Exploitation Tools

beef

beef — the Browser Exploitation Framework — attacks from inside the browser. Once a target loads a page carrying BeEF’s hook script (delivered through an XSS flaw, a phishing page, or a man-in-the-middle), that browser is “hooked” and appears in BeEF’s control panel, where you can run a large library of command modules against it: fingerprint the browser and its plugins, capture keystrokes, launch social-engineering popups, pivot into the internal network the browser can reach, and more. It’s the tool that makes the browser itself the beachhead.

Installed from the AUR (as beef-xss); Security → Exploitation Tools → beef. BeEF runs its control panel and hook server together — running it is the action — so Oniomarchy starts it directly. It’s also available as a toggleable service; see Running Services.

Before it will start

BeEF ships with the default credentials beef / beef, and it deliberately refuses to start while those are unchanged — a safety catch, since it binds its panel to all interfaces. Edit /usr/share/beef-xss/config.yaml and change beef.credentials.user and beef.credentials.passwd before first use, or BeEF exits immediately with Default username and password in use!.

Using it

  1. Set your credentials in the config file as above.
  2. Start BeEF — it prints the hook URL (http://<you>:3000/hook.js) and the control-panel URL (http://<you>:3000/ui/panel).
  3. Get a target to load the hook — through an XSS payload, a crafted page, or in the lab, BeEF’s own demo page.
  4. Drive hooked browsers from the panel: each one appears in the “Online Browsers” tree, and the Commands tab lists the modules you can run against it, color-coded by how likely they are to work and how visible they’ll be.

BeEF pairs naturally with the Social Engineering Tools — a convincing phishing page is the usual delivery vehicle for the hook.