Friday, July 5, 2013

A funny issue on BeEF keylogger spotted by Mario


Mario Heiderich, a good friend of mine, spotted a cool issue with the BeEF keylogger. He went “Armin Meiwes” on our favourite open source bovine. He found XSS in BeEF using <svg/onload=blah>. Well-done!

The BeEF team encourages security researchers to help out wherever possible. As such, we are announcing a BeEF bug bounty program. Each bug will receive a kilogram of Minotaur rump (depending upon supply ;-). Contact us if you would like to help out. We want to hear from you!

We're publishing the writeup about the bug Mario found and we're addressing how we fixed it in today's blog post.


To demonstrate, enter the data into the demo hook demo page:
XSS Screenshot
And the final result was:

Returned data
I've added the ability to do context-aware output escaping of data coming from the hooked browser to the BeEF web admin UI jQuery-encoder. It's an awesome and very easy-to-use JavaScript library.

If you search in the BeEF JavaScript code, you can spot multiple instances of $jEncoder.encoder.encodeForHTML(your_untrusted_output). In this case, the issue is that the data coming from the BeEF keylogger was first mangled by this.formatTitle, and then the output was escaped.

Have a look at the patch (lines 57 to 59):

XSS Patch source
Regarding exploitability, I would imagine the following attack:
  • An attacker prepares a website vulnerable to XSS, ready to be exploited with the BeEF hook.
  • The website also includes a piece of JavaScript that monitors the window object for a new global variable called BeEF.
  • When the BeEF variable is found, it's sufficient to use the functionality available in our logger.js (/beef/core/main/client/logger.js) to issue an XHR back to the /event handler, with properly formatted data including the XSS vector. 
This bug was fixed within 3 hours of notification. Update and cover your BeEF!

Cheers
antisnatchor



59 comments:

  1. I like your post about "A funny issue on BeEF keylogger spotted by Mario" very nice post. It is very help full.I do appreciate about this post & this blog ... :)
    vulnerability assessment
    penetration testing

    ReplyDelete
  2. funny indeed, thanks for this post, but i usually use this https://www.hoverwatch.com/free-android-keylogger keylogger.

    ReplyDelete
  3. Keylogger
    The best keylogger for Windows 10 (32bit and 64bit)
    http://keylogger111.tumblr.com/

    ReplyDelete
  4. Thank you for this interesting post! I want to tell you about this spy app for android http://copy9.com/free-keylogger/ I didn't expect it is something unusual. But when I downloaded it, I saw it has so many interesting functions. I haven't seen keylogger better than this one.

    ReplyDelete
  5. Have you ever checked out some of these spy applications, I mean spyera and others

    ReplyDelete
  6. Downloading this spy app can help you go through all the stuff your husband does on his phone. Please, look at this article if you really want to spy. http://www.mireview.com/blog/9-cell-phone-signs-your-husband-is-cheating-on-you/

    ReplyDelete
  7. I wanted to know the email password of my girl. So I installed an android keylogger http://9spyapps.com/best-hidden-keylogger-android/ on her smartphone. Maybe it's not fair. But I'll not deceive ourselves. Cuz, I have a feeling of dignity.

    ReplyDelete
  8. Hellos craze for acting Second home started in lofty college, during by happen he walked by the tragedy group also saw the undergraduates acting love poultrys

    ReplyDelete
  9. The first time I saw this website, I was immediately attracted to zoom. Moreover, all mortgage & tax arrears the information is in my opinion quite interesting and intriguing. I hope you also visit my website and pass judgment on Costa Calida my website. Thanks.

    ReplyDelete
  10. There's no doubt that sometimes students have lots of things to do. U Write My Essay makes their life much more easier by writing a perfect essays for them.

    ReplyDelete
  11. hello yes o like it and agreed with you After reading this blog Second home i am very strong and clear in this topic and
    second mortgage canada explanation also very clear in this blog so easy to understand

    ReplyDelete
  12. Yes, I've seen some discussions on that issues. Check this entry, guys, don't ignore your other users, that don't post on this blog.

    ReplyDelete
  13. I have read you post, Great work you really did it very well. Keep working like this and sharing informative posts like
    this one. keep it up. I'm waiting for your next post...
    burnaby real estate

    ReplyDelete
  14. Great tips I have noted all in my diary I'll use your all tips as you mentioned I really like your article I was searching on this topic as I'm working on this topics too.you can see my work but yours is too good I personally appreciate you for this. Keep working like this.t shirt design vancouver

    ReplyDelete
  15. Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog. Really very informative post you shared here.
    Kindly keep blogging. If anyone wants to become a Front end developer learn from javascript and jquery training in chennai .
    or learn thru Javascript Training in Chennai.
    Nowadays JavaScript has tons of job opportunities on various vertical industry. javascript and jquery training in chennai

    ReplyDelete
  16. It looks funny but It was a serious matter, And solved in two weeks. It take time and efforts of professionals as we can see ١٠ أسباب تدفعك إلى الاستثمار في جورجيا there. It was a good experience to solve this funny issue...

