Tuesday, January 6, 2015

Hooked-Browser Meshed-Networks with WebRTC (Kiwicon 2014) - Part 1

Hi All, @xntrik here from sunny Australia. I hope you’ve all had a good New Year's and are ready to kick browser hacking into high gear for 2015. I had a thought that inspired me, and I wanted to share it here.

What if, to avoid tracking our post-exploitation communication back to our BeEF server, we were able to hook a bunch of browsers within an organisation, and make them talk to each other, instead of talking to our BeEF server? Perhaps we could keep one as the data channel (controlling peer)?

The answer is WebRTC. I recently had an amazing opportunity to present this at Kiwicon 2014, and I was keen to get the code into BeEF. This blog post provides a brief summary of WebRTC and how it works. Since there's quite a bit of ground to cover, this will be the first of a two part series.


Retaining post-exploitation communication with hooked-browsers is one of the more interesting issues with BeEF.

By default, BeEF uses XMLHttpRequest objects to poll to your BeEF server every 5 seconds. The logic is in the updater.js file of the core BeEF JavaScript client. It executes a setTimeout() function call that executes beef.updater.get_commands(), requesting the hook.js file from the BeEF server.

BeEF has options to use the WebSocket protocol as well, which shifts the comms from a polling mechanism to a more bi-directional streaming method of sending and receiving data between the server and browsers. Other more esoteric options are also being investigated, such as the use of DNS channels.

One of the issues with these methods is, all of your communication channels go back to the BeEF server. There are methods available to try and hide or obfuscate the presence of your BeEF server. But, most of these will still lead back to your BeEF Server eventually. For example, you could:

  • run multiple BeEF servers,
  • run servers with multiple interfaces, 
  • run multiple proxies pointing to your BeEF server, 
  • use reduced polling periods, 
  • use JavaScript obfuscation (which may help, but not much at the network layer), or  
  • use TLS encapsulation (similar issue, comms are still being sent to the BeEF server). 

If you're targeting a wide variety of targets, having things track back to your BeEF server may not matter so much.  If you're targeting a single organisation, though, this information is very useful to incident responders. If they detect one browser talking to your BeEF server, they'll very quickly spot the others. (This is still a big IF. As of today, no AV engines are detecting the stock-standard, un-obfuscated hook.js .. which is not altogether that surprising).

Virustotal report for stock hook.js
Thanks to those clever folks over at Google, Mozilla and Opera, we have an HTML5 technology to help us: WebRTC. WebRTC was initially intended to provide peer-to-peer communications for use-cases such as p2p video streaming. Due to bandwidth requirements, it's often better to provide video streaming between peers, instead of bouncing through servers. Another feature, apart from video streaming, is the provision of a data channel. This data channel works a little bit like WebSockets, in that it's event-driven and bi-directional. This is exactly the feature that we can use in BeEF to peer hooked browsers together.

The WebRTC Extension within BeEF is currently disabled by default. But, it's easy enough to enable. The extension provides the ability to have hooked browsers communicate with one another, using a single controlling peer as a data channel. The extension has been tested on Firefox 34.0.5 and Chrome 39.0.2171.95 (and Chrome on Android too!). In part two of this series, we’ll discuss some of the underlying JavaScript and how to use the extension.

170 comments:

  1. A good blog. Thanks for sharing the information. It is very useful for my future. keep sharing
    red ball 2 | duck life 2 | happy wheels | Red Ball | Red ball 3 | Flash Games| Tank trouble

    ReplyDelete
  2. Really very interesting post!!
    I hope title is the most attractive section of this particular post. I must read it. Sure I will book mark this content for the easy access of such an informative post.
    Essay writing company

    ReplyDelete
  3. Thanks for sharing your honest experience. When I first took a look at my head shots,
    I wasn’t too thrilled with mine but you’ve given me a new perspective!

    Virtual Edge

    ReplyDelete
  4. I as of late had an astonishing chance to present this at Kiwicon 2014, and I was quick termite company tucson az to get the code into BeEF. This blog entry gives a brief rundown of WebRTC and how it functions.

