From b78390cd39d39fd3369d0a9d46bce4d0d96b07b0 Mon Sep 17 00:00:00 2001 From: bcoles Date: Wed, 2 May 2012 18:42:18 +0930 Subject: [PATCH 1/4] Added Google Search module --- modules/browser/google_search/command.js | 39 +++++++++++++++++++++++ modules/browser/google_search/config.yaml | 25 +++++++++++++++ modules/browser/google_search/module.rb | 32 +++++++++++++++++++ 3 files changed, 96 insertions(+) create mode 100644 modules/browser/google_search/command.js create mode 100644 modules/browser/google_search/config.yaml create mode 100644 modules/browser/google_search/module.rb diff --git a/modules/browser/google_search/command.js b/modules/browser/google_search/command.js new file mode 100644 index 000000000..93366a3d5 --- /dev/null +++ b/modules/browser/google_search/command.js @@ -0,0 +1,39 @@ +// +// Copyright 2012 Wade Alcorn wade@bindshell.net +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. +// +beef.execute(function() { + + var query = '<%= @query.gsub(/'/, "\\'") %>'; + + var searchGoogle = function(query) { + + var script = document.createElement('script'); + script.defer = true; + script.type = "text/javascript"; + script.src = "https://ajax.googleapis.com/ajax/services/search/web?callback=callback&lstkp=0&rsz=large&hl=en&q=" + query + "&v=1.0"; + + callback = function (results) { + document.body.removeChild(script); + delete callback; + beef.net.send('<%= @command_url %>', <%= @command_id %>, "query="+query+"&results="+JSON.stringify(results)); + }; + + document.body.appendChild(script); + } + + searchGoogle(query); + +}); + diff --git a/modules/browser/google_search/config.yaml b/modules/browser/google_search/config.yaml new file mode 100644 index 000000000..6160abacf --- /dev/null +++ b/modules/browser/google_search/config.yaml @@ -0,0 +1,25 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +beef: + module: + google_search: + enable: true + category: "Browser" + name: "Google Search" + description: "This module uses the hooked browser to search Google." + authors: ["bcoles"] + target: + working: ["ALL"] diff --git a/modules/browser/google_search/module.rb b/modules/browser/google_search/module.rb new file mode 100644 index 000000000..afec66958 --- /dev/null +++ b/modules/browser/google_search/module.rb @@ -0,0 +1,32 @@ +# +# Copyright 2012 Wade Alcorn wade@bindshell.net +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +class Google_search < BeEF::Core::Command + + def self.options + return [ + {'name' => 'query', 'ui_label' => 'Query', 'type' => 'textarea', 'value' =>'beef', 'width' => '400px', 'height' => '50px'} + ] + end + + def post_execute + content = {} + content['results'] = @datastore['results'] + content['query'] = @datastore['query'] + save content + end + +end + From c3435ee345bcf77da4bb1cf6035d0103e5655f63 Mon Sep 17 00:00:00 2001 From: antisnatchor Date: Wed, 2 May 2012 14:25:31 +0300 Subject: [PATCH 2/4] Fixed a nasty bug in net.js forgeRequest. Stripping line breaks from request domain: prevented the requester/tunneling proxy to work (always cross-domain fails) --- core/main/client/net.js | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/main/client/net.js b/core/main/client/net.js index b5340d472..b4dd6f590 100644 --- a/core/main/client/net.js +++ b/core/main/client/net.js @@ -243,9 +243,9 @@ beef.net = { // check if same domain or cross domain var cross_domain = true; - if (document.domain == domain) { + if (document.domain == domain.replace(/(\r\n|\n|\r)/gm,"")) { //strip eventual line breaks if(document.location.port == "" || document.location.port == null){ - cross_domain = !(port == "80" || port == "443"); + cross_domain = !(port == "80" || port == "443"); } else { if (document.location.port == port) cross_domain = false; } From 53c6fb5252fde1fcb07760432a7f4c7d4294dce8 Mon Sep 17 00:00:00 2001 From: bcoles Date: Thu, 3 May 2012 15:32:53 +0930 Subject: [PATCH 3/4] Fixed typo in module name/category --- modules/hooked_domain/ajax_fingerprint/config.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/modules/hooked_domain/ajax_fingerprint/config.yaml b/modules/hooked_domain/ajax_fingerprint/config.yaml index 32e2c3156..b1cd1b6ce 100644 --- a/modules/hooked_domain/ajax_fingerprint/config.yaml +++ b/modules/hooked_domain/ajax_fingerprint/config.yaml @@ -17,8 +17,8 @@ beef: module: ajax_fingerprint: enable: true - category: "Host" - name: "Hooked Domain" + category: "Hooked Domain" + name: "Fingerprint Ajax" description: "Fingerprint Ajax and JS libraries present on the hooked page." authors: ["qswain"] target: From 99d47351b7b13f3a19986295bc4b6aff4f290450 Mon Sep 17 00:00:00 2001 From: bcoles Date: Thu, 3 May 2012 15:54:46 +0930 Subject: [PATCH 4/4] Patched newline issue in request() in net.js See commit c3435ee345bcf77da4bb1cf6035d0103e5655f63 for more info --- core/main/client/net.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/main/client/net.js b/core/main/client/net.js index b4dd6f590..889503569 100644 --- a/core/main/client/net.js +++ b/core/main/client/net.js @@ -146,7 +146,7 @@ beef.net = { request: function(scheme, method, domain, port, path, anchor, data, timeout, dataType, callback) { //check if same domain or cross domain var cross_domain = true; - if (document.domain == domain){ + if (document.domain == domain.replace(/(\r\n|\n|\r)/gm,"")) { //strip eventual line breaks if(document.location.port == "" || document.location.port == null){ cross_domain = !(port == "80" || port == "443"); }