    ReplyDelete
  17. Can I Learn this from basics... I want to learn this and can you tell me how can I do this? And How I can get proprepandfulfillment from the basics of these things...

    ReplyDelete
  18. Here is the best essay writing blog https://writemypaper4me.org/blog/classification-essay. Find us at the writers guide conference!

    ReplyDelete
  19. Get OFF HostGator when you use this exclusive hostgator coupons code

    ReplyDelete
  20. Evaluating your vehicle's worth will enable you to guarantee that you can get the most extreme sum conceivable on your auto value. When you utilize the KBB valuation as a benchmark, you can precisely evaluate the assessed estimating for your utilized auto. auto title loans near me chicago

    ReplyDelete
  21. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  22. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  23. Coinpublish provides latest Blockchain and Cryptocurrency news
    Coinpublish is an independent publication working for a decentralized economy and delivering you with the latest updates on ICO, Bitcoin, Ethereum and Altcoin news.
    cryptocurrency news , ICO news , Latest Blockchain news , Bitcoin news , Ethereum news , Altcoin news

    ReplyDelete
  24. Shen Tong is an Angel Investor and has invested in plenty of start-ups related to the food industry. Shen Tong is an entrepreneur and is extensively involved in the media industry and software industry. Shen Tong is the founder and president of VFinity and is also in the board of directors of Food Tank. VFinity essentially is responsible for making web applications for multimedia and multilingual search, software tools, media production, archiving, and media distribution. Shen Tong is widely acknowledged because of the speech he made on the promotion of context media and suppression of the National Association of Broadcasters in Las Vegas. Apart from being a sequential entrepreneur, Shen Tong is a writer/poet, social activist, a film buff and a foodie. Shen Tong holds an honorary Ph.D. degree from St Ambrose University. It was in the year 2000 when Shen Tong moved to the city of New York and founded business accelerators: FoodFutureCo in the year 2015 and Food-X in the year 2014.Shen Tong co-chaired a committee designed to form a dialogue concerning the Chinese pro-democracy movement.Shen Tong organised the democracy movement in 1989 that occupied Tiananmen Square while he was at Beijing University.

    ReplyDelete
  25. Looking for best bars in Delhi to quench the weekend thirst, or just need some of the best pubs in delhi for enjoying evenings after long days at work. Choosing a place drink eBay celebrate should not be a difficult task. There are some things that are important while deciding about where shall you drink. The bar or the clubs should be close, economical, not congested & should also offer good food. But how can you find this information? It's actually quite simple. Just Download Boozeey Smartphone app for your smartphone.

    boozeey will immediately give you the list of best bars in Delhi from the nearby area & show you their drinks menu & prices. So never waste time ever again by going to multiple bars or pubs, #justBoozeey. Not only does the boozeey app helps you to find the best pubs & bars it will also give you great discounts with features like first drink free every night & happy hours anytime. Check it out on App Store & Google Play & discover for yourself the easiest & the most economical way to enjoy parties at best bars in Delhi.

    Not only your party experience is better with boozeey but Boozeey takes care of a safe ride home for you. The Boozeey app has in-built OLA cabs integration that will allow you to book an OLA cab to reach or depart from the bar location. So if you are living in Delhi NCR download the boozeey app & enjoy exclusive access to best bars & pubs in Delhi.


    ReplyDelete

  26. Bless you will many with regards to high quality construct. Icing is primarily cheerful pictures seen self-sufficient. Icing needed decide to buy regarding it tremendously benefits! Brilliant offer! Outdoor long term lots of many hopes to look into presume could quite possibly reveal many associated with! At this time go along with this unique Best General Contractor Westchester County A lot of component astounding attainable.

    ReplyDelete
  27. This post shows nice details. I like the way you analyze issues windows 10

    ReplyDelete
  28. Thank you for posting this article, it was really helpfull. Great Article.
    super mario crossover unblocked

    ReplyDelete
  29. TreasureBox is operated by a group of young, passionate, and ambitious people that are working diligently towards the same goal - make your every dollar count, as we believe you deserve something better.
    Check out the best
    rattan outdoor furniture nz
    headboard nz
    laptop table nz

    ReplyDelete
  30. Our nursing essay writing services and college research paper service work collaboratively with our team of researchers to ensure that every order is thoroughly researched before drafting.

    ReplyDelete
  31. Nursing Students always find out the best research paper writing services in usa since its very difficult because they require extensive research and most students lack the appropriate skills of researching. Students also seek help of top custom essay services.

    ReplyDelete
  32. Our experienced and high-quality research paper services will ensure when you search for best research paper writing services in USA and cheap dissertation writing services based on your instructions and specifications you get the assistance you need.