    ReplyDelete
  5. It was nice unblock game . Very informative and expressive .things are easily play online at
    Y8 game

    ReplyDelete
  6. This comment has been removed by the author.

    ReplyDelete
  7. Things are really changing, now get awesome content become easier. I used write my paper for me
    service for this last time. Pretty good service

    ReplyDelete
  8. It was nice unblock game . Very informative and expressive .things are easily play online at
    http://railbeeps.org

    ReplyDelete
  9. Take a closer look at this blog. It contains some information about phone tracking software that you can use to track someone you know

    ReplyDelete
  10. I would like to thank you for the efforts you have made in. The game is best known for its dark sense of humor and its graphic violence . I am hoping the arborists of long island same best work from you in the future as well. I really appreciate your work. Thanks for you agree for me.

    ReplyDelete
  11. I have read you post, Great work you really did it very well. Keep working like this and sharing informative posts like
    this one. keep it up. I'm waiting for your next post...
    what does it mean to refinance your mortgage

    ReplyDelete
  12. I have read you post, Great work you really did it very well. Keep working like this and sharing informative posts like
    this one. keep it up. I'm waiting for your next post...
    when to refinance your home

    ReplyDelete
  13. I have read you post, Great work you really did it very well. Keep working like this and sharing informative posts like
    this one. keep it up. I'm waiting for your next post...
    real estate agent

    ReplyDelete
  14. Great tips I have noted all in my diary I'll use your all tips as you mentioned I really like your article I was searching on this topic as I'm working on this topics too.you can see my work but yours is too good I personally appreciate you for this. Keep working like this.t shirt printing brampton

    ReplyDelete
  15. I got very excited to see these trendy looks. I think all those who are looking of latest trends will really enjoy reading your post. Please provide more information and photos. I am eagerly waiting for your updated post to get it.
    Coursework writing services

    ReplyDelete
  16. Hi, Great.. Tutorial is just awesome..It is really helpful for a newbie like me.. I am a regular follower of your blog.
    Really very informative post you shared here. Kindly keep blogging.
    If anyone wants to become a Front end developer learn from Javascript Online Training from India .
    or learn thru JavaScript Online Training from India.
    Nowadays JavaScript has tons of job opportunities on various vertical industry. ES6 Training in Chennai

    ReplyDelete
  17. dwgamez.com for best pc software you can get here

    ReplyDelete
  18. You always have creative content. Thanks for sharing. I love it and share with my friends. Keep it up bro.
    .
    .
    |
    |
    Download Call of Duty Zombies Mod APK Latest

    ReplyDelete
  19. Thanks for sharing such a great and informative post. I like this post and i would like to share with my friends. Keep it up bro.
    .
    .
    Tinder hacked matches

    ReplyDelete
  20. Hi there! This article could not be written any better! Reading through this post reminds me of my previous roommate! He continually kept preaching about this. I'll forward this post to him. Pretty sure he'll have a very good read. Thank you for sharing!

    Earn to Die 2 Mode apk

    ReplyDelete
  21. Stream authorization is a method to separate bot traffic from the human traffic. One of the most common of all is vidup.me/pair

    ReplyDelete
  22. Thank you to admin for sharing this with us here. This will help me out in my cv editor online and that is just the best thing for me right now. I love to read amazing things like this post here. Download hd cartoon apk

    ReplyDelete
  23. Amazing post I am glad thanks for sharing and I am sure you will check this so easy for everyone.
    asphalt 8 unlimited money
    pocket mortyrecipes
    mobdro
    custom binary blocked by frp lock

    ReplyDelete
  24. I have been checking out a few of your stories and I can state pretty good stuff. I will definitely bookmark your blog. Bloons TD Battles Cheats
    Which Ultimate Snapchat Hack Apk Download
    Download Need For Speed No Limits Mod Apk

    ReplyDelete
  25. Thanks for sharing such a spectacular post. I note you always posting a deep researchable post.
    Farmville 2 cheats bonus

