it is a very interesting tool for a penetration tester, but I have a couple of doubts about it, in particular when linking it to Cross Domain Request. So, in some ...
-4
votes
1answer
1k views

How to use beef-xss on ports other than default 3000?

I want to use BeEF-XSS Framework over WAN (for educational purposes). The only problem is that my ISP is blocking port 3000. So, after some research, I found this page that says: However, beef-xss ...
5
votes
1answer
271 views

Can BeEF hooking be stopped with Content Security Policies

I know that using strict values for default-src and scripts-src are a popular way to prevent (or at least limit the impact) of XSS attacks. But I was just wondering it CSPs can be used to stop ...
2
votes
1answer
330 views

BeEF - What are the Indicators of Compromise (IOC)

If a phishing email came through with a link to a website hosting BeEF (or another such framework) what would be the Indicators of Compromise for such an attack. Additionally, if systems were ...
4
votes
1answer
95 views

Beef on Multiple Campaigns

I use the Autorun Rule Engine (ARE) in BEEF to run some some targeted modules upon being hooked and this works great, but how about if I want to run two separate campaigns? Those sent to webpage A ...
3
votes
1answer
687 views

BeEF Server over VPN

Is it possible the run BeEF (Browser Exploitation Framework) on the WAN through a VPN? IF so, how would I modify to config.yaml file? I assume I would need to open some ports on my VPN service, ...
2
votes
1answer
898 views

Restriction to ui panel on BeEF+Bettercap generates error login

I'm not sure if I discovered a possible bug. I already reported to Bettercap's staff on their Bettercap's Github but as you can see on that link, it seems the problem is not on Bettercap's side. Maybe ...
3
votes
1answer
198 views

Invalid beef hook id: the hooked browser cannot be found in the database?

So I've just installed beEF on my centOS server, but so far it hasn't been working on any page that's not in the same browser that I'm logged into. The beEF admin panel only works on the demo pages ...
5
votes
1answer
376 views

How does BeEF do a portscan and ping?

I'm wondering how can BeEF do a ping request, port scan or other things that heavily rely on interacting with lower levels of the operating system (OS)? I used to think that JavaScript cannot ...
4
votes
1answer
2k views

XSS filter bypass to hook BeEF

I found a vulnerability on a website which allows me to trigger XSS. It's a very specific vulnerability, which is caused by a design-flaw. I want to write a PoC for them but I'm stuck at this step. ...
21
votes
4answers
18k views

How does BeEF work? (working understanding)

I have recently come across the BeEF- a browser exploitation tool. In most of the articles, it is said time and again that it is developed for research and pen test purposes! Has anyone worked with ...