+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: Spoofing a different device type to fool Gmail? (/showthread.php?tid=6251547)
Spoofing a different device type to fool Gmail? - laguerre2 - Sep 13, 2023
If I know the exact information about the device type that someone uses to login to Gmail, is there any way to spoof what I'm using to login so as to make Google not stop the login with a security check? Making my machine look like, say, a specific model of MacBook Pro, maybe even with the same MAC address.
Or is there an online resource where I can login through an emulator, for the same effect?
The same would go with Instagram, I suppose.
RE: Spoofing a different device type to fool Gmail? - BiNBo - Sep 13, 2023
It's important to note that modern authentication systems, like those used by Google, rely on a variety of factors to verify the identity of the user and the device. Simply changing your device type or MAC address will likely not be sufficient to bypass security checks.
RE: Spoofing a different device type to fool Gmail? - DramaKing - Sep 13, 2023
(Sep 13, 2023 12:30 PM)BiNBo Wrote: It's important to note that modern authentication systems, like those used by Google, rely on a variety of factors to verify the identity of the user and the device. Simply changing your device type or MAC address will likely not be sufficient to bypass security checks.
Quite so. I have a theory that the browser fingerprint is cookie-based, as well as using the user agent, and possibly other browser data. You'll need the AppData\Local\Chrome folder from the target in the case of Chrome for Windows and AppData\Roaming\Microsoft \Protect. Then decrypt Login Data and Cookies with the correct DPAPI masterkey, transfer the Google folder to your AppData folder, re-encrypt with your masterkey, and spoof the user agent. You may still trip Google's 'sus activity' detection based on the IP address that you're using.