Skip to content

Information Gathering

Jack Walker edited this page Dec 30, 2019 · 23 revisions

So now, you have BeEF up and running, and you've hooked your first browser. What's the next step?

Your first step will often be to perform reconnaissance on the remote host. Which browser and plugins do they have running? Which website have you hooked?

Browser Fingerprinting

When a browser is hooked, BeEF will automatically gather several pieces of information on the hooked browser:

  • Browser name and version
  • Browser User Agent
  • Plugins (including Java, ActiveX, VBS, Flash...)
  • Windows size

Default information on the hooked browser gathered by BeEF :

You can then use different plugins to gather more detailed information on the browsers :

Result of the browser fingerprinting module :

Information gathering on the system

By using several modules, you can also gather information on the system of the hooked browser :

  • Internet Explorer has permissive restrictions allowing to detect softwares installed (module Detect Softwares) and even registry keys (caution, in this case the user will be prompted with an authorization message).
  • If the browsers authorize Java, the module Get Internal IP allows to detect the IP address of the system (funnier tricks with the network will be described later)
  • The module Get System Info uses also a Java Applet to gather detailed information on the system : operating system details, Java JVM details, IP addresses, amount of memory...
  • It is also possible to retrieve the location of the user whether by using the geolocation API or by using a trick requesting Google maps.
  • The default javscript API allows of course, to get the data stored in the clipboard.

Result of Get System Info module :

User's behaviour fingerprinting

The hooked browser also allows to discover several information on the behaviour of the user :


Previous | Next

Clone this wiki locally