+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Session Hijacking with Reverse Proxy.. (/showthread.php?tid=6037137)
Session Hijacking with Reverse Proxy.. - Null - Dec 31, 2019
Hey,
It's been a while since i've pose something here, anyway..
I've gotten a reverse proxy set on some PC which i'm trying to steal a session off, is this achievable in any way ?
I don't want to log in with my browser using his IP as that's clearly a different session and it may trigger stuff as mobile verification etc..
Help would be much appreciated <3
RE: Session Hijacking with Reverse Proxy.. - RCE - Dec 31, 2019
Achieving full session hijacking with only a reverse proxy is not possible,
You can use HVNC to clone the current session and avoid security issues like 2fa.
RE: Session Hijacking with Reverse Proxy.. - Mr. Robot - Dec 31, 2019
Depends on your full setup really. What site specifically, what country and what browser.
RE: Session Hijacking with Reverse Proxy.. - gsxrest8 - Jan 1, 2020
hi Im interested to buy plz send me PM
RE: Session Hijacking with Reverse Proxy.. - Null - Jan 1, 2020
(Dec 31, 2019 12:33 PM)Mr. Robot Wrote: Depends on your full setup really. What site specifically, what country and what browser.
chrome and it's twitter.
RE: Session Hijacking with Reverse Proxy.. - Mr. Robot - Jan 1, 2020
(Jan 1, 2020 12:39 PM)Null Wrote: chrome and it's twitter.
Do they have 2auth enabled?
RE: Session Hijacking with Reverse Proxy.. - Null - Jan 1, 2020
(Dec 31, 2019 12:32 PM)RCE Wrote: Achieving full session hijacking with only a reverse proxy is not possible,
You can use HVNC to clone the current session and avoid security issues like 2fa.
sorry but i don't understand what do you mean by HVNC, is that anything different from remote desktop connection?
(Jan 1, 2020 12:49 PM)Mr. Robot Wrote: Do they have 2auth enabled?
SMS verification yeah
RE: Session Hijacking with Reverse Proxy.. - Mr. Robot - Jan 1, 2020
(Jan 1, 2020 01:07 PM)Null Wrote: sorry but i don't understand what do you mean by HVNC, is that anything different from remote desktop connection?
SMS verification yeah
I don't know the full setup with twitter but what i'd recommend is setting up a twitter with 2fa and see what you can accomplish on your own account for testing.
RE: Session Hijacking with Reverse Proxy.. - Null - Jan 1, 2020
(Jan 1, 2020 01:21 PM)Mr. Robot Wrote: I don't know the full setup with twitter but what i'd recommend is setting up a twitter with 2fa and see what you can accomplish on your own account for testing.
using just a reverse IP will do nothing, it's like using two browsers on same computer to log on the website so it will treat each browser as a separate session, i need to copy the session somehow.
RE: Session Hijacking with Reverse Proxy.. - Mr. Robot - Jan 1, 2020
(Jan 1, 2020 01:23 PM)Null Wrote: using just a reverse IP will do nothing, it's like using two browsers on same computer to log on the website so it will treat each browser as a separate session, i need to copy the session somehow.
I don't know if taking a session via something like zANTI or droidsheep would work in this case.
RE: Session Hijacking with Reverse Proxy.. - Null - Jan 1, 2020
(Jan 1, 2020 01:24 PM)Mr. Robot Wrote: I don't know if taking a session via something like zANTI or droidsheep would work in this case.
I'm not sure if i can use these with a reverse proxy, droidsheep alone fails to steal https sessions anyway iirc, i will do some research now that you mentioned this i kind of totally forgot i could do that lol
Update: I've successfully initiated a HVNC connection with Ozone RAT and it's so freaking awesome, the only problem is that the PC is disgustingly old so it's a pain in the ass to navigate around.
I was using Quasar Initially
RE: Session Hijacking with Reverse Proxy.. - Youssef Sherif - Jan 18, 2020
Spoiler (Click to View)