search

beefproject / beef

The Browser Exploitation Framework Project
https://beefproject.com
9.89k stars 2.19k forks source link

Review "IP address has changed" functionality #2821

Open bcoles opened 1 year ago

bcoles commented 1 year ago

The "IP address has changed" functionality is dodgy. Worse, when allow_reverse_proxy is used, the X-Forwarded-For header is trusted implicitly without validation.

https://github.com/beefproject/beef/blob/943a6fd2266f2652e64885c499e8f8fb5735ac10/core/main/handlers/hookedbrowsers.rb#L93-L102

Here's an example someone provided, showing that the stored IP address contains two IP addresses separated by ,.

image

It may also result in many "IP address has changed" events in load balanced environments. Although I'm not sure that this is avoidable.

github-actions[bot] commented 1 year ago

This issue as been marked as stale due to inactivity and will be closed in 7 days