# WRAITH: A Browser-Hooking Framework for Security Testing Combining BeEF-style command channels with blind XSS evidence collection for penetration testing. - **Source:** [Darknet – Hacking Tools, Hacker News & Cyber Security](https://brifing.si/source/f98b20e7-3541-4c13-b88a-d7282ccbb7ca) - **Published:** 2026-09-07 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/6b24dbf4-b4e2-40dc-a992-b1b801efe117 ## Introduction to WRAITH WRAITH is a browser-hooking framework that merges BeEF-style command channels with blind XSS evidence collection capabilities. It establishes a WebSocket connection from hooked browsers to an operator console, enabling deployment of capture modules and reconnaissance tools. The framework was publicly released on GitHub in August 2026 with three initial commits, though it remains labeled as work in progress. ## Technical Implementation The hook script derives callback addresses from script URLs, connects to /ws/hook endpoints, and transmits browser fingerprints. Operators can deploy JavaScript modules to live browsers, with results returning through the same WebSocket channel. The system automatically captures page origins, URLs, cookies (excluding HttpOnly), and attempts DOM serialization with screenshots, clearly labeling any capture failures due to security policies. ## Page Mirror Functionality WRAITH's Page Mirror feature relays operator link clicks through hooked browsers, which make credentialed fetch requests. This allows access to session-gated content without direct cookie theft, as HttpOnly cookies are attached by the browser to same-origin requests. The returned HTML is sanitized (scripts removed, forms disabled) and displayed in a sandboxed frame, creating a navigable but limited mirror of the target application. ## Security Boundaries The framework maintains important security boundaries: HttpOnly cookies remain inaccessible to JavaScript, and cross-origin reads still obey the Same-Origin Policy. WRAITH demonstrates this distinction in its practice lab, showing empty captured cookie lists while still allowing credentialed access to session-gated pages through browser-mediated requests. ## Deployment Requirements WRAITH requires Node.js 18+, Docker, and Docker Compose for containerized deployment. The setup process generates session-signing secrets and protected .env files. Security measures include mandatory operator passwords for public binding and recommendations for TLS encryption, per-cohort credentials, and service removal between exercises to protect sensitive captured data. ## Data Handling Captured credentials, DOM content, and mirrored pages (up to 60 per session) are stored in data/sessions.json, with individual HTML capped at 2MB. Session hiding doesn't delete data - operators must explicitly use the permanent-forget action. This creates significant data sensitivity, requiring advance planning for retention policies and access controls in test environments. ## Comparison with BeEF While inspired by BeEF (Browser Exploitation Framework), WRAITH currently offers a smaller module set: three login overlays, page capture, a port scanner, and the page mirror. Unlike BeEF's extensive module catalog, WRAITH focuses on combining command channels with evidence collection, particularly for blind XSS scenarios, without claiming feature parity with its predecessor. ## Red Team Applications For penetration testers, WRAITH proves most useful after achieving authorized JavaScript execution. Page Capture identifies blind payload triggers, while Page Mirror enables inspection of same-origin resources without session token extraction. This workflow supports evidence collection during authorized security assessments while maintaining operational security boundaries. ## Local Testing Results Initial testing confirmed proper operation: the operator console, demo page, practice lab, and hook script all returned HTTP 200 status. All JavaScript files passed syntax checks, and security safeguards like the public-bind protection worked as documented, preventing console exposure without proper credentials. ## Historical Context Browser hooking tools have evolved since BeEF's 2006 debut. WRAITH builds on this lineage while incorporating capabilities from blind XSS tools like xsshunter-express. Similar to 2025's evilreplay, it leverages existing JavaScript execution contexts without breaking fundamental browser security models like HttpOnly cookie protections. ## Operational Limitations WRAITH's mirroring has clear constraints: JavaScript-heavy applications won't replay faithfully, and form submissions are blocked. Server-rendered applications with useful links work best. The framework makes no claims about being a complete remote-browser solution, instead positioning itself as an evidence collection enhancement for specific testing scenarios. ## Security Implications WRAITH represents a significant tool for security professionals, combining previously separate capabilities into a unified framework. Its careful handling of security boundaries (maintaining HttpOnly protections while enabling credentialed access) demonstrates thoughtful design for ethical penetration testing, where evidence collection must balance effectiveness with respect for security controls. ## Sources covering this story - https://www.darknet.org.uk/2026/09/wraith-browser-hooking-and-blind-xss-page-mirroring/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._