WRAITH: A Browser-Hooking Framework for Security Testing
Combining BeEF-style command channels with blind XSS evidence collection for penetration testing.
1Introduction to WRAITH
WRAITH is a browser-hooking framework that merges BeEF-style command channels with blind XSS evidence collection capabilities. It establishes a WebSocket connection from hooked browsers to an operator console, enabling deployment of capture modules and reconnaissance tools. The framework was publicly released on GitHub in August 2026 with three initial commits, though it remains labeled as work in progress.
2Technical Implementation
The hook script derives callback addresses from script URLs, connects to /ws/hook endpoints, and transmits browser fingerprints. Operators can deploy JavaScript modules to live browsers, with results returning through the same WebSocket channel. The system automatically captures page origins, URLs, cookies (excluding HttpOnly), and attempts DOM serialization with screenshots, clearly labeling any capture failures due to security policies.
3Page Mirror Functionality
WRAITH's Page Mirror feature relays operator link clicks through hooked browsers, which make credentialed fetch requests. This allows access to session-gated content without direct cookie theft, as HttpOnly cookies are attached by the browser to same-origin requests. The returned HTML is sanitized (scripts removed, forms disabled) and displayed in a sandboxed frame, creating a navigable but limited mirror of the target application.
4Security Boundaries
The framework maintains important security boundaries: HttpOnly cookies remain inaccessible to JavaScript, and cross-origin reads still obey the Same-Origin Policy. WRAITH demonstrates this distinction in its practice lab, showing empty captured cookie lists while still allowing credentialed access to session-gated pages through browser-mediated requests.
5Deployment Requirements
WRAITH requires Node.js 18+, Docker, and Docker Compose for containerized deployment. The setup process generates session-signing secrets and protected .env files. Security measures include mandatory operator passwords for public binding and recommendations for TLS encryption, per-cohort credentials, and service removal between exercises to protect sensitive captured data.
6Data Handling
Captured credentials, DOM content, and mirrored pages (up to 60 per session) are stored in data/sessions.json, with individual HTML capped at 2MB. Session hiding doesn't delete data - operators must explicitly use the permanent-forget action. This creates significant data sensitivity, requiring advance planning for retention policies and access controls in test environments.
7Comparison with BeEF
While inspired by BeEF (Browser Exploitation Framework), WRAITH currently offers a smaller module set: three login overlays, page capture, a port scanner, and the page mirror. Unlike BeEF's extensive module catalog, WRAITH focuses on combining command channels with evidence collection, particularly for blind XSS scenarios, without claiming feature parity with its predecessor.
8Red Team Applications
For penetration testers, WRAITH proves most useful after achieving authorized JavaScript execution. Page Capture identifies blind payload triggers, while Page Mirror enables inspection of same-origin resources without session token extraction. This workflow supports evidence collection during authorized security assessments while maintaining operational security boundaries.
9Local Testing Results
Initial testing confirmed proper operation: the operator console, demo page, practice lab, and hook script all returned HTTP 200 status. All JavaScript files passed syntax checks, and security safeguards like the public-bind protection worked as documented, preventing console exposure without proper credentials.
10Historical Context
Browser hooking tools have evolved since BeEF's 2006 debut. WRAITH builds on this lineage while incorporating capabilities from blind XSS tools like xsshunter-express. Similar to 2025's evilreplay, it leverages existing JavaScript execution contexts without breaking fundamental browser security models like HttpOnly cookie protections.
11Operational Limitations
WRAITH's mirroring has clear constraints: JavaScript-heavy applications won't replay faithfully, and form submissions are blocked. Server-rendered applications with useful links work best. The framework makes no claims about being a complete remote-browser solution, instead positioning itself as an evidence collection enhancement for specific testing scenarios.
12Security Implications
WRAITH represents a significant tool for security professionals, combining previously separate capabilities into a unified framework. Its careful handling of security boundaries (maintaining HttpOnly protections while enabling credentialed access) demonstrates thoughtful design for ethical penetration testing, where evidence collection must balance effectiveness with respect for security controls.