    ReplyDelete
  26. Your article is awesome! How long does it take to complete this article? I have read through other blogs, but they are cumbersome and confusing. I hope you continue to have such quality articles to share with everyone! I believe there will be many people who share my views when they read this article from you!
    obat gabagen
    obat ginjal bengkak
    obat tbc kelenjar
    obat keloid
    obat kencing manis

    ReplyDelete
  27. the articles you present are very interesting and inspiring. i am very amazed good luck
    obat limpa bengkak
    obat thalasemia
    obat ginjal bengkak
    obat jantung bengkak
    obat keloid

    ReplyDelete
  28. I'd like to thank you for the efforts you have put in writing this blog. I'm hoping to check out the same high-grade blog posts by you in the future as well.
    fnaf world full version

    ReplyDelete
  29. Amazing site thaks a lot happy to see this beautiful design and will visit your site daily thanks<3
    Visit Also: asphalt 8 airborne mod apk

    ReplyDelete
  30. I as of late went over your site and have been perusing along. I thought I would leave my first remark. I don’t recognize what to say with the exception of that I have delighted in perusing. Decent blog, I will continue going by this online journal all the time. Happy New Year 2019 Quotes, Images Wallpapers, Wishes & Cards

    ReplyDelete
  31. Those who are searching over internet assignment help can contact with us now. We are the best assignment writing service provider in melbourne, Australia. Our Academic assignment writers available 24*7 hours for the students, if you really want to need assignment help online at cheapest price meet assignment helper at sample assignment and get high distinction grades.

    ReplyDelete
  32. You can take advantage of the “FRP bypass apk 2018” and everything else associated with it.
    google lock bypass

    ReplyDelete
  33. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Selenium with python Training in Electronic City

    ReplyDelete
  34. The post is written in very a good manner and it contains many useful information for me. Thank you very useful information admin, and pardon me permission to share articles here may help :

    risa herbal
    cara menghilangkan benjolan
    toko obat herbal sapnudin
    sehat dan cantik alami
    khasiat obat herbal
    cara menghilangkan bekas jerawat

    ReplyDelete
  35. Good Post! Thank you so much for sharing this pretty post, it was so good to read and useful to improve my knowledge as updated one, keep blogging.

    Dot net training in electronic city

    ReplyDelete
  36. What an amazing article. I can say you have cover every point and make things very interesting. Thanks for such an informative post.
    New Year GIF Video

    ReplyDelete
  37. Browse hacking is a very common practice. I was amazed at the number of sites that offer to teach you how to hack someone's account. If your account has been hacked, you should immediately change your password and you need online strong password generator. There is usually an account validation procedure to help you get your account back.

    ReplyDelete
  38. After reading numerous writing subreddits I decided to make a short list of the best essay writing service reddit which received the most positive feedback.

    ReplyDelete
  39. I drink 2 litres of flavoured milk every day and 2 protein shakes each with 40g protein. war machines hack

    ReplyDelete
  40. Nice article,This blog post provides a brief summary of WebRTC and how it works.thank for sharing.
    Taxation law assignment help.

    ReplyDelete
  41. 90minup ข่าวกีฬา ฟุตบอล ผลบอล วิเคราะห์บอล พรีเมียร์ลีก ฟุตบอลไทย
    ข่าวกีฬา
    ตารางคะแนน
    ฟุตบอลไทย
    ไฮไลท์ฟุตบอล
    ดูบอลออนไลน์
    ผลบอลสด
    90minup

    ReplyDelete
  42. zombie gunship survival hack Ur editing is next level man. I hv also seen brawl stars by ea. But this is fantastic

    ReplyDelete
  43. Make your drive more awesome with Sydney Bus Hire and Bus Hire North Sydney at amazing cost.

