[hdawg12]

I want to use Beef over WAN. I have it installed and I configured a routed IP address/port to my laptop. Can I use this to send a link to my VM(windows XP)browser, who has a VPN ip address assigned to it(to make it look like its out of my LAN)? And will this work or do I need apache2 server running?

[Gary]

Sorry for the off-topic post, however I thought the thread title meant someone was starting beef over one question but you were saying one in a weird way.

[hdawg12]

I just wanted to know if my setup for port forwarding was ok to send the hook .js to people outside my LAN or if I needed an app(something like ngrok) to do it.

[kayla_90]

Find a free webhosting,create a web page of whatever. Now when you create the hook.js,copy it and put the hook.js file along with the website you created.
Right click and edit the website source code and create a invissible iframe.
Done correctly,while you running Beef send the link and you can hook the visitors browsers. It's fun but i havn't mess with it for a long time.
Kayla

[hdawg12]

thanks for the tip.

Can I use my apache2 server to host my simple fake website?

[kayla_90]

thanks for the tip.

Can I use my apache2 server to host my simple fake website?

Yes you can

[hdawg12]

how can I create a invisible iframe? Can you show me how or point me in the right direction?

[DonnyD]

beef or beef not that is the question...

[linkinpork]

I want to use Beef over WAN.  I have it installed and I configured a routed IP address/port  to my laptop.  Can I use this to send a link to my VM(windows XP)browser,  who has a VPN  ip address assigned to it(to make it look like its out of my LAN)? And will this work or do I need apache2 server running?

1. Get a Linux VPS somewhere like DigitalOcean or CrazyRDP
2. Install apache2

Code

apt install apache2

3. Copy the hook script into the VPS' apache2 public directory - View the JS file, copy, then paste it in /var/www/html/hook.js
4. Delete the default home page and create one with the hook

Code

rm /var/www/html/index.html
nano /var/www/html/index.html

Then insert the script src=hook.js HTML tag in there, then save.

5. Test your hook script: Keep the BeEF console running, and view your VPS over your browser

Code

http://(VPS IP address)/index.html

Have fun!

[hdawg12]

thanks I will try that and let you know how it works.

I"m using lampp. Is that ok to use as well?

[linkinpork]

thanks I will try that and let you know how it works.

I"m using lampp. Is that ok to use as well?

The Bitnami bundle? That should work too. The homepage directory would differ though (and it could be index.php instead of index.html)

I forgot to mention that the BeEF server needs to reside in the WAN as well - DigitalOcean has a 4 dollar-per-month subscription where you pay by the hour. Essentially you'll need 2 servers -- the BeEF server on a VPS, and the other one that houses the hook script -- take note that the hook script does not explicitly need a VPS to run, you only need a copy of the javascript (hook.js) file to make it pop, even github.io or even a blogspot.com website could work.

Cheers!

---

Apparently there's a docker version for BeEF - if I recall correctly Google Cloud can run small scale docker images for free. Heroku free tier can also run it straight out of the GitHub repository, as is the case with OWASP Juice Shop.

https://github.com/isaudits/docker-beef

If you want to test out the hook script without having a second server or website to host it, you can try to insert it as a reflective XSS into this: http://testphp.vulnweb.com/

Have fun!

[hdawg12]

Thanks man you are a wealth of knowledge. I appreciate all you're doing to giving me pointers.