Monday, December 31, 2012

BeEF Shank - BeEF MitM for Pentests

Happy New Year, everyone!

This guest post is brought to you by Ryan Linn.

At BlackHat Briefings this past summer, Steve Ocepek and I released Ruby code that would assist folks who want to use BeEF on internal penetration tests. Some may wonder, why would you want to do that? More and more internal resources are moving to Sharepoint, tools moving to web based intranet sites, and personal information moving away from mainframes and thick clients into web clients with database back-ends. Being able to attack the browser effectively on internal tests is going to become more crucial in giving realistic feedback on potential impact of an intrusion.

So our goal at BlackHat this year was to demonstrate how to effectively utilize the browser among local machines on the network. We created two tools to help utilize BeEF effectively on internal tests. The first was a tool called shank. Shank is an ARP Spoofing tool used to execute smarter Man-In-The-Middle (MITM) attacks injecting the BeEF hook into browsers surfing on the network.


Shank has two distinct parts. The first part is the MITM engine that begins by ARP spoofing the local network. Once the network has been successfully poisoned, shank begins polling the local BeEF instance to determine which browsers are already hooked. If shank sees a web response destined for a poisoned client that hasn’t already been hooked by BeEF, shank will insert the BeEF hook into the response. Once the browser is hooked, shank won’t inject another response until the BeEF hook is lost.  This ensures that while the browser is actively browsing the web, it will stay hooked by shank.

So where do we go from here? Once we have a browser hooked, we want to get as much information as we can from each browser.  BeEF lets us auto-run one module for each browser, but what if we wanted to do a large amount of fingerprinting for each browser we hook. This is where the autorun.rb comes into place.  For each browser we hook, we check in autorun.rb to detect if this is a new hook. If it is a new hook, we have an array of modules that we want to run against the hooked browser.

These modules can do anything from figure out what version of Java and Flash is running, to determining all the interfaces on a machine to determine if a VPN session is active or if a host is multi-homed. Based on that logic, and since this is all in Ruby, additional logic can be added for reactions based on the fingerprints such as auto-launching MSF modules, or other types of attacks based on versions of Flash or the presence of VPN interfaces. This increases the functionality of BeEF through external triggers thanks to Michele’s REST API interface.

Leveraging these tools can greatly enhance your internal penetration tests, and this is a proof of concept to help with internal tests. If you want to try any of this out for yourself, you can get the code at github. I also encourage you to checkout the whitepaper.

If you have any suggestions for other things to add to BeEF, feel free to add them to our feature tracker, and we’ll take a shot. If you’d like to help out with BeEF let us know!

92 comments:

  1. Hi great stuff!

    I was thinking that if you this type of attack could be integrated in BeeF?
    http://resources.infosecinstitute.com/slaac-attack/

    thk

    ReplyDelete
    Replies
    1. Kitchen Appliances That Do Most of the Work for You · The Waffle Maker Product, Electronic device, Technology, Output device, what best kitchen appliances work best for your kitchen, your family and your lifestyle can be a challenge. Carefully consider these expert kitchen .

      Delete
  2. Thankful such an awesome sum for sharing this glorious information! I am envisioning see more posts by you. I like visiting you site since I always come across interesting articles like this one. Great Job, I greatly appreciate that. Do keep sharing! Your information is good and friendly this article very helpful for me. Thanks for the post. After seeing the following post, I totally inspire from you and your blogs also respectively. It was nice articles and I also very enjoyed after read this. Thanks a lot sir. Visit: Best essay writing service

    ReplyDelete
  3. * Jual Obat Aborsi,,
    * Obat Aborsi,,
    * Obat Penggugur Kandungan,,
    * what I have read on this page is enough to make me satisfied can menik die this article thanks greetings *

    ReplyDelete
  4. Writing an essay? Start with a good hook. Looking for some good hooks for essays? Click on a link!

    ReplyDelete
  5. how to enable hey cortana in windows 10 hello cortana' is a feature on Windows 10 that lets your personal assistan

    ReplyDelete
  6. I have read very important topics write my essay about the client resources. They are issued many updates on your work place for innovations. so we are given this article to reviews in online and thankful to have the great services.

