null Bangalore Chapter - June 2014 Meet

1. -Prashanth Sivarajan
Prash.siv@gmail.com

2. What is BeEF?
BeEF is short for The Browser Exploitation Framework. It is
a penetration testing tool that focuses on the web browser.
Amid growing concerns about web-borne attacks against
clients, including mobile clients, BeEF allows the professional
penetration tester to assess the actual security posture of a
target environment by using client-side attack vectors. Unlike
other security frameworks, BeEF looks past the hardened
network perimeter and client system, and examines
exploitability within the context of the one open door: the
web browser. BeEF will hook one or more web browsers and
use them as beachheads for launching directed command
modules and further attacks against the system from within
the browser context.

3. How it works

4. UI Overview

5. Information Gathering
Network Discovery
Social Engineering
Exploit
Persistence
Command Modules

6. Information Gathering
Network Discovery
Social Engineering
Exploit
Persistence
Browser Fingerprinting
Detect Plugins
(Quicktime/VLC/Silverlight)
Host Fingerprinting
Detect logged in sessions
Command Modules

7. Information Gathering
Network Discovery
Social Engineering
Exploit
Persistence
Internal IP Address
Ping Sweep
DNS Enumeration
Port Scanning
Network Fingerprinting
NAT Pinning
Command Modules

8. Information Gathering
Network Discovery
Social Engineering
Exploit
Persistence
Prompt Fake Login Page
Redirect
Embed iFrames
Fake flash/browser Updates
Flash camera & Mic
permission
Click jacking assist
Command Modules

9. Information Gathering
Network Discovery
Social Engineering
Exploit
Persistence
Several Device
specific CSRF
modules
Command Modules

10. Information Gathering
Network Discovery
Social Engineering
Exploit
Persistence
Foreground iframe
Popup Under
Man in the browser
Command Modules

11. Metasploit Integration
• Start msgrpc on metasploit
• Enable metasploit in config.yaml
• Configure BeEF with msgrpc username and pwd in
extensions/metasploit/config.yaml
• Start beef

12. Tunnelling Proxy
• Doesn’t work like it used to thanks to same
origin policy of browsers
• Make request in the context of the hooked
browser.

13. BeEF API Example
• Authenticate
• List hooked browsers
• Make persistent (popup under)
• Determine the type of browser
• if browser.match(/^IE/)
{ add iframe with URL for Metasploit module
ms10_046_shortcut_icon_dllloader}
Else
{execute a different module}