search

beefproject / beef

The Browser Exploitation Framework Project
https://beefproject.com
9.72k stars 2.15k forks source link

update GetStoredCredentials, senglehardt.com, login manager autofill #1974

Open Telariust opened 4 years ago

Telariust commented 4 years ago

I was surprised not to find this trick among the modules https://senglehardt.com/demo/no_boundaries/loginmanager/ Its work in last Chrome_v83 (https require). It has been known since 2017. Need update Commands->Browser->HookedDomain->GetStoredCredentials

jackdwalker commented 4 years ago

Thanks for raising the issue @Telariust. Currently the focus of project collaborators is primarily on the stability, maintainability, core functionality, and usability of BeEF while revitalising some of the older components of the tool. As such, feature requests (e.g. new command modules), for the moment, have taken the backseat, with the exception of those that are critical to the project such as #1392, #1573, and #1785. We'll get there but it's going to take some time to catch up on some of the tech debt we currently have.

If you see features such as this that are missing, feel free to have a read over the module creation documentation and have a go at creating one yourself :)

We're always happy to receive PRs!

iWhacko commented 2 years ago

While this is a very interesting exploit. I do not really see the use of it in BeEF. It relies on a first party website to include an external script (this exploit). Their example is of a third party analytics website that does tracking. So unless the website willingly includes the hook.js, this is not going to work. Unless you use the "inject into all tabs" exploit. But then I think the existing extract credentials function should work. Correct me on this if I am mistaken.