    ReplyDelete

  7. افضل شركات الاثاث المستعمل
    قد يحتاج البعض إلى شراء بعض قطع الأثاث اللازمة في المنزل لكن عند البحث في المحال التجارية يجدون أن الأسعار باهظة بشكل غير معقول لذلك قد يفكر الكثير من الأشخاص اللجوء إلى شراء الأثاث المستخدم والذي يكون في حالة جيدة لكن قد تنتابهم الحيرة في معرفة الشركة التي لا بد من التوجه إليها للبحث عن قطع الأثاث المناسبة ولماذا كل ذلك فكل ما عليك هو التواصل مع شركة شراء اثاث مستعمل والتي عادة ما توفر جميع قطع الأثاث التي يرغب في اقتنائها جميع العملاء مهما اختلفت طبقاتهم المجتمعية فجرب ذلك الأمر بنفسك ونعدك بأنك لن تندم أبداً على ذلك الاختيار.
    شراء الاثاث المستعمل بالدمام
    شراء اثاث مستعمل
    ارقام الاثاث المستعمل
    اتخاذ القرار الحاسم بالتوجه إلى جهة معينة لشراء الأثاث المستعمل منها أمر ليس سهل إطلاقاً لكن عندما يكون لديك خلفية معرفية عن كل شركة فهذا بالطبع سيساعدك على اختيار ما هو أفضل لك ولكل أفراد أسرتك لذلك فسنطلعك في النقاط التالية على أهم المميزات التي تمتلكها شركة شراء اثاث مستعمل وذلك لكي تطمئن في حالة التعامل معها:
    • توفير جميع أنواع الأثاث اللازم لكل منزل مثل غرف النوم وأطقم الصالونات والأنتريهات هذا بالإضافة إلى المجالس وغرف النوم الخاصة بالأطفال.
    • يوجد بشركتنا المتميزة العديد من أجهزة الحاسب الآلي وتتميز باختلاف أحجامها وأنواعها وأسعارها وهذا لكي تناسب جميع عملائنا الكرام.
    • إذا كنت تبحث عن شراء الأجهزة الكهربائية المنزلية مثل الثلاجات وأجهزة التكييف ففي شركتنا ستجد أنواع متميزة لا حصر لها يمكنك اختيار ما يحلو لك منها.
    • يمكنك من خلال شركتنا المتميزة شراء جميع أدوات المطبخ مثل غسالات الأطباق وأفران الميكروويف والأفران العادية.
    • لا تخشى عملية نقل الأثاث إلى منزلك حيث أن شركة شراء اثاث مستعمل توفر العديد من الشاحنات ذات الأحجام المختلفة لمساعدتك في نقل جميع الأثاث الذي قمت باختياره وشرائه إلى منزلك بشكل آمن.
    • خدمة العملاء التابعة لنا تعمل على مدار 24 ساعة وهذا لاستقبال جميع اتصالاتكم الهاتفية وكافة استفساراتكم.
    • يتم عرض جميع الأثاث المتوفر لدينا بشكل مرتب ومنظم هذا بالإضافة إلى أن أسعارنا لا يوجد لها منافس.

    شراء الاثاث المستعمل
    شراء اثاث
    حقين الاثاث المستعمل

    ReplyDelete
  8. Students could often find it tough to write their academic tasks. It could lead to they not getting desired grades in the academics. Opting for our Assignment help could be ideal for such students and they can get a complete assignment solution from us.

    ReplyDelete
  9. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  10. All Assignment Help is a web portal where students get help in making assignments for all the subjects, with the help of our experts. You will get 100% plagiarism free assignment. Expertes consultation is also available for students. If they have any query they can contact with our experts anytime.

    ReplyDelete
  11. Those who are searching over internet matlab assignment help can contact with us now. We are the best assignment writing service provider in melbourne, Australia. Our Academic assignment writers available 24*7 hours for the students, if you really want to need IT assignment help, java assignment help, programming assignment help, r programming assignment help, case study assignment help online at cheapest price and get high distinction grades.

    ReplyDelete
  12. Searching out a penetration trying out a framework to offer protection awareness? Strive for the browser exploitation framework. The ability to modify content transferred between two hosts the usage of the guy inside the center (mitm) assaults is a network attack vector. Info Knowledge Shared by Do My Dissertation Help Cheap | All Assignment Help Australia

    ReplyDelete
  13. Thank you for your post, I look for such article along time. And do you want to leave the virtual worth yourself? If you want, let go to the game sims 4 cheats. Click link to participate game.