    ReplyDelete
  44. mini golf king hack I am a BIG FAN of getting up at 5AM. It's perfect for quiet time, CREATIVE time and connection time. I hope to make videos as GREAT as yours in the near future. (I just created my first 7 day EPIC LIFE challenge

    ReplyDelete
  45. Dentist in Hamilton

    Dentists in Hamilton are really helpful and when you search for dentists Hamilton nj, you will find that you are being displayed a number of dentist in Hamilton nj and dentist in Trenton nj. But when you have to pick one, Hamilton Dental Care is the best option for you to choose.

    It is not just the regular dentistry procedures that make the Hamilton Dental Care stand out but also the cosmetic dentistry in Hamilton. When you will search for Cosmetic Dentistry in Hamilton, you are looking for the best dental health services in Hamilton.

    So next time when you are looking for a dentist in Hamilton nj, you must go to Hamilton Dental Care.

    ReplyDelete
  46. The affordable online boutique is a leading store for the fashion loving women, and it offers classy, designer and trendy outfits at economical prices. Boutique in Atlanta offers a wide range of shopping options for women of all age groups. If you are looking for women's trendy tops or boutique dresses then affordable online boutique is the destination for you. The highlighting aspect of the southern boutique is the seasonal dressing offers. It offers a wide variety from boutique summer dresses to trendy sweaters that keeps you warm. The online boutique also specializes in rompers, jumpsuits, two-piece sets, coats, vests, cardigans, boutique tops, and women's accessories. Yes! Along with the trendy tops for women, you can also get the matching accessories like hair accessories to stand out of the crowd.

    Online Boutique Store:https://www.bermere.com
    Instagram Profile: https://instagram.com/shopbermere
    Facebook Profile: https://www.facebook.com/shopbermere

    ReplyDelete
  47. Thank you for this very informative post! I am a programmer student and it's really helpful.
    Sometimes I get so many written assignments that I don't have enough time for anything else. In such cases I contact guys from academic writing service. They always provide 24/7 support and high quality service.

    ReplyDelete
  48. Thank you for this, definitely will try out some of these just to try getting a summer body for our August beach trip!
    war machines hack

    ReplyDelete
  49. Welcome to our Assignment Help, we are the best provider assignment service at UK location, our service is most reliable and affordable for every student.
    Assignment Writing Service uk

    ReplyDelete
  50. After a year, analysing all kinds of diets, finally understood that we should eat normal foods that are grown locally from our native home town... no packed or imported foods. This is the trick but nobody ill like this comment!! factory inc hack

    ReplyDelete
  51. Thank you very much for sharing this very useful information,
    facebook entrar

    ReplyDelete
  52. Does your current resume need updating?
    Would you like your resume to showcase your experience?
    Do you want your resume to stand out from the competition? Our service will help you with this,
    www.ewriters.pro

    ReplyDelete
  53. TreasureBox is operated by a group of young, passionate, and ambitious people that are working diligently towards the same goal - make your every dollar count, as we believe you deserve something better.
    Check out the best
    sofa bed
    shoe rack nz
    bedroom furniture nz

    ReplyDelete

  54. Menjalin hubungan tanpa komitmen dengan gaya pergaulan bebas yang kemudian terjadilah kehamilan dapat memicu melakukan cara menggugurkan hamil muda karena adanya ketidak siapan dan sebagainya . Langkah menggugurkan kandungan mereka harapkan untuk cara mencegah kehamilan yang tidak mereka inginkan . Etah itu karena keterbatasan finansial atau apalah mereka mengambil jalan praktis dengan cara menggugurkan kandungan dengan manjakani ataupun asam jawa , kunyit asam dan buah-buahan seperti nanas muda maupun nanas muda untuk solusi mengatasi masalahnya . Pernahkah anda mengalami mimpi basah , lalu apa yang bisa Anda rasakah ? . Jika pasangan wanita ada sedang mengalami menstruasi sebaiknya tidak boleh di gauli terlebih dulu , tunggu masa menstruasinya sampai tuntas . Jika sudah selesai maka silahkan saja untuk mempergauli sampai cara membuat wanita cepat klimak dan keluar cairan orgasme agar puas .

    ReplyDelete
  55. Our dissertation help services in USA and custom research paper writing in USA are meant to transform the academic profile of any student from a downward trend to an upward trend in their grades.

