Modlishka VS muraena

I remember some big service many years ago (maybe yahoo?) had a “memorable image” or something that was associated with your username as some kind of anti phish metric. Of course nowadays that would be trivial to bypass with something like Modliskha or a different reverse proxy passing through the website content.

https://github.com/drk1wi/Modlishka

2FA can be "bypassed" by using some phishing and setup like https://github.com/drk1wi/Modlishka

Apps would not help in this case. OTP, Push, SMS, Phone calls are all possible to be compromised using this attack (via reverse proxy for example).

The MFA implemented in Azure is not phishing-proof. This can be phished using a reverse proxy, and the push notification method is often becoming a bad habit for users to always approve ("this was from Microsoft, so it looked legit"). The only phishing proof method is using FIDO2 authenticators, but that is Passwordless, not MFA

Step 1. The user becomes a victim of an advanced phishing attack with MFA phishing included, so the attacker's phishing script logs in using both password and MFA code. Step 2. The attacker uses the session cookie to impersonate the victim. Step 3 is the same as with Option A.

* https://github.com/drk1wi/Modlishka

GitHub - drk1wi/Modlishka: Modlishka. Reverse Proxy.

See things like https://github.com/drk1wi/Modlishka

Hello there people of the craft! I'm concerned about the account migration not being the digital heaven dinnerbone has announced, While moving the accounts to the microsoft data seems safer at first, there is a few reasons this can be quite bad news, and this feels like when we were forced to have a google+ accounts. First off, what is technically better with the new authentification system? Like really, expect the chance of microsoft randomly locking your account because you didn't got your password right the first time, what's so great? A anti password brute force system? We already had that with mojang I believe. And it is not like a lot of accounts are hacked using this system anyways, phishing is actually much more used ( where the attacker trick you with a fake email from mojang, and a link going to a fake login that collect your password when you enter it ). But luckily we will have two-factor authentication to PROTECT US ALL from the dangerous local rusian hacker who desperately wants to steal your minecraft account! Cheese and crackers! 2FA doesn't protect you from that ( check out muraena and necrobrowser to see how that's done ). 2FA is almost worthless, just another process to help the microsoft foundation get more of your personal data.

* https://github.com/muraenateam/muraena