    ReplyDelete
  33. One should know which company has the best writers whose essay is free from grammatical errors. Grammatical errors reduce the quality of a custom paper especially those who want to pre written research paper and those seeking for custom assignment services.

    ReplyDelete
  34. Amazing Article ! I have bookmarked this article page as i received good information from this. We are the best Website Designing Company in Noida & Website Designing Company in Mumbai.

    ReplyDelete
  35. It has been some time since I visited website with such high quality information about regarding. We are Excellent company for Custom RNA Synthesis | RNA Synthesis.

    ReplyDelete
  36. I really enjoyed reading. Thanks for sharing such wonderful blog.


    Taxation law assignment help

    ReplyDelete
  37. I Got the best experts Who Can Do My Economics Homework online. We are a team of highly skilled professionals at providing complete assignments in any educational field.

    ReplyDelete
  38. We are the best writing company providing Custom Assignment Writing Service at affordable rates. Our Assignment Online Services are student-oriented, and therefore we price our articles at student-pocket -friendly rates.

    ReplyDelete
  39. The quality of our Best Essay Writing Service are always high as we work hard to ensure that we uphold our good reputations at all time. We make sure that Nursing Essay Writing Services ordered are delivered on time and our prices are affordable to every student.

    ReplyDelete
  40. Your blog is filled with unique good articles! I was impressed how well you express your thoughts.
    jio4gvoice for pc

    ReplyDelete
  41. Thanks for the informative article. This is one of the best resources I have found in quite some time. Nicely written and great info, I really thank you for sharing it.
    UK Assignment Help

    Do My Assignment

    ReplyDelete
  42. Thanks for the shared this informative and interesting post with us, I really enjoyed your post because it's really very helpful and informative.
    regards,
    factocert

    ReplyDelete

  43. New Jersey SEO company providing you with the best digital marketing services all over the US. The SEO company New Jerseycovers all aspects of digital marketing terms to boost your ranking on the search engine platforms. Seo company new jersey also provides you all social media services
    for the promotion and growth of your business on a social media platform like Instagram SEO .New Jersey Seo company also provides you with the service of web designing, mobile application development, and application development.

    ReplyDelete
  44. Dental Services in New Jersey since 1998-Hamilton Dental Care. Offers a variety of dental services in Hamilton to meet all of your dental needs. Let’s say if you are searching for the cosmetic dentistry near me or cosmetic dentistry hamilton NJ then you might come across with the Hamilton Dental Care because it is the best dental health services provider in the NJ. It gives you a smile that you can be proud to show off.

    Dental Services - https://www.hamiltondentalcarenj.com
    Facebook Profile - https://www.facebook.com/Hamilton-Dental-Care-153063602028984/
    Yelp Profile - https://www.yelp.com/biz/hamilton-dental-care-hamilton-township

    ReplyDelete
  45. Excel Dental - Dentist in Langhorne offers cosmetic dentistry procedures, restorative dentistry, affordable dental implants including mini dental implants as well as full dental implant in Langhorne, Pennsylvania. Book your dental appointment for teeth whitening for any cosmetic procedures in Langhorne, Pennsylvania if you are searching for a general dentist near me then you might come across with Excel Dental Langhorne because of its best dentist in Langhorne

    ReplyDelete
  46. 24*7 mobile truck repair in Atlanta.. Premium Truck and Trailer Repair LLC all the truck repair, trailer repair, services in Conley, Atlanta. Premium Truck and Trailer Repair LLC offers high quality and cost effective truck and trailer repair services. Our professional truck repair near me can fix your heavy duty truck and trailer for hassle free travel.

    ReplyDelete
  47. ). Contact us if you would like to help out. We want to hear from you!

    We're publishing the writeup a

    https://sbobet88-mobile.blogspot.com/

    ReplyDelete
  48. od reputations at all time. We make sure that Nursing Essay Writing Services ordered are delivered on time and our p

    http://www.informasiunik.web.id/

    ReplyDelete

  49. and growth of your business on a social media platform like Instagram SEO .New Jersey Seo company also provid
    http://www.informasiunik.web.id/

    ReplyDelete


  50. of your business on a social media platform like Instagram SEO .New Jersey Seo company also pr
    http://www.deskripsifilm.web.id/

    ReplyDelete
  51. Having read this I thought it was very informative. I appreciate you spending some time and effort to put this content together. I once again find myself spending a significant amount of time both reading and leaving comments. But so what, it was still worth it!
    192.168.254.254
    192.168.3.1
    10.0.1.1
    192.168.0.50
    192.168.11.1
    10.1.1.1

    ReplyDelete
  52. Is there anyone who can recommend the best service among the ones listed here?
    SEO for Plumbers

    ReplyDelete
  53. By ordering a Cheap Dissertation Writing Services from our Nursing Writing Services,be completely sure your personal information obtained is protected and will never be revealed to any third party.

    ReplyDelete