    ReplyDelete
  14. Nice article this post is very useful to every people
    Thank You
    You Check Also Read This Post :- best anime streaming sites

    ReplyDelete
  15. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check buyfbpagelikes.com and check my work

    ReplyDelete
  16. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check unblockedgames.life and play any game

    ReplyDelete
  17. very nice post and detail work done by the article and it shows how good you are in writing good stuff please kisscartoon and watch any cartoon you want

    ReplyDelete
  18. very nice post and detail work done by the article and it shows how good you are in writing good stuff please check kik usernames and find all kik users

    ReplyDelete
  19. This article is really fantastic and thanks for sharing the valuable post.
    red ball 4

    ReplyDelete
  20. Why we rank the best in offering professional custom writing services is the quality services that are offered to the thousands of clients that contract our organization for the provision of quality custom dissertation writing service.

    ReplyDelete
  21. I think you had put 1000% in this post that's why this post is something different and knowledgeable for all of us. Thanks for this.
    Attitude Status
    Instagram Bios for Girls

    ReplyDelete
  22. That's An Amazing post where you share Awesome knowledge. So thank you.
    ViralVilla

    ReplyDelete
  23. Our Custom Essay Services is the best and highly ranked by students because of our dedication to keeping the promise. Whatever you read from the website about us is true,and we are committed to delivering well prepared papers to meet your entire write my Top Essay Writing Service academic needs.

    ReplyDelete
  24. Keep writing such kind of info on your blog. Im really impressed by your blog.
    driving games

    ReplyDelete


  25. the article and it shows how good you are in writing good stuff please check buyfbpagelikes.com and c
    http://www.robbiramdhani.web.id/

    ReplyDelete
  26. 4 As well as the transport company in Najran has cars and trucks capable of transporting luggage easily, and for all these advantages you must deal with furniture transport company in Najran as the best transport company in Najran.
    شركة نقل عفش
    شركة نقل اثاث من الرياض الى قطر
    شركة نقل عفش من الرياض الى قطر
    شركة نقل عفش بالخبر

    ReplyDelete
  27. A well-written Literature Review for Dissertation contains a title, abstract, introduction, literature review, methods, results, discussion and references. The company offers Research Paper Writers for Hire to the Customers.

    ReplyDelete
  28. It is a great article. You will surely like this also because it is a great stuff
    http://bit.ly/31MuA4O

    ReplyDelete
  29. I really like touring your site due to the fact i continually come across thrilling articles like this one. the incredible task, I greatly respect that. do maintain sharing! your statistics is right and pleasant this text very useful for me. they are issued many updates to your painting's vicinity for improvements. so we are given this Cheap Essay Writing text to critiques in online and grateful to have the great offerings.

    ReplyDelete
  30. Recall whilst meeting people to pentest web www.6DollarEssay.com apps and log-ins you needed to fire penetration testing and protection discussion. Intercepting passwords and forwarding statistics.

    ReplyDelete
  31. Thanks for sharing this information Upsers

    ReplyDelete
  32. We provide AllAssignmentHelp to students of any college in their United States. Our all students are also given 2-4 * 7 support and service. Best Biology Dissertation Help Online

    ReplyDelete
  33. Accept the quick help you require from our skillful economics Don’t accentuate about thinking nominal GDP on your private—our expert economics homework help online can help you answer the difficulties you are working with on your time. economics homework help online

    ReplyDelete
  34. The content of this article page, I find the content quite interesting and useful to me, thank you for sharing http://drawmything.games/dupligon

    ReplyDelete
  35. In my opinion, the issues you raise are still some unclear. I hope in the near future to read more articles from you apkxyz

    ReplyDelete
  36. AllHomeworkHelp gives an online service of 24 hours of receptiveness to understudies. Through this, the understudies can at whatever point look for help from online associations.
    chemistry homework

    ReplyDelete
  37. We created two tools to help utilize BeEF effectively on internal tests.

    this article

    ReplyDelete
  38. ساندویچ پانل، یا ساندویچ پنل و یا همینطور پنل ساندویچی سازه ای پیش ساخت و مدرنی است که به دلیل ویژگی های بیشمارش در حال جایگزین شدن به جای مصالح سنتی و قدیمی در علم ساختمان سازی امروزه است. البته کاربرد ساندویچ پانل به ساختمان سازی محدود نمی شود.

