Framework Initialization and Configuration

The Browser Exploitation Framework (BeEF) is a penetration testing tool that focuses on web browser vectors. It allows security professionals to assess the security posture of a client-side environment by hooking browsers and launching module-based attacks. The framework is typically written in Ruby and provides a graphical interface for command and control.

To deploy the framework, install the package and modify the core configuration file to bind the service to the local network interface. This ensures the management panel is accessible from other devices on the subnet.

# Installation via package manager
sudo apt-get install beef-xss

# Configuration path
/opt/beef-xss/config.yaml

Update the configuration file to reflect the local IP address of the host machine. Once configured, navigate to the framework's directory and execute the main script to start the server.

cd /opt/beef-xss
./beef

Upon startup, the console displays critical information, including the Hook URL (used to inject the JavaScript into targets), the UI URL (the administration panel), and the RESTful API token required for remote interactions.

Website Cloning via API

The framework includes a RESTful API endpoint that facilitates the cloning of external websites. This feature is useful for creating deceptive replicas of legitimate login pages. By sending a POST request with the target URL and a desired mount path, the server creates a local copy of the specified site.

The following structure demonstrates the API request logic using shell variables to enhance readability and modifiability:

#!/bin/bash

# Define variables
TARGET_SITE="https://www.example.com"
MOUNT_POINT="/phishing_mirror"
BEEF_HOST="192.168.1.105:3000"
API_KEY="your_generated_api_token_here"

# Execute clone command
curl -H "Content-Type: application/; charset=UTF-8" \
     -d "{\"url\": \"${TARGET_SITE}\", \"mount\": \"${MOUNT_POINT}\"}" \
     -X POST \
     "http://${BEEF_HOST}/api/seng/clone_page?token=${API_KEY}"

If the request is successful, the cloned site will be available at the specified mount path on the BeEF server. Note that resource loading may vary depending on the target site's content security policies.

Credential Harvesting and Data Interception

When a target interacts with a cloned page—specifically a login interface—the data submitted via forms is intercepted by the framework. For instance, if a tester clones the login portal of a vulnerable training environment (like a deliberately weak XSS lab) and a user attempts to authenticate, the credentials are captured.

To capture this data, access the administration dashboard and navigate to the "Logs" tab. Here, all form inputs and HTTP requests initiated by the hooked browser are recorded in real-time, allowing the tester to retrieve usernames and passwords.

Session Hijacking via Blind XSS

In scenarios where Blind XSS vulnerabilities exist, the hook script can be injected into fields that are processed by an administrator or another user later. Once the script executes in the victim's browser, the target appears in the framework's "Hooked Browsers" list.

To perform session hijacking, select the active browser session from the dashboard. Navigate to the "Commands" module and search for cookie-related functionalities. Selecting the "Get Cookie" module and executing it forces the hooked browser to return its current session tokens. These tokens can then be used to bypass authentication mechanisms on the target application.