Modlishka VS kubesploit

I remember some big service many years ago (maybe yahoo?) had a “memorable image” or something that was associated with your username as some kind of anti phish metric. Of course nowadays that would be trivial to bypass with something like Modliskha or a different reverse proxy passing through the website content.

https://github.com/drk1wi/Modlishka

2FA can be "bypassed" by using some phishing and setup like https://github.com/drk1wi/Modlishka

Apps would not help in this case. OTP, Push, SMS, Phone calls are all possible to be compromised using this attack (via reverse proxy for example).

The MFA implemented in Azure is not phishing-proof. This can be phished using a reverse proxy, and the push notification method is often becoming a bad habit for users to always approve ("this was from Microsoft, so it looked legit"). The only phishing proof method is using FIDO2 authenticators, but that is Passwordless, not MFA

Step 1. The user becomes a victim of an advanced phishing attack with MFA phishing included, so the attacker's phishing script logs in using both password and MFA code. Step 2. The attacker uses the session cookie to impersonate the victim. Step 3 is the same as with Option A.

* https://github.com/drk1wi/Modlishka

GitHub - drk1wi/Modlishka: Modlishka. Reverse Proxy.

See things like https://github.com/drk1wi/Modlishka

Kubesploit

You can find it here: https://github.com/cyberark/kubesploit