Skip to content

Commit 6887774

Browse files
bcolesbcoles
authored
Remove PhishingFrenzy integration (#2793)
1 parent 58efd34 commit 6887774

File tree

10 files changed

+0
-135
lines changed

10 files changed

+0
-135
lines changed

‎config.yaml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -124,13 +124,6 @@ beef:
124124
# GeoLite2 City database created by MaxMind, available from https://www.maxmind.com
125125
database: '/usr/share/GeoIP/GeoLite2-City.mmdb'
126126

127-
# Integration with PhishingFrenzy
128-
# If enabled BeEF will try to get the UID parameter value from the hooked URI, as this is used by PhishingFrenzy
129-
# to uniquely identify the victims. In this way you can easily associate phishing emails with hooked browser.
130-
integration:
131-
phishing_frenzy:
132-
enable: false
133-
134127
# You may override default extension configuration parameters here
135128
# Note: additional experimental extensions are available in the 'extensions' directory
136129
# and can be enabled via their respective 'config.yaml' file

‎core/main/client/browser.js‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4331,24 +4331,6 @@ beef.browser = {
43314331
if (has_wmp) details['browser.capabilities.wmp'] = has_wmp;
43324332
if (has_vlc) details['browser.capabilities.vlc'] = has_vlc;
43334333

4334-
var pf_integration = "<%= @phishing_frenzy_enable %>";
4335-
if (pf_integration) {
4336-
var pf_param = "uid";
4337-
var pf_victim_uid = "";
4338-
var location_search = window.location.search.substring(1);
4339-
var params = location_search.split('&');
4340-
for (var i = 0; i < params.length; i++) {
4341-
var param_entry = params[i].split('=');
4342-
if (param_entry[0] == pf_param) {
4343-
pf_victim_uid = param_entry[1];
4344-
details['PhishingFrenzyUID'] = pf_victim_uid;
4345-
break;
4346-
}
4347-
}
4348-
} else {
4349-
details['PhishingFrenzyUID'] = "N/A";
4350-
}
4351-
43524334
return details;
43534335
},
43544336

‎core/main/handlers/browserdetails.rb‎

Lines changed: 0 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -546,17 +546,6 @@ def setup
546546
err_msg "Invalid value for hardware.screen.touchenabled returned from the hook browser's initial connection."
547547
end
548548

549-
if config.get('beef.integration.phishing_frenzy.enable')
550-
# get and store the browser plugins
551-
victim_uid = get_param(@data['results'], 'PhishingFrenzyUID')
552-
print_debug "PhishingFrenzy victim UID is #{victim_uid}"
553-
if BeEF::Filters.alphanums_only?(victim_uid)
554-
BD.set(session_id, 'PhishingFrenzyUID', victim_uid)
555-
else
556-
err_msg "Invalid PhishingFrenzy Victim UID returned from the hook browser's initial connection."
557-
end
558-
end
559-
560549
# log a few info of newly hooked zombie in the console
561550
print_info "New Hooked Browser [id:#{zombie.id}, ip:#{zombie.ip}, browser:#{browser_name}-#{browser_version}, os:#{os_name}-#{os_version}], hooked domain [#{log_zombie_domain}:#{log_zombie_port}]"
562551

‎core/main/handlers/modules/beefjs.rb‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,9 +100,6 @@ def build_beefjs!(req_host)
100100
hook_session_config['websocket_sec_port'] = config.get('beef.http.websocket.secure_port')
101101
end
102102

103-
# @note Set if PhishingFrenzy integration is enabled
104-
hook_session_config['phishing_frenzy_enable'] = config.get('beef.integration.phishing_frenzy.enable') if config.get('beef.integration.phishing_frenzy.enable')
105-
106103
# @note populate place holders in the beef_js string and set the response body
107104
eruby = Erubis::FastEruby.new(beef_js)
108105
@hook = eruby.evaluate(hook_session_config)

‎core/main/handlers/modules/legacybeefjs.rb‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,9 +100,6 @@ def legacy_build_beefjs!(req_host)
100100
hook_session_config['websocket_sec_port'] = config.get('beef.http.websocket.secure_port')
101101
end
102102

103-
# @note Set if PhishingFrenzy integration is enabled
104-
hook_session_config['phishing_frenzy_enable'] = config.get('beef.integration.phishing_frenzy.enable') if config.get('beef.integration.phishing_frenzy.enable')
105-
106103
# @note populate place holders in the beef_js string and set the response body
107104
eruby = Erubis::FastEruby.new(beef_js)
108105
@hook = eruby.evaluate(hook_session_config)

‎core/main/handlers/modules/multistagebeefjs.rb‎

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -100,9 +100,6 @@ def multi_stage_beefjs!(req_host)
100100
hook_session_config['websocket_sec_port'] = config.get('beef.http.websocket.secure_port')
101101
end
102102

103-
# @note Set if PhishingFrenzy integration is enabled
104-
hook_session_config['phishing_frenzy_enable'] = config.get('beef.integration.phishing_frenzy.enable') if config.get('beef.integration.phishing_frenzy.enable')
105-
106103
# @note populate place holders in the beef_js string and set the response body
107104
eruby = Erubis::FastEruby.new(beef_js)
108105
@hook = eruby.evaluate(hook_session_config)

‎core/main/rest/handlers/hookedbrowsers.rb‎

Lines changed: 0 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -99,32 +99,6 @@ class HookedBrowsers < BeEF::Core::Router::Router
9999
output.to_json
100100
end
101101

