Information Gathering
So now, you have BeEF up and running, and you've hooked your first browser. What's the next step?
Your first step will often be to perform reconnaissance on the remote host. Which browser and plugins do they have running? Which website have you hooked?
When a browser is hooked, BeEF will automatically gather several pieces of information on the hooked browser:
- Browser name and version
- Browser User Agent
- Plugins (including Java, ActiveX, VBS, Flash...)
- Windows size
Default information on the hooked browser gathered by BeEF :
You can then use different plugins to gather more detailed information on the browsers :
- The module Browser Fingerprinting uses custom url to identify the browser. It can be useful if the user has changed its user agent.
- You can complete the list of plugins with the modules Detect Firebug, Detect popup blocker, Detect Google Desktop, Detect unsafe ActiveX...
Result of the browser fingerprinting module :
By using several modules, you can also gather information on the system of the hooked browser :
- Internet Explorer has permissive restrictions allowing to detect softwares installed (module Detect Softwares) and even registry keys (caution, in this case the user will be prompted with an authorization message).
- If the browsers authorize Java, the module Get Internal IP allows to detect the IP address of the system (funnier tricks with the network will be described later)
- The module Get System Info uses also a Java Applet to gather detailed information on the system : operating system details, Java JVM details, IP addresses, amount of memory...
- It is also possible to retrieve the location of the user whether by using the geolocation API or by using a trick requesting Google maps.
- The default javscript API allows of course, to get the data stored in the clipboard.
Result of Get System Info module :
The hooked browser also allows to discover several information on the behaviour of the user :
- By using javascript tricks, it is possible to detect if the browser has already visited a given URL or a given domain.
- Two modules can be used to know if the user is logged on social networks, and if the user uses TOR.
