-Prashanth Sivarajan Prash.siv@gmail.com

What is BeEF?

BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser. Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.

How it works

UI Overview

Information Gathering

Network Discovery

Social Engineering

Exploit

Persistence

Command Modules

Information Gathering

Network Discovery

Social Engineering

Exploit

Persistence

Browser Fingerprinting

Detect Plugins (Quicktime/VLC/Silverlight)

Host Fingerprinting

Detect logged in sessions

Command Modules

Information Gathering

Network Discovery

Social Engineering

Exploit

Persistence

Internal IP Address

Ping Sweep

DNS Enumeration

Port Scanning

Network Fingerprinting

NAT Pinning

Command Modules

Information Gathering

Network Discovery

Social Engineering

Exploit

Persistence

Prompt Fake Login Page

Redirect

Embed iFrames

Fake flash/browser Updates

Flash camera & Mic permission

Click jacking assist

Command Modules

Information Gathering

Network Discovery

Social Engineering

Exploit

Persistence

Several Device specific CSRF modules

Command Modules

Information Gathering

Network Discovery

Social Engineering

Exploit

Persistence

Foreground iframe

Popup Under

Man in the browser

Command Modules

Metasploit Integration

• Start msgrpc on metasploit

• Enable metasploit in config.yaml

• Configure BeEF with msgrpc username and pwd in extensions/metasploit/config.yaml

• Start beef

Tunnelling Proxy

• Doesn’t work like it used to thanks to same origin policy of browsers

• Make request in the context of the hooked browser.

BeEF API Example

• Authenticate

• List hooked browsers

• Make persistent (popup under)

• Determine the type of browser

• if browser.match(/^IE/) { add iframe with URL for Metasploit module ms10_046_shortcut_icon_dllloader}

Else

{execute a different module}