+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Whitehat • Blue Team • Defensive Security (https://hackforums.net/forumdisplay.php?fid=448)
+---- Forum: Pentesting and Forensics (https://hackforums.net/forumdisplay.php?fid=231)
+---- Thread: SEToolkit Question (/showthread.php?tid=5164425)
SEToolkit Question - HFZhyonn - Feb 9, 2016
Hey guys I have been looking into the credential harvester method in the SEToolkiit and I have a question. Let's say I was targeting users that use a specific application on their mobile device. For example the application iFunny. It has no web browser version as it is only available for mobile devices such as iPhone or Android etc. I don't have a login url to clone the website. Is there a way to get around this?
* - zer0pwn - Feb 9, 2016
you would have to intercept the credentials as they're being sent to ifunny's login server. either that or you could make a fake ifunny apk and get an android user to download it
* - Inferno - Feb 11, 2016
and probably the first method wouldnt work cause it would probably have https and not http
* - zer0pwn - Feb 11, 2016
(Feb 11, 2016 09:17 AM)Inferno Wrote: and probably the first method wouldnt work cause it would probably have https and not http
there are still ways to break ssl
* - n3cr0 - Feb 11, 2016
If they are on wifi network would trying a fake router MitM attack with something like sslstrip work. Another far fetched idea maybe phishing attack. (I have only touched on these areas myself please steer me right if im wrong)
* - lIIlIIl - Feb 12, 2016
Create a website that looks like the apps loginpage? Or did i missunderstand the question?
* - BiometriX - Feb 12, 2016
Don't think k4rm4's method would work, they open the app and only connect via api's like OP mentioned no browser involved.
Look into mitm and test it first with your phone