Man-in-the-Browser attack with XSS and BeEF

BeEF, the Browser Exploitation Framework, is a tool that focuses on client-side vectors, specifically on attacking web browsers.

In this recipe, we will exploit an XSS vulnerability and use BeEF to take control of the client browser.

Getting ready

Before we start, we need to be sure that we have started the BeEF service and are capable of accessing http://127.0.0.1:3000/ui/panel (with beef/beef as login credentials).

1. The default BeEF service in Kali Linux doesn't work, so we cannot simply run beef-xss to get BeEF running. Instead, we need to run it from the directory in which it was installed, as shown here:

cd /usr/share/beef-xss/
 ./beef

2. Now, browse to http://127.0.0.1...