How to Use BeEF and JavaScript for Reconnaissance « Null Byte :: WonderHowTo

Welcome back everyone. As many of you know, reconnaissance is extremely important in any successful hack. Without proper reconnaissance, we won't know what we're about to get into, literally.Among the vast ocean of information we need about our target, operating system isdefinitelyrequired. If we don't know the OS, we're half blind! The process of identifying our targets operating system is known as OS fingerprinting.Image viasecurityintelligence.comThere are many tools capable of OS fingerprinting, such asp0fandnmap, but today we'll be using a tool that isn't built specifically for recon,BeEF.BeEF stands forBrowser (Othere)ExploitationFramework. It allows us to "hook" into the victim's browser and cause all sorts of mayhem. You may remember that we'vepreviously used BeEFto take photos through a webcam. This is just a taste of what BeEF is capable of.The second part of today's recon isJavaScript, a powerful web development language. We'll be executing some JavaScript on our victim today. This will yield their OS. We'll simply be using BeEF as a means of execution. We'll be attempting to fingerprint a victim running Windows 10, so, let's get cooking!Step 1: Launch and Log into BeEFIf we're going to use BeEF, we might want to start it first! For those of you using Kali 2.0, BeEF is conveniently located on the dock to the side of the desktop:For those of you still using Kali 1.X, you can start BeEF with the following:Start BeEF with this command:service beef-xss startNavigate to the login page at 127.0.0.1:3000/ui/authenticationNow we all should be at the authentication page for BeEF, which should look something like this:Now, the default user name and password are bothbeef, let's log in with these credentials and start our recon!Step 2: Hook the VictimIn order for us to be able to execute our JavaScript, we need to "hook" the victim. Once we hook the victim, we'll be able to control their browser. BeEF has it's own demo hook page for testing, we'll be using this today. Let's start by looking at what browsers we currently have hooked:Alright, we can see here that we only have one victim, this was the victim from our last BeEF tutorial. Now let's go ahead and navigate our victim to the BeEF demo page:Now that we've loaded the demo page, we should see our victim appear under "Hooked Browsers" in our BeEF window:Now that we've successfully hooked the victim, we can control their browser. This includes the ability to execute JavaScript.Step 3: Execute the JavaScriptNow that we have our victim hooked, we can execute JavaScript against their browser. BeEF has many modules to control the victim, we'll be using the "Raw JavaScript" module, let's go ahead and navigate to it in our BeEF window:We've found our desired module, now let's take a look at the description:It simply tells us that whatever we script into the text field will be executed against the victims browser, it also comes with some sample code.Time to get a little technical; Most browsers support a JavaScript object called the "navigator", this object contains information about the browser and some information about the host, including operating system. We're simply going to be returning some information out of this object. More specifically, we're going to be reading the appVersion property, which will return our victims OS type. Let's go ahead and switch the sample code with the script to accomplish this:Now that we've added our little snippet of code, let's press the "execute" button at the bottom right of the BeEF window and evaluate our result!Step 4: Evaluate the ResultNow, we have our execution result, we just need to evaluate it. Let's select the command we just ran from the menu to the left and take a look at the returned result:In our result we can see the words "Windows NT 10.0". This is our user-agent string. It is normally used to properly respond to a host, but in our case, it tells a different story.We can do a very quick search for user-agent strings, and cross reference our result with what we find. When searching for "Windows NT 10.0", we can easily discover that this is the user-agent string for Windows 10! We've successfully identified our victims OS! Now, let's wrap all this up, shall we?Wrapping It UpThere we have it! We were first able to hook our victim with BeEF's demo page. Then we executed some JavaScript on their browser, which gave us the information we needed to make a conclusion about what OS they're using! We did it!There arefarbetter ways to fingerprint a victims OS, but this just shows that we can get creative with it. Creativity is essential in the mind of a hacker!Leave any questions and/or concerns you have in the comments below and I'm positive they'll be addressed.Thank you for reading!-DefaltWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedExploiting XSS with BeEF:Part 2How To:Hack Forum Accounts with Password-Stealing PicturesHow To:Hook Web Browsers with MITMf and BeEFHack Like a Pro:How to Get Facebook Credentials Without Hacking FacebookHow To:Advanced Penetration Testing - Part 1 (Introduction)Hack Like a Pro:How to Hack Facebook (Same-Origin Policy)How To:Use Javascript to make websites more interactiveHow To:Hack Web Browsers with BeEF to Control Webcams, Phish for Credentials & MoreNews:Make Apps for HoloLens in JavaScript with HoloJSHow To:Pull Italian Beef for Italian Beef SandwichHow To:Write an XSS Cookie Stealer in JavaScript to Steal PasswordsNews:How to Study for the White Hat Hacker Associate Certification (CWA)How To:Inject Coinhive Miners into Public Wi-Fi HotspotsHack Like a Pro:How to Hack Web Apps, Part 2 (Website Spidering with WebScarab)How To:Use the basics of the jQuery Javascript libraryHow To:Use JavaScript Injections to Locally Manipulate the Websites You VisitHow To:JavaScript Codecademy TutorialNews:Get YouTube's New Layout Today with a Simple JavaScript HackGoodnight Byte:HackThisSite Walkthrough, Part 9 - Legal Hacker TrainingNews:The Homepage of jQueryHow To:Reveal Saved Browser Passwords with JavaScript InjectionsNews:Fun Way to Learn JavaScript Basics!News:Top 10 Beef-less Burgers in LAHow To:How Cross-Site Scripting (XSS) Attacks Sneak into Unprotected Websites (Plus: How to Block Them)Forbes Exploited:XSS Vulnerabilities Allow Phishers to Hijack Sessions & Steal LoginsGoodnight Byte:HackThisSite Walkthrough, Part 3 - Legal Hacker TrainingHow To:Make Bourbon-Spiked ChiliNews:DCPU PacmanGoodnight Byte:HackThisSite Walkthrough, Part 4 - Legal Hacker TrainingHow To:Access Wikipedia During Today's SOPA BlackoutNews:Intel Core 2 Duo Remote Exec Exploit in JavaScript