repository·master·Indexed 27 days ago
https://github.com/beefproject/beefA penetration testing tool focused on web browser exploitation, allowing testers to hook browsers and use them as beachheads for command modules and attacks. Version 0.6.0.0 supports integration with Metasploit via BeEF Bind payloads and includes a DNS Rebinding extension. It requires Ruby 3.0+, Node.js 10+, and SQLite 3.x on Linux or macOS.
To use Metasploit BeEF Bind payloads, you must install a custom handler into your Metasploit Framework installation.
Note: The paths below assume a standard Kali Linux installation. Adjust the destination path if your Metasploit installation is located elsewhere.
sudo cp beef_bind-handler.rb /usr/share/metasploit-framework/lib/msf/core/handler/beef_bind.rbWhen writing specs for modules located under spec/beef/modules/**/<category>_spec.rb, the pattern involves walking every modules/<category>/**/module.rb file and generating an RSpec.describe block per class.
These baseline specs should cover:
.options returns an Array (if defined)#pre_send runs without raising (if defined)#post_execute runs without raising (if defined)#post_execute example using realistic datastore values provided by BeefTestConfig.branch_coverage_for(:category).Note: These are coverage-driving baselines meant to catch load failures and nil crashes; they do not assert behavioral correctness. For high-value modules, add targeted assertions.
To install the required operating system packages and all prerequisite Ruby gems, run the provided install script from the root of the repository.
$ ./installTo use the Firefox Extension Dropper module, you must place the specific binary you intend to drop and execute via the Firefox extension into the module's directory.
Important Constraints:
readme.txt file.To perform a DNS Rebinding attack, follow these steps:
Domain Setup: Register a domain (e.g., dnsrebinding.org) and set the NS (Name Server) record to the IP address where your BeEF DNS server is running. (For testing, services like freedns.afraid.org can be used).
Extension Configuration: Configure the DNS Rebinding extension settings (address_http_internal, address_http_external, address_proxy_internal, address_proxy_external, and port_proxy) as described in the extension configuration guide.
Module Configuration: In the BeEF UI, open the DNS Rebinding module and set the domain configuration. This adds the necessary DNS rule to the BeEF DNS database.
Hook the Victim: Deliver a link containing your registered domain (e.g., http://dnsrebinding.org) to the victim.
Execute Attack: In the BeEF UI, open the DNS Rebinding module for the hooked browser. Enter the victim's target LAN IP (e.g., 192.168.0.1) in the target field and launch the module. This adds a double A record to the BeEF DNS database and sends the malicious JavaScript.
Access Target Content: Once the attack is active, access the target's content via your browser using the proxy URL format:
http://<address_proxy>:<port_proxy>/<path>
Example: If the target IP is 192.168.0.1 and you want to access login.php, use http://<address_proxy>:81/login.php.
Before installing BeEF, ensure your environment meets the following requirements:
Gemfile must be installed.Once installed, you can use msfvenom to verify the installation and generate various payload formats.
List available payloads to ensure beef_bind is present:
msfvenom -l payloads | grep beef_bindTo dump both the stager and stage in C format:
msfvenom -p windows/beef_shell/beef_bind --format CTo dump the stager in raw format:
msfvenom -p windows/beef_shell/beef_bind R > beef_bind-stagerTo encode the stager to remove null bytes (\x00):
msfvenom -p windows/beef_shell/beef_bind R --bad-chars '\x00' > beef_bind-stager-nonullWhen using the Web Cloner extension, BeEF generates two files for every cloned site: an original unmodified version (site_name) and a modified version (site_name_mod).
To manually customize a cloned page and serve your own version through BeEF, follow these steps:
_mod file (e.g., beefproject.com_mod) in the extensions/social_engineering/web_cloner/cloned_pages/ directory._mod file."use_existing":"true" in your API call. This instructs BeEF to serve your modified _mod file instead of generating a new one.You can make executables, JARs, or browser extensions available on the BeEF server by mounting local files to a specific URL path using the /api/server/bind endpoint. This allows you to host files (e.g., bin.exe) at a predictable location like http://beefserver/bin.exe for use in social engineering attacks.
To upload a file, send a POST request to the /api/server/bind endpoint with a JSON payload containing the desired mount path and the local_file path on the BeEF server.
curl -H "Content-Type: application/json; charset=UTF-8" -d
'{"mount":"/bin.exe", "local_file":"/extensions/social_engineering/droppers/bin.exe"}'
-X POST http://beefserver/api/server/bind?token=<token>After a successful installation, you can start the Browser Exploitation Framework by executing the beef script.
$ ./beefCoverage can be generated using rake tasks or by setting the COVERAGE environment variable with rspec.
Supported coverage focus areas:
core: Framework core functionalityextensions: Extension modulesmodules: Command modulesall: Complete coverage across all areasHTML reports are generated in the coverage/ directory.
# Complete coverage (recommended)
bundle exec rake coverage
# or
COVERAGE=all bundle exec rspec spec/ --tag '~run_on_browserstack' --tag '~run_on_long_tests'
# Component-specific coverage
bundle exec rake coverage_core # Core only
bundle exec rake coverage_modules # Modules only
bundle exec rake coverage_extensions # Extensions onlyTo run the BeEF test suite, ensure you have the following prerequisites installed:
GemfileConfiguration files include spec/spec_helper.rb (main configuration), .simplecov (coverage configuration), and utilities located in spec/support/.