1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Hacking with BEeF

  1. Skyline Geek

    Skyline Geek Administrator Staff Member

    Likes Received:
    Trophy Points:
    Apr 11, 2017

    What is BEeF?
    When skids are asked what they use to hack Metasploit is the usual answer, mostly because they don't know any other way to do it. BEeF (I don't know what the lower-case e is for) stands for Browser Exploitation Framework is the equivelant to Metasploit for Browsers. In the land of Web-borne and mobile exploitation, BeEF focuses on one backdoor which is the web browser.

    How is BeEF used for hacking?
    Before being able to use BeEF's framework one must first "Hook" a browser, BeEF provides a hook URL that can be used. A popular way of Hooking a target is usually by putting the hook script into your webpage. After the target is "hooked" you can begin using the BeEF framework's many commands, including using metasploit.

    Running BeEF:
    The first thing you're going to have to do is CD to where BeEF is located, on Kali you can do this by inputing the code below:
     cd /usr/share/beef-xss
    then run the BeEF script
    This is the console output that should pop up after you run the script.


    I know it's a bit confusing but I'll elaborate, Hook UI is the interface where commands are sent and your list of zombies is viewed, we'll be looking into that in a bit. First we're going to talk about the hook URL which is what hooks the victim's browser. Below I'll put an example of some web code which should hopefully clarify how this hook URL is used.

    <script src="" type="text/java"></script>
    The above is an example of me injecting my hook url into an html page, I am sure this is not the only way to get someone to run your shit, Google or get creative with it.

    The BeEF Interface:
    Opening the BeEF UI URL will greet you with a browser interface and a log-in screen, the default username and password are both "beef". After logging in you'll be led to the interface where commands can be sent to hooked browsers.

    What the interface looks like. (open)

    One very important detail to look at is the traffic light system that BeEF uses to tell you what exploits work on the victim.
    • Green means that you can use this exploit on the victim without him knowing.
    • Orange means you can use an exploit but it may be visible to the target.
    • Red means the exploit CANNOT be used against the target.
    • Grey means the target hasn't been measured on this particular exploit.

    That concludes our introduction to BeEF, I hope you learned something from this thread as I had a lot of fun making it. I don't usually contribute shit because I'm lazy but hopefully that will change.

    Additional Reading:
    Source #LearnHacking
    1 People like this

Share This Page