BeEF

Browser exploitation framework: hooks victims through XSS.

A framework that turns an XSS into interactive control of the victim's browser. The payload injects `hook.js`, which opens a permanent channel to the BeEF panel; from there you launch modules against that browser: steal cookies and page content, take screenshots, show fake credential dialogs, scan the internal network from inside the browser or proxy requests through it. It is the demonstration of why a "merely reflected" XSS is not a minor finding.

Family Web exploitation

Flags hook.js (panel en 3000)

Concepts Blind XSS (Bot & Exfiltration), DOM-based XSS, Session Fixation

Cheatsheet XSS (Cross-Site Scripting)

Installation

sudo apt install -y beef-xss
# start it (first run asks you to set the admin password):
sudo beef-xss
# panel: http://127.0.0.1:3000/ui/panel   |   hook: http://<ip>:3000/hook.js

Repositorygithub.com/beefproject/beef

Useful commands2 commands

Reference tool: it does not yet appear in a published machine on the blog, but it is part of the arsenal for its everyday use.