    ReplyDelete
  56. Students should ensure that quality of essays offered match their prices. All our Nursing Research Paper Writing Service should ensure that customers’ private details are kept in privacy. This also applies when one need to seek for write my term paper online.

    ReplyDelete
  57. Companies offering affordable writing services should help students perform well by delivering papers prior to deadline. Early delivery of custom writing services by our online research paper writer is very important because it results in good performance of learners.

    ReplyDelete
  58. We treat the evaluation process serious and don’t publish fake reviews. In this https://scamfighter.net/review/boomessays.com review you can learn all information about the company which you won’t find elsewhere.

    ReplyDelete
  59. Thank you so much for sharing this excellent information. Your article is amazing. Good to discover your post. We are the Best Mobile App Development Company in India

    ReplyDelete
  60. Excellent Blog. I really want to admire the quality of this post. I like the way of your presentation of ideas, views and valuable content. No doubt you are doing great work. I’ll be waiting for your next post. Thanks .Keep it up!
    Kindly visit us @
    Luxury Boxes
    Premium Packaging
    Luxury Candles Box
    Earphone Packaging Box
    Wireless Headphone Box
    Innovative Packaging Boxes
    Wedding gift box
    Leather Bag Packaging Box
    Cosmetics Packaging Box
    Luxury Chocolate Boxes

    ReplyDelete
  61. Good knowledge about the blog. I will keep on reading your update. We are life science service provider like Oligo Synthesis | Custom Oligo Synthesis.

    ReplyDelete
  62. We are the best writing company providing Buy College Papers Online to students across the globe.We are a UK based company and have been operational since 2005 where we have assisted thousands of students in attaining high marks in Custom College Essay Writing Service.

    ReplyDelete
  63. All our writers understand Assignment Writing Help standards, and they are always ready to work for you. Students can Research Papers Help in any field and on any level of education.

    ReplyDelete
  64. bingo blitz cheats bingo blitz free credits bingo blitz freebies cheats for bingo blitz bingo ...https://bingoblitzcredits.com/ NOTE This gift has also been emailed and can only be claimed once.

    ReplyDelete

  65. Get House of Fun Free Coin. Collect new update Hof free coins 2019 and Hof free spin. Get House of Fun Coins and Claim House of Fun Slot freebies.
    House Of Fun is favorite choice among people from United States. We all enjoy this game so much but to continue game need house of fun coins.
    Collect House of Fun Slots Free Coins & Spins You can only collect each bonus one time.
    https://houseoffuncoins.com/

    ReplyDelete
  66. The information you have shared is very helpful to us. Football legends 2016

    ReplyDelete
  67. i visited your website and really nice stuff thanks for every thing .i like that type of website
    pikdo

    ReplyDelete
  68. I am reading on how to tell if my phone is tapped from this page. From Cocospy.

    ReplyDelete
  69. You are the smartest, you are much louder and I hope you give me a heart zero city zombie shelter survival hack

    ReplyDelete
  70. Thank you for sharing this informative post.MyAssignmenthelp.co.uk is giving dissertation conclusion help to students.we are already trusted by thousands of students who struggle to write their academic papers and also by those students who simply want
    marketing dissertation writing
    to save their time and make life easy.

    ReplyDelete
  71. In anticipation of the expected risks during the movement of furniture, we make sure to fill your things properly, through our packaging services designed شركة نقل عفش

    ReplyDelete
  72. Visit this page to download Spyic and learn many things on spying app. Before other people use this app to spy on you, I recommend you to learn this yourself so you will know what you need to do to prevent things from getting hacked.

    ReplyDelete
  73. https://papernow.org
    You are exactly the kind of help that I needed. I am very impressed with how my essay was written. Thank you!

    ReplyDelete
  74. JapanCupid review isn't a fake in my experience. I've used the pay service 3,000 for 1 month with unlimited messaging. I send messages to women whose profiles/pictures look good and I eventually end up with 20-30 cellphone numbers/LINE accounts. Then I end my membership and follow up offline. I've met quite a few women from there mostly Japanese but also some white girls and other Asian here in Japan. Never had any problems with the payment system or using my credit card there.

