My Poor Mistreated Blog

Greetings, all.

As it's probably plainly evident, my success in keeping this thing up to date has been pretty awful. It's not entirely because of laziness, but that's certainly been a factor. 

Just as a life update and partial explanation, I recently moved again. At the same time, I was working on another work certification and managed to pass my GIAC GWAPT (The GIAC Web Application Penetration Tester) certification exam, though it took two tries. I thought about writing a little guide on how I passed it, but figured it was just too close to the original one I posted for the GSEC exam a while ago to be worth it, as most everything from that still applies.

One thing I have been meaning to get a blog post written up about, and will probably start on tonight, is creating a little "how to" for setting up Evilginx. 

For a little backstory, we were running into a lot of AiTM attacks at work where we couldn't figure out how the attackers were compromising the users so efficiently and so quickly. After some digging, we heard about Evilginx which was a AiTM attack toolset, so I started working to create a proof of concept that we could use against some test accounts we controlled to see if we could figure out what was going on.

We quickly realized just how effective this tool was, especially when the attackers put in even a modest amount of effort to create a URL that was reasonably convincing (close to the company name, instead of some of the usual URL's that could go edge-to-edge on a 4K monitor). Between that and the ease that it was able to harvest not just the user's password, displayed in plaintext, and also their active session ID, it was scary to see just how easily attackers were able to spin up VM's and deploy the tool, considering someone like me could figure it out without too much trouble. 

We did manage to figure out some effective counters to this that helped to largely reduce the number of incidents from it, and discovered that things like a Yubikey could almost entirely eliminate the threat at all, as the authentication takes place through a separate side channel that the AiTM server isn't privy to. 

Anyhow, I'll include more detail on that when I finally throw the post together. It was a lot of fun to get some real world "red team" experience, getting to attack my own account and see how it would pop up, and work with the team to find ways to allow us to track and treat these incidents before they escalated.

Until then!