    پانل ها دارای سه لایه هستند، دو لایهء اطراف ساندویچ پانل را ورق ها تشکیل می دهند و هسته و مرکز ساندویچ پانل را در بر می گیرند. هسته این سازه پیش ساخته نیز از فوم ساخته شده است. از ویژگی های ساندویچ پانل می توان به: سهولت در نصب و در نتیجه پایین آورنده زمان پرژوه، عایق صدا، عایق حرارت، عایق سرما، عایق در برابر رطوبت، مقاومت بالا در برابر خوردگی و زدگی، انعطاف پذیری بالا، مقاومت در برابر کپک زدگی و نفوذ حشرات و ایجاد محیطی بهداشتی، مقاوم در برابر زمین لرزه، تحمل بار بالا، خاصیت رنگ پذیری، قابلیت شستشو، قیمت بسیار مناسب و مقرون به صرفه بودن آن نسبت به محصولات سنتی، عدم نیاز به زیر سازی، بوجود آورنده ی نما و ظاهری زیبا و.. اشاره کرد.

    ReplyDelete
  39. It's very good post which I really enjoyed reading. It is not everyday that I have the possibility to see something like this.
    apk here

    ReplyDelete
  40. Thank you for sharing this wonderful article, And it is very useful information norton.com/setup
    www.norton.com/setup

    ReplyDelete
  41. Really great article, Glad to read the article. It is very informative for us. Thanks for posting www.norton.com/setup
    norton.com/setup

    ReplyDelete
  42. My silver Service deserves a little Silver Service occasionally, travel in a luxurious, wheelbase sedan with an experienced driver who’ll get you there in style.
    silver top silver service

    ReplyDelete
  43. BeEF is pioneering techniques that provide practical client side attack vectors.

    1playergames66

    ReplyDelete
  44. Various sorts of assignments making endeavors to ensure the broad headway of data and fitness of the understudies.
    Assignment Help Online
    Write My Assignment
    business essay

    ReplyDelete
  45. I really happy found this website eventually. Really informative and inoperative, Thanks for the post and effort! Please keep sharing more such blog.
    norton online help

    spectrum email login

    kaspersky activation

    ReplyDelete
  46. Very helpful advice in this particular post! It’s the little changes that make the largest changes. Thanks for sharing!
    mobile link

    ReplyDelete
  47. Dear admin thank you so much for sharing this informative information with us, it's really useful for me. your blog is amazing. I wish you all the best for future comments. I have read it and I have also something here to share with you. norton.com/setup
    www.norton.com/setup, Norton product key

    ReplyDelete
  48. Just speaking, I am a narrator a craftsman who paints pictures with words cleared into creation by the intensity of a pen.

    whiteboard animation video

    ReplyDelete
  49. My silver Service understands the importance of educating our drivers on transporting passengers with assistance animals. Assistance animals are welcome in all Silver Service taxis and count as 1 passenger.
    taxi silver service Melbourne

    ReplyDelete
  50. We take your order with your complete instruction to write an essay just the way you need it.
    Writing Service

    ReplyDelete
  51. Thanks for sharing this post.It is very informative and helpful.
    I like this blog very much, Its a very nice billet to read and incur Info.

    office.com/setup
    office.com/setup

    ReplyDelete
  52. The information you have posted is very useful. I really enjoy reading and also appreciate your work. Please keep inspiring more readers!
    software developer
    freelance software development
    virtual assistant

    ReplyDelete
  53. The most significant thing was that the logo completely lived up to my desires and client assistance's was great. This vender has my suggestion!
    How To Design Logo

    ReplyDelete
  54. In our papers the body paragraphs support the thesis statement, with each body paragraph elaborating on one supporting point.
    Ebook Writing Service UK

    ReplyDelete
  55. We providing Case Study Help including all subjects like Law Case Study, Organizational Behavior Case Study, Marketing Case Study, HR Functions Strategy Case Study, History Case Study & more writing services.

    ReplyDelete
  56. TreatAssignmentHelp is dedicated to provide online Web Designing Assignment Help for students who is perusing degree or diploma courses in universities. We have 24/7 Customer live support where you can discuss about your troubles with our specialized writers. We pioneer the custom writing industry due to the flair and subject expertise of our pool of writers who promise to deliver 100% plagiarism free papers.For more service : Law Dissertation Help

    ReplyDelete
  57. The best online football betting website in Thailand, Vegus168 Baccarat, Slots, Roulette, Hi-Lo, Fish Shooting Games, Dragon Tiger cards, complete online gambling, open 24 hours a day.

