+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Blackhat Training (https://hackforums.net/forumdisplay.php?fid=405)
+---- Thread: Session hijacking to bypass 2FA? (/showthread.php?tid=6128015)
Session hijacking to bypass 2FA? - albyaty - Dec 17, 2020
I am currently using a RAT, I am trying to get the cookies or login session for some victims but so far the cookie grabbing plugin that is intergrated in the RAT does not work.
Does anybody have any alternatives that I can use in this case? Will I have to use evilginx2? are there any other options?
if I already have access to the victim's PC, is it that hard to grab the cookie?
Thanks in advance for the help! 😁😁
RE: Session hijacking to bypass 2FA? - jinpingxi - Dec 20, 2020
(Dec 17, 2020 01:22 PM)albyaty Wrote: I am currently using a RAT, I am trying to get the cookies or login session for some victims but so far the cookie grabbing plugin that is intergrated in the RAT does not work.
Does anybody have any alternatives that I can use in this case? Will I have to use evilginx2? are there any other options?
if I already have access to the victim's PC, is it that hard to grab the cookie?
Thanks in advance for the help! 😁😁
If the program lets you download a file on the target machine, best bet would be to just send another rat that can cookie log.
Otherwise, you could just download everything in their chrome directory and then parse those cookies out yourself
RE: Session hijacking to bypass 2FA? - this.0xd - Dec 24, 2020
I don't know much about RATing, but session ids can be grabbed from inside a browser easily. So if they're afk then you can grab it through that?
RE: Session hijacking to bypass 2FA? - kuebiko - Dec 24, 2020
Some RAT's have reverse browser features. If not, you can try importing cookies into a browser that supports that kind of thing (e.g. Genesium). Using reverse proxy/a nearby IP address is also critical to bypass 2fa on most platforms that support it.
RE: Session hijacking to bypass 2FA? - albyaty - Jan 16, 2021
(Dec 20, 2020 06:01 AM)jinpingxi Wrote: If the program lets you download a file on the target machine, best bet would be to just send another rat that can cookie log.
Otherwise, you could just download everything in their chrome directory and then parse those cookies out yourself
I got the cookie file but chrome cookies are encrypted as far as I know so it is basically useless
RE: Session hijacking to bypass 2FA? - KalisiRAM - Jan 18, 2021
Token grab or check the saved passwords and if they have 2FA try to sim jack
RE: Session hijacking to bypass 2FA? - D3adF00l - Apr 11, 2021
The private key used for decryption is inside the host machine. So the cookies should be decrypted only in the host and then can be grabbed away. The private key should be not exportable.
The encryption is performed by using WinDPAPI so you should write a program that call the decryption function (should be CryptUnprotectData function (dpapi.h)) to decrypt cookies.
Remember, the private key is in the host machine... and Google is a good mate.