Hack the Browser.Harden the System.

BeEF empowers penetration testers to exploit browsers safely and reveal client-side weaknesses hidden behind the network perimeter.

Documentation Download

What is BeEF?

BeEF is short for The Browser Exploitation Framework. It is a penetration testing tool that focuses on the web browser.

Amid growing concerns about web-borne attacks against clients, including mobile clients, BeEF allows the professional penetration tester to assess the actual security posture of a target environment by using client-side attack vectors. Unlike other security frameworks, BeEF looks past the hardened network perimeter and client system, and examines exploitability within the context of the one open door: the web browser.

BeEF will hook one or more web browsers and use them as beachheads for launching directed command modules and further attacks against the system from within the browser context.

Key Capabilities

Browser-Focused Security

Targets the most vulnerable entry point: web browsers.

Client-Side Attack Vectors

Exploits weaknesses within the browser context.

Cross-Platform Testing

Works across all major browsers and operating systems.

Read Documentation

Installation Guide

Powerful Features

Everything you need for browser exploitation and client-side penetration testing

Web-Based Control Panel

Powerful and intuitive administrative interface for managing hooked browsers and launching targeted command modules

Real-time browser hooks
Module execution interface
Session management

Getting StartedLogsCommands

Hooked Browsers

📁 Online Browsers

🦊 10.211.55.10

🌐 10.211.55.2

📁 Offline Browsers

ID	Type	Event
9	Command	Hooked
8	Command	Hooked
7	Zombie	10.211

Command Modules

Extensive library of browser-based command modules with simple and powerful API for targeted attacks

Information gathering
Social engineering attacks
Browser exploitation

Command ModulesExtensionsAutorun Rules

Search modules...

Network Discovery

Bypass network perimeter defenses by using hooked browsers as beachheads for internal reconnaissance

Internal network mapping
WebRTC extensions
Pivot capabilities

Network DiscoveryPort ScanningWebRTC

Discovery Complete

Discovered Network Hosts

Network Scanner Console

Extensible Framework

Modular architecture with autorun rule engine and development API for creating custom modules

Module development API
Extension system
Event-driven architecture

Module EditorAPI DocsExtensions

BeEF Framework

modules

social_engineering

fake_notification.rb

redirect_browser.rb

clickjacking.rb

browser

extensions

core

modules / social_engineering / fake_notification.rb

Ruby

"comment">#

"comment"># Browser Exploitation Framework (BeEF) - https://beefproject.com

"comment">#

"keyword">class Fake_notification < BeEF::Core::Command

"keyword">def self.options

"keyword">return [

{ 'name' => 'notification_text',

'description' => 'Text to display in fake notification',

'ui_label' => 'Notification Text',

'value' => 'Your session has expired. Please log in again.',

'width' => '400px'

},

{ 'name' => 'notification_type',

'description' => 'Type of notification to display',

'ui_label' => 'Notification Type',

'value' => 'security',

'type' => 'combobox',

'store' => ['security', 'update', 'error', 'info']

},

{ 'name' => 'auto_close',

'description' => 'Auto-close notification after delay',

'ui_label' => 'Auto Close',

'value' => 'true',

'type' => 'checkbox'

}

]

"keyword">end

"keyword">def post_soft_load

"keyword">return

"keyword">end

"keyword">def pre_s"keyword">end

BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind(

'/#{@command_id}/notification.js',

'/modules/social_engineering/fake_notification',

'notification.js'

)

"keyword">end

"keyword">def callback

content = {}

content['result'] = @datastore['result'] "keyword">if @datastore['result']

content['clicked'] = @datastore['clicked'] "keyword">if @datastore['clicked']

save content

"keyword">end

Advance Browser Security Research

Join security professionals worldwide contributing to BeEF's mission of improving web browser security through collaborative research and development.

Start Contributing

Join Discord