102-
#
103-
# @note this is basically the same call as /api/hooks, but returns different data structured in arrays rather than objects.
104-
# Useful if you need to query the API via jQuery.dataTable < 1.10 which is currently used in PhishingFrenzy
105-
#
106-
get '/pf/online' do
107-
online_hooks = hbs_to_array(BeEF::Core::Models::HookedBrowser.where('lastseen >= ?', (Time.new.to_i - 15)))
108-
109-
output = {
110-
'aaData' => online_hooks
111-
}
112-
output.to_json
113-
end
114-
115-
#
116-
# @note this is basically the same call as /api/hooks, but returns different data structured in arrays rather than objects.
117-
# Useful if you need to query the API via jQuery.dataTable < 1.10 which is currently used in PhishingFrenzy
118-
#
119-
get '/pf/offline' do
120-
offline_hooks = hbs_to_array(BeEF::Core::Models::HookedBrowser.where('lastseen <= ?', (Time.new.to_i - 15)))
121-
122-
output = {
123-
'aaData' => offline_hooks
124-
}
125-
output.to_json
126-
end
127-
128102
#
129103
# @note Get all the hooked browser details (plugins enabled, technologies enabled, cookies)
130104
#
@@ -198,38 +172,6 @@ def get_hb_details(hb)
198172
'country_code' => details.get(hb.session, 'location.country.isocode')
199173
}
200174
end
201-
202-
# this is used in the 'get '/pf'' restful api call
203-
def hbs_to_array(hbs)
204-
hooked_browsers = []
205-
hbs.each do |hb|
206-
details = BeEF::Core::Models::BrowserDetails
207-
# @todo what does the below TODO comment mean? why do we care about the client side view inside a controller?
208-
# TODO: jQuery.dataTables needs fixed array indexes, add emptry string if a value is blank
209-
210-
pfuid = details.get(hb.session, 'PhishingFrenzyUID').nil? ? 'n/a' : details.get(hb.session, 'PhishingFrenzyUID')
211-
bname = details.get(hb.session, 'browser.name').nil? ? 'n/a' : details.get(hb.session, 'browser.name')
212-
bversion = details.get(hb.session, 'browser.version').nil? ? 'n/a' : details.get(hb.session, 'browser.version')
213-
bplugins = details.get(hb.session, 'browser.plugins').nil? ? 'n/a' : details.get(hb.session, 'browser.plugins')
214-
215-
hooked_browsers << [
216-
hb.id,
217-
hb.ip,
218-
pfuid,
219-
bname,
220-
bversion,
221-
details.get(hb.session, 'host.os.name'),
222-
details.get(hb.session, 'browser.platform'),
223-
details.get(hb.session, 'browser.language'),
224-
bplugins,
225-
details.get(hb.session, 'location.city'),
226-
details.get(hb.session, 'location.country'),
227-
details.get(hb.session, 'location.latitude'),
228-
details.get(hb.session, 'location.longitude')
229-
]
230-
end
231-
hooked_browsers
232-
end
233175
end
234176
end
235177
end

‎docs/browser.js.html‎

Lines changed: 0 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4350,24 +4350,6 @@ <h1 class="page-title">Source: browser.js</h1>
43504350
if (has_wmp) details['browser.capabilities.wmp'] = has_wmp;
43514351
if (has_vlc) details['browser.capabilities.vlc'] = has_vlc;
43524352

4353-
var pf_integration = "&lt;%= @phishing_frenzy_enable %>";
4354-
if (pf_integration) {
4355-
var pf_param = "uid";
4356-
var pf_victim_uid = "";
4357-
var location_search = window.location.search.substring(1);
4358-
var params = location_search.split('&amp;');
4359-
for (var i = 0; i &lt; params.length; i++) {
4360-
var param_entry = params[i].split('=');
4361-
if (param_entry[0] == pf_param) {
4362-
pf_victim_uid = param_entry[1];
4363-
details['PhishingFrenzyUID'] = pf_victim_uid;
4364-
break;
4365-
}
4366-
}
4367-
} else {
4368-
details['PhishingFrenzyUID'] = "N/A";
4369-
}
4370-
43714353
return details;
43724354
},
43734355

‎spec/support/assets/config_new.yaml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -128,13 +128,6 @@ beef:
128128
enable: true
129129
database: '/opt/GeoIP/GeoLite2-City.mmdb'
130130

131-
# Integration with PhishingFrenzy
132-
# If enabled BeEF will try to get the UID parameter value from the hooked URI, as this is used by PhishingFrenzy
133-
# to uniquely identify the victims. In this way you can easily associate phishing emails with hooked browser.
134-
integration:
135-
phishing_frenzy:
136-
enable: false
137-
138131
# You may override default extension configuration parameters here
139132
# Note: additional experimental extensions are available in the 'extensions' directory
140133
# and can be enabled via their respective 'config.yaml' file

‎spec/support/assets/config_old.yaml‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -121,13 +121,6 @@ beef:
121121
enable: true
122122
database: '/opt/GeoIP/GeoLite2-City.mmdb'
123123

124-
# Integration with PhishingFrenzy
125-
# If enabled BeEF will try to get the UID parameter value from the hooked URI, as this is used by PhishingFrenzy
126-
# to uniquely identify the victims. In this way you can easily associate phishing emails with hooked browser.
127-
integration:
128-
phishing_frenzy:
129-
enable: false
130-
131124
# You may override default extension configuration parameters here
132125
# Note: additional experimental extensions are available in the 'extensions' directory
133126
# and can be enabled via their respective 'config.yaml' file

0 commit comments

Comments
 (0)