Taking control of the user's browser with BeEF-XSS

An attack known as Man-in-the-Browser (MITB) uses JavaScript to hook the user's browser to a Command and Control (C2) server that uses a script to issue orders to the browser and gathers information from it. XSS can be used as the vehicle to make a user load such a script while accessing a vulnerable application. Among the actions that an attacker could perform are the following:

  • Reading keystrokes
  • Extracting passwords saved in the browsers
  • Reading cookies and HTML5 storage
  • Enabling microphone and webcam (may require user interaction)
  • Exploiting browser vulnerabilities
  • Using the browser as pivot to the internal network of an organization
  • Controlling the behavior of browser's tabs and windows ...

Get Improving your Penetration Testing Skills now with O’Reilly online learning.

O’Reilly members experience live online training, plus books, videos, and digital content from 200+ publishers.