Ngrok with BeEF

Download ngrok, then tunnel traffic to your BeEF server (port 3000 by default).

This can be achieved with the following command, which tells ngrok to open a tunnel to port 3000 on your local host.

$ ngrok http 3000

ngrok prints the publicly accessible forwarded tunnel URL(s) to terminal upon startup. Start BeEF, and ensure you can access the admin interface using the forwarded ngrok URL: https://your.ngrok.url/ui/panel.

Once you've verified your ngrok tunnel is configured correctly, you'll need to tell BeEF about the ngrok host and port (BeEF only knows about its own local network interface IP addresses).

In order for the client-side BeEF JavaScript hook to be able to connect back to BeEF, the hook JavaScript needs to be generated with the correct connect-back details. The connect-back host, post and protocol (http/https), are configured in beef.http.public:* properties in the config.yaml configuration file. For example:

beef:

    # ...

    http:

        # ...

        public: 
            host: "<ngrok-id>.ngrok.io" # ngrok domain name for forwarding URL
            port: "443"                 # ngrok port for forwarding URL (443 for HTTPS)
            https: true                 # ngrok supports HTTPS by default

You'll need to restart BeEF after making changes to the configuration file. These changes to the configuration file are used to generated the BeEF hook JavaScript file. Note that if you leave a hooked page open during configuration, you will need to refresh the hooked page after applying these changes for the browser to fetch the updated hook file.