X-BEE
BeEF
Browser Exploitation Framework for demonstrating real-world impact once an authorized XSS finding hooks a browser.
OVERVIEW
BeEF (beefproject.com, github.com/beefproject/beef) is a Ruby-based penetration testing framework that treats the web browser itself as the target. A small JavaScript "hook" — delivered through an authorized XSS finding, a client-side social-engineering test page, or another agreed injection point — registers the browser with the BeEF server, after which a tester drives it from a web-based control panel.
Once a browser is hooked, BeEF's module library demonstrates concrete impact rather than just flagging a theoretical bug: session and cookie exposure, browser and plugin fingerprinting, port-scanning the victim's internal network from their browser, and various social-engineering demo modules (fake prompts, redirects). It's widely taught alongside tools like Metasploit as the standard way to show what a client-side finding is actually worth in a report.
USE CASES
Practical use cases
- 01
Demonstrating the concrete impact of a confirmed, in-scope XSS finding beyond a proof-of-concept alert box.
- 02
Showing session/cookie exposure and browser fingerprinting from a hooked browser during a web-app engagement.
- 03
Running an authorized client-side social-engineering exercise to measure how staff respond to a hooked page.
- 04
Pivoting reconnaissance to a victim's internal network by port-scanning from inside their hooked browser.
QUICK START
After an XSS finding is confirmed and hooking is explicitly in scope, to demonstrate what an attacker could actually do with that hooked browser.
- Confirm hooking browsers is explicitly within the agreed scope and rules of engagement before running anything.
- Install dependencies and configure credentials/network settings in config.yaml.
- Start the BeEF server.
- Deliver the hook.js script through the authorized injection point (the confirmed XSS or agreed test page).
- Work from the web-based control panel to run modules against hooked browsers and record exactly what was executed for the report.
./beefBEFORE YOU RUN IT
What to check before running it
Hooking a browser is itself an intrusive action on a real user session — only do it within the explicitly agreed scope and consent of the engagement, never against out-of-scope users.
Demo modules (session capture, redirects, fake prompts) can affect the victim browser's session or state, so document exactly which modules were run, against which hooked browser, and when.
BeEF's hook.js and its callback traffic are a well-known indicator of compromise; tell the blue team in advance so hooked sessions are not mistaken for a real incident.