Hack any browser using BeEF

[parad0x]

 What is BeEF?

BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser. BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.


Step 1: Now.lets know how to use it. First we have to install it.So,in backtrack, navigate to Applications -> BackTrack -> Exploitation Tools -> Social Engineering Tools -> BEEF XSS Framework -> and select  BeEF Installer.

Step 2: After you have successfully installed it.Navigate to Applications -> BackTrack -> Exploitation Tools -> Social Engineering Tools -> BEEF XSS Framework -> and select BeEF  to start the server.The username and password are beef.
Step 3: Copy the highlighted link and paste in into your browser's url bar.





Step 4: Now send the  link to your victim(don't forget to shorten this ).
You'll find the link in the first para after signing in into the BeEF.




Once the user opens the link sent by us.We'll got his browser.
The compromised browser will be shown in the left hand pane.Like this one...Enjoy!!

[vezzy]

Thanks. I remember toying around with BeEF on Ubuntu a while ago. Tutorial could be more detailed, but decent job.

[parad0x]

Thanks. I remember toying around with BeEF on Ubuntu a while ago. Tutorial could be more detailed, but decent job.

Which part was left by me,vezzy?
Be more specific.

[kenjoe41]

seeing the different levels of expertise and experience we all have here, he meant that the tut could be more verbose to cover us all. all in all it was a great tut. keep up the spirit.

[techb]

BeEF seems pretty local. Meaning, be on the same network for this to work. Unless you did some port forwarding. In which case I would deff change the default port and un/pass. Since BeEF is a pen tool, I doubt rigorous fuzzing or exploiting has been done against it, so it can be vulnerable especially for outside attacks with the port forwards.

I do, however, like the hooking. Being just browser does by-pass a lot of other security layers, like NAT, firewalls, AVs, etc... With the new Java zero-day and a module for BeEF would be pretty nice. And with Metasploit plug-in-ability and all it could be a decent tool.

[Axon]

I find your tutorial to be quite similar to this.

[techb]

I find your tutorial to be quite similar to this.

Most all tuts for this tool are extremely similar, there's not much more you can do with it.

[ca0s]

BeEF seems pretty local. Meaning, be on the same network for this to work. Unless you did some port forwarding. In which case I would deff change the default port and un/pass. Since BeEF is a pen tool, I doubt rigorous fuzzing or exploiting has been done against it, so it can be vulnerable especially for outside attacks with the port forwards.

You can inject its payload with an XSS vuln, for example. Or append it to a website instead of defacing it But I don't know if SOP would prevent you from doing certain things...

[Daemon]

I find your tutorial to be quite similar to this.

All of the backtrack tutorials posted by him on here are like that, but then again it's like techb said, how else can you do it? At least he's trying to contribute i guess. Thank you for that Mr. Perfect

[parad0x]

I find your tutorial to be quite similar to this.

Well,a good site for newbies to learn how to use metasploit.I'll be posting a tut on how to use metasploit. I know there's one but that is not interesting.

[Axon]

Here's is a good tutorial on how to install BeEF on Windows.

http://www.hackingarticles.in/how-to-install-beef-in-windows-pc/

[Griffon Bossi]

im trying to get BeEF on windows using the tutorial axon gave but when i get to the point where i have to extract the devkit cmd keeps saying the path is unspecified. can someone help. i put the devkit into the ruby file and tried it in the c: however nothing is working. please help.

[proxx]

And getting metasploit to work on windows....
Good luck with that.
Not trying to be negative but it saves a lot of time doing this in a nix env.

[Griffon Bossi]

whats nix env?

[techb]

whats nix env?

Linux environment.