Modlishka
CDK
Modlishka | CDK | |
---|---|---|
11 | 5 | |
4,672 | 3,650 | |
- | 1.6% | |
6.0 | 2.8 | |
13 days ago | 1 day ago | |
Go | Go | |
GNU General Public License v3.0 or later | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
Modlishka
- best phishing site or code for hacking insta
-
Browser in the Browser (BITB) Attack
I remember some big service many years ago (maybe yahoo?) had a “memorable image” or something that was associated with your username as some kind of anti phish metric. Of course nowadays that would be trivial to bypass with something like Modliskha or a different reverse proxy passing through the website content.
https://github.com/drk1wi/Modlishka
-
Even if hacker gets your password what good is it if the system flags suspicious logins cause of different IP address?
2FA can be "bypassed" by using some phishing and setup like https://github.com/drk1wi/Modlishka
- What's the fuss about 2FA with SMS?
-
2fa is hackable. Its pretty easy. Now what?
Apps would not help in this case. OTP, Push, SMS, Phone calls are all possible to be compromised using this attack (via reverse proxy for example).
-
Bad guys got into a 365 account with MFA enabled.
The MFA implemented in Azure is not phishing-proof. This can be phished using a reverse proxy, and the push notification method is often becoming a bad habit for users to always approve ("this was from Microsoft, so it looked legit"). The only phishing proof method is using FIDO2 authenticators, but that is Passwordless, not MFA
-
Azure MFA
Step 1. The user becomes a victim of an advanced phishing attack with MFA phishing included, so the attacker's phishing script logs in using both password and MFA code. Step 2. The attacker uses the session cookie to impersonate the victim. Step 3 is the same as with Option A.
-
Engineering a real-time phishing simulation proxy in Rust
* https://github.com/drk1wi/Modlishka
-
Social Engineering Toolkit (SET)
GitHub - drk1wi/Modlishka: Modlishka. Reverse Proxy.
-
Is hacking still an issue with 2FA?
See things like https://github.com/drk1wi/Modlishka
CDK
-
A morning with the Rabbit R1: a fun, funky, unfinished AI gadget
It does show how incompetent the attacker was, I report below what Retr0id wrote in the issue:
"tl;dr: The "leak" seems real, but doesn't prove any of the claims made in the readme.
This statement from Peiyuan Liao, the rabbit CTO, is consistent with what I'm seeing here: https://twitter.com/liaopeiyuan/status/ 1782922595199033662
So the "leak" is a bit of a nothingburger, containing partial code for the relatively boring process of letting users authenticate with online services through a sandboxed browser session, from which auth tokens etc. can be extracted. You can't infer anything about how LAM does or doesn't work from this.
They likely used "kiosk escape" tricks to get code exec within the box that runs the browser. Assuming their sandboxing is all set up correctly, this isn't particularly concerning, but it does expose the code that runs within the sandbox for analysis. That's what we appear to have here.
The attacker left behind a file named cdk.log, which is an artifact of https://github.com/cdk-team/CDK/, a container pentesting tool. They were clearly trying to escape the sandbox and pivot to somewhere more interesting, but I don't think they managed it. I think "part 2" is a bluff, this is all they have (feel free to prove me wrong, lol).
But that doesn't mean there's nothing here. Lets look at what we do have.
The most interesting detail to me is a package name list in repo/ typescript/common/base-tsconfig.json
[...]
The only code actually present is for q-web-minion-
What follows is my speculation based on the names alone:
"q" seems like a codename for the rabbit device (so q-hole rabbit hole). Q might stand for "quantum".
The problem with trying to log into and interface with consumer-facing services from 'the cloud" is that you'll get IP rate limited, blocked as a bot, etc. It would make sense to proxy traffic back out through the user's device, and that's what I'd hope q-proxy is about. The big downside with this is that it ~doubles latency and halves available bandwidth, magnifying any deficiencies of a flaky 4G connection. This is perhaps partly why their doordash demo chugged so hard. (protip to the team; use a caching proxy, with SSL, MitM. Detect CDN URLs and don't proxy those.)
This is a total stab in the dark but my guess is that bunny-host is where the LAM action happens, and bunny-builder is for LAM training.
cm-quantum-peripheral-common might be the wrist-mounted device teased in the launch event.
Addendum:
It's also possible there were some juicy credentials accessible within the container. But if there were, they aren't in this leak. In particular, it looks like they're using GCP "service account keys' (/credentials/ cm-gcp-service-account-quantum-workload/gcp-service-account- quantum-workload.json), which according to google's docs "create a security risk and are not recommended. Unlike the other credential file types, compromised service account keys can be used by a bad actor without any additional information".
There isn't enough information here (and/or my analysis isn't deep enough - "cloud" is not my forte) to determine if that'll cause any issues in practice, but if there really is a "part 2" leak, I'd guess this is how they got it."
I OCR two screenshots that I did so there could be errors.
- A Detailed Talk about K8S Cluster Security from the Perspective of Attackers (Part 1)
-
CDK – Zero Dependency Container Penetration Toolkit
3. Tools for network actions, probe, tunnel and K8s cluster management (7 tools).
See more in https://github.com/cdk-team/CDK
What are some alternatives?
evilginx2 - Standalone man-in-the-middle attack framework used for phishing login credentials along with session cookies, allowing for the bypass of 2-factor authentication
kubefwd - Bulk port forwarding Kubernetes services for local development.
bettercap - The Swiss Army knife for 802.11, BLE, IPv4 and IPv6 networks reconnaissance and MITM attacks.
runtime - Kata Containers version 1.x runtime (for version 2.x see https://github.com/kata-containers/kata-containers).
muraena - Muraena is an almost-transparent reverse proxy aimed at automating phishing and post-phishing activities.
WeaponizeKali.sh - Automate installation of extra pentest tools on Kali Linux
fx - A Function as a Service tool makes a function as a container-based service in seconds.
broxy - An HTTP/HTTPS intercept proxy written in Go.
kata-containers - Kata Containers is an open source project and community working to build a standard implementation of lightweight Virtual Machines (VMs) that feel and perform like containers, but provide the workload isolation and security advantages of VMs. https://katacontainers.io/
kubesploit - Kubesploit is a cross-platform post-exploitation HTTP/2 Command & Control server and agent written in Golang, focused on containerized environments.
Gitkube - Build and deploy docker images to Kubernetes using git push