BeEF

BeEF (Browser Exploitation Framework) is a penetration testing tool that focuses on web browsers. It hooks browsers through XSS injections and uses them as beachheads to launch client-side attacks, steal credentials, and assess browser security.

BeEF hooks a browser by injecting a JavaScript file (hook.js) into a web page, typically through an XSS vulnerability or malicious link. Once loaded, the browser communicates with the BeEF server and becomes controllable through the web UI.

BeEF can hook most modern browsers, but its capabilities depend on the browser and installed plugins. Internet Explorer typically provides the most module options, while modern Chrome and Firefox have stronger security boundaries.

BeEF is legal for authorized penetration testing and research. Hooking browsers without consent is illegal and violates computer fraud laws. Always use in controlled lab environments or with explicit authorization.

Browser hooking is the process of injecting BeEF's hook.js script into a victim's browser, establishing a communication channel that allows the attacker to execute commands and modules against the hooked browser.

BeEF leverages XSS vulnerabilities to inject its hook.js script into target browsers. Once hooked, BeEF can execute over 400 command modules for data theft, network scanning, and social engineering.

BeEF provides 400+ command modules including credential theft, keystroke logging, screenshot capture, network scanning, social engineering dialogs, browser fingerprinting, and Metasploit integration.

BeEF can maintain persistence through re-hooking techniques, persistent XSS, and browser extension installation, though modern browsers have security features that limit long-term persistence.

BeEF can use various evasion techniques including payload encoding, traffic obfuscation, and HTTPS for hook communication, though modern security software may still detect hook.js injection.

Yes, BeEF works with modern browsers, but some modules may be restricted by security features like Content Security Policy, SameSite cookies, and sandboxing in newer browser versions.

Generate an SSL certificate and configure BeEF in /etc/beef-xss/config.yaml to use HTTPS. Modern browsers block HTTP hook scripts on HTTPS pages, so HTTPS hooking is required for secure targets.

Yes, BeEF integrates with Metasploit for advanced post-exploitation. Load the integration with: msfconsole -r /usr/share/beef-xss/modules/msf.rc. This enables system-level attacks through browser hooks.

BeEF provides 400+ command modules organized by category: browser, network, social engineering, exploitation, and persistence. Modules range from simple browser fingerprinting to complex Metasploit exploitation chains.

Yes, BeEF can use hooked browsers as network proxies to scan internal networks, access internal web applications, and capture traffic through the browser's network connection.

Configure the port in /etc/beef-xss/config.yaml or use the -p flag: beef-xss -p 3001. The web UI and hook server run on the specified port.

Yes, BeEF includes keylogging modules that capture keystrokes from hooked browsers. The hook.js script intercepts keyboard events and sends them back to the BeEF server in real-time.

BeEF typically requires an XSS injection point. Alternatives include social engineering (luring users to a page with the hook), browser extension installation, or combining with tools like SET for phishing delivery.

Yes, BeEF fingerprints the hooked browser including installed plugins, extensions, screen resolution, operating system, and other client-side information through JavaScript detection techniques.

Press Ctrl+C in the BeEF terminal or use kill $(pgrep beef) to stop the server. BeEF gracefully shuts down and disconnects all hooked browsers when stopped.