    ReplyDelete
  58. Dear admin I really like the way you have to describe this blog it is awesome. All information is very informative I really appreciate your effort toward the reader. Thank you so much for this amazing content and I have also something to share here. www.office.com/setup, Office product key, office.com/setup

    ReplyDelete
  59. Aquiring the services of Supply Chain Assignment Help from Professional Assignment Writers Online provide you with free time to concentrate on other task. The company also offers any type of PowerPoint Writing Services Online that are custom made.

    ReplyDelete
  60. Wales publications research grant UK breaks the barrier to getting the research from the developing countries and by publishing their research in international journals and encounter the issues that researcher faces across all developing countries,
    by providing them active opportunities to fill the gap between the scientific knowledge and new technology development.

    ReplyDelete
  61. Wales Publications is a research publishing solution provide best Publication Research In UK
    in all issues from research to the journal publication are catering in your discipline based on your requirements.

    ReplyDelete
  62. Very impressive blog post, I subscribed your blog for your future post. I also have some useful link to share here mcafee activate |

    mcafee.com/activate |

    norton.com/setup |

    norton setup |

    office.com/setup |

    hp support assistant |

    ReplyDelete
  63. Good Work, i like the way you describe this topic, keep going. i would like to share some useful security links here please go through www.mcafee.com/activate |

    www.norton.com/setup |

    www.office.com/setup |

    office setup |

    hp printer drivers |

    hp printer support number |


    ReplyDelete
  64. This is really great work , Thank you for sharing such a useful information here in the blog. I have something to share here mcafee download |

    norton download |

    microsoft office download |

    office download |

    hp printer installation |

    ReplyDelete
  65. Watch Unlimited Movies, TV Shows & Get Free Shipping Benefits with Amazon Prime. Watch Latest & Exclusive Bollywood, Hollywood Movies, US TV & Kids Shows. Multiple Devices. High Quality. No Ads. Low Data Usage.
    www.primevideo.com/mytv
    www.primevideos.com/mytv
    www.primevideo.com/mytv register code
    www.primevideo.com/mtv
    www.primevideo.com

    ReplyDelete
  66. If you are a scholar pursuing nursing and is having an issue executing their assignment then you eventually have come to the ideal arena. Get help with our skilled Nursing Assignment Help Australia and obtain increased grades while not averting your studies.

    ReplyDelete
  67. Amazon Prime is a first class Television Based App feature giving a great deal of on-request and live films and TV shows, particularly with no ads. Amazon Prime gives clients moment admittance to a few sorts of current shows from all the large communicating networks in the U.S. The enrollment gives supporters boundless motion pictures, current just as past mainstream TV shows. Amazon Prime is a comprehensive amusement channel on Amazon Prime Tv.

    www.primevideo.com/mytv
    www.primevideo/mytv
    www.primevideo.com/mytv register code

    ReplyDelete
  68. Thanks for announcing and reviewing these tools, I think they will be useful for many cyber security testers. Both tools deserve attention to be introduced into my collection of tools for pentesting, and I also agree with you that now any industry is moving into the web space, so you need to look towards using tools that involve both the client side and the server side for pentests. Penetration testing (Pentest) is a method of assessing the security of computer systems or networks by means of simulating an attack by an attacker. The process includes an active analysis of the system for potential vulnerabilities that can provoke incorrect operation of the target system, or a complete denial of service. For readers who have never heard of this type of testing, I advise you to look on YouTube for videos in which famous cybersecurity experts talk about this type of testing. I found there quite a lot of videos on this topic and noticed that most of them were posted by channels to which at least 52 thousand subscribers were subscribed! I am sure this is because the owners of such channels often use the services of https://soclikes.com/ in order to wind up subscribers on YouTube.

    ReplyDelete
  69. Make your daily life passionately amazing with Guwahati escort and call girl services.
    Romance is not a simple factor that you can bargain with.
    Escorts in Guwahati
    Escort services in Guwahati

    ReplyDelete
  70. Explore the profiles of guwahati escorts, guwahati call girls, call girls in guwahati
    and escorts in guwahati for female companionship in top rated hotels.
    Get affordable escort services in guwahati hotels now.
    College escorts in Guwahati |
    Housewife escorts in Guwahati |
    Assamese call girls in Guwahati |
    Nepali call girls in Guwahati |
    Female escorts in Guwahati |
    High profile escorts in Guwahati |
    Russian escorts in Guwahati |
    College call girls in Guwahati |

    ReplyDelete