    ReplyDelete
  75. Share your feedback with others because your feedback helps others make the right decisions.

    Post here

    ReplyDelete
  76. One of the biggest issues with BeEF is that each hooked browser has to talk to the users' BeEF server. To try and avoid detection, they often want to try and obfuscate or hide their browsers, particularly if they have heavily targeting a single organization MyGiftCardSite

    ReplyDelete
  77. The best indicator of how likely you are to win is to look at the total a casino has paid out. If it's low, chances are you might not be onto a big winner.
    osg777
    A fast payout is often dependant on the casino, however, there are things you can do to ensure you get your cash quickly.
    osg777
    The main impact is the banking method you use, as each one will have slightly different processing times.
    osg777
    We've listed the methods that offer the fastest processing times so that you can make a more informed decision when it comes to withdrawing your funds.
    osg777
    Making a withdrawal from an online casino is easy; especially as most casinos do all that they can to keep the process as fuss-free as possible.
    osg777

    ReplyDelete
  78. Poker is one of the greatest games on earth. The combination of skill and luck, the psychological element, and the fact you can make money from it all help with its popularity.
    idn poker online
    But in order for you to make money from poker, you need to learn how to win at poker, which is actually easier than some would suggest.
    idn poker online
    It should go without saying that in order to discover how to win in poker, you need to learn the basics of the game.
    idn poker online
    When I first started playing poker, I didn’t know anything about the game, even including what hands beat what.
    idn poker online

    ReplyDelete
  79. Thanks for sharing such a great blog... I am impressed with you taking time to post a nice info.
    iPad Application Development
    Hybrid App Development
    Web Development Services

    ReplyDelete
  80. In this section, you can discover some of the facts behind gambling myths,
    http://www.tabloidgame.web.id
    get explanations for the terms used in the gambling industry and understand its size and how it is regulated.
    http://www.ikanhias.web.id
    Probability is the likelihood of a specific outcome or event taking place.
    http://www.fashionista.web.id
    To work this out, you divide the number of specific outcomes with the number of possible outcomes.
    http://www.daftaratletindonesia.web.id
    For example, if you were rolling a dice and wanted the number three to come up, there is only one specific outcome;
    http://www.tanamanhias.web.id
    at the same time, there are six possible outcomes because the dice could land on one, two, three, four, five or six.
    http://www.beritakomunitas.web.id
    So the probability of you rolling a three is 1 in 6.
    http://www.populerkan.web.id
    In gambling, the "odds" are the chances a person has of winning a bet, but these always work against that person.
    http://www.liriklaguindo.web.id
    The "house" refers to the people who offer the bet (the casino, bookmaker, slot machine owner, etc.) and they always have the "edge".
    http://www.tips60detik.web.id
    This means that the designers of the machine or game make sure that it works in their favour and they will always make money overall.
    http://www.tips60detik.web.id

    ReplyDelete
  81. I really happy found this website eventually.
    Really informative and inoperative, Thanks for the post and effort! Please keep sharing more such blog.
    Guest Blogging Site
    Guest Posting Site
    Guest Posting Site
    Guest Posting Site
    Guest Posting Site

    ReplyDelete
  82. I enjoy reading a post that can make online mobile repair marathahalli men and women think. Also, thanks for permitting me to comment! Right here is online lg display repair the right web site for anyone who wishes to understand this topic. You understand so much its almost hard to argue with you (not that online mi display repair I actually would want to…HaHa). You definitely put a fresh spin on a topic that's been written about for decades. Wonderful stuff, just excellent!

    ReplyDelete
  83. Aw, this was an incredibly online iphone display repair good post. Spending some time and actual effort to produce a very good online nokia display repair article… but what can I say… I procrastinate a whole lot and don't manage to get nearly anything online google pixel display repair done.

    ReplyDelete