Loading video...

Video Failed to Load

Go Home

I'm currently working on reviving the OG social engineering technique for phishing attacks to be natively supported in Evilginx Pro. The Browser-in-the-Browser (BITB) technique (pioneered by mr.d0x) is making a well-deserved comeback soon. - Displays a fake OS pop-up window with the phishing page rendered within. 🖼️ - Customisable...

34,248 views • 2 months ago •via X (Twitter)

0 Comments

No comments available

Comments from the original post will appear here

Related Videos

Is reverse proxy phishing slowly dying? 💀🎣 This is what I've been trying to find out during the past several months. Major websites have caught up and vastly improved their security, successfully detecting malicious traffic originating from reverse-proxy phishing servers. The attackers have changed their tactics and begun utilising a new method that involves using a real web browser to sign in on the phished user's behalf. In the video I've just released, I am demonstrating a live demo of a modern phishing attack using the Credential Relay Phishing technique, which evades all current anti-phishing measures deployed against reverse-proxy phishing. To simulate a phishing attack against a Google account secured with FIDO MFA, I am using the latest features of Evilginx Pro to downgrade the FIDO MFA to less secure & phishable MFA alternatives. Additionally, the attack simulation employs a Browser-in-the-Browser social engineering technique to spoof the phishing URL in the address bar of the fake pop-up window, displaying the sign-in page. Everything you see in the video is ready to use in the latest beta version of Evilginx Pro, available exclusively to vetted cybersecurity professionals working within cybersecurity companies or internal red teams. Evilginx Pro's latest features include: Phishlets 2.0: A complete rewrite of the old phishlets format now allows for modification of every part of HTTP traffic going through the reverse proxy server. The new format allows hosting of static website content utilising external modules such as Evilpuppet to simulate Credential Relay Phishing attacks. Downgrading FIDO MFA: With the most recent implementation of Evilpuppet, it is now possible to control a separate background browser session and sign in on behalf of the phished user, allowing the attacker to be the one responsible for choosing which MFA method the user should authenticate with. Browser-in-the-Browser: It is now possible to embed any phishing page within a fake browser pop-up window, rendered with JavaScript and stylised for the OS on which the page is displayed. This enables the construction of extremely convincing social engineering attacks, as the URL in the pop-up window can be spoofed to any value using legitimate hostnames. If you want to use these features in your next red team engagement or assess your company's readiness against modern phishing attacks, make sure to give Evilginx Pro a try. Hope you enjoy the video! 💗 Happy phishing! 🪝🐟 Kuba

Kuba Gretzky

25,614 views • 1 month ago

🚨 New Crypto Pop-Up Is Draining Users 🚨 If you use a crypto wallet, you're familiar with the embedded browser pop-up that prompts you to sign transactions. However, scammers are now exploiting this in an updated scam tactic. When a user navigates to a scam site via social engineering, sponsored scam ads, or scam comments on X with a look-alike link, it mirrors the real website, in this case, to claim a Jupiter airdrop (not real). The website mirrors the real site exactly and follows the normal flow: clicking "connect wallet," then detecting which wallets you have installed in the browser. In this VM, I have MetaMask 🦊 and Phantom installed, so it detected both. I was already logged into MetaMask, so when I clicked on it, instead of prompting me within the MetaMask browser extension, it created a new pop-up window (separate browser window) impersonating MetaMask, displaying the URL and mimicking the real MetaMask behavior. Since my MetaMask wallet was empty, it said I "was not eligible". But if I had any funds in the wallet, it would have prompted for a wallet-draining signature/approval. When I tested with Phantom, it followed the same flow. However, because I wasn't logged into Phantom, the fake window impersonating Phantom popped up first, followed by the real Phantom prompt within the browser asking me to log in so that way the scam window pop up could prompt me for a scam approval/signature to drain that wallet after I logged into my legit wallet. While you may be watching this closely and catching the red flags, like the scam Vercel app URL showing in the address bar, many people don't read anything when prompted for a wallet connection or signature. They simply click. This scam has already drained many wallets because people click without taking even one second to review what they're signing. Always, no matter what, take at least a few seconds to review what you're signing in your wallet each time. Something as simple as noticing the URL bar could save you from losing everything….. Stay Safe & Stay Vigilant

NFT_Dreww.eth

48,000 views • 7 months ago

TradingView to Screener & Marketsmith Extension ⚠️Please before asking in comment or DM, how to install, please read the full post, i have given the instructions also, and if you still cant follow it, You will find plenty of video on youtube on how to install the plugin, or ask AI⚠️ 🙏This was a killer timesaver tool for me, Hope it helps all, please share your feedbacks or gratitude in comments, will be sharing more plugin like this in future as well ☑️Overview This Chrome Extension natively integrates with TradingView, adding quick-access buttons to your top chart header. These buttons allow you to instantly view fundamental financial data for the currently active stock symbol on or evaluate it on MarketSmith India. > Features : > Screener New Tab: Opens the consolidated financials page for the current active TradingView symbol in a new browser tab. > Screener Splitscreen: Toggles a bottom-half split screen (iframe) inside the TradingView tab to load the page directly over your charts, letting you perform fundamental and technical analysis synchronously. > Marketsmith New Tab: Opens the stock evaluation page on MarketSmith India for the active symbol in a new tab. > This extension utilizes the Manifest V3 standard APIs and works smoothly across all modern Chromium-based browsers, including: Google Chrome Microsoft Edge Brave Browser Vivaldi Opera Arc Browser ⭐ Installation Instructions (Local/Unpacked) -> 1)Download or keep this entire extension folder on your computer. 1) Download or keep this entire extension folder on your computer: For Google Chrome: type chrome://extensions/ in the address bar. For Microsoft Edge: type edge://extensions/ in the address bar. For Brave: type brave://extensions/ in the address bar. Enable Developer mode using the toggle switch (usually located in the top-right corner). 3) Click the Load unpacked button that appears. 4) In the file explorer popup, choose this exact directory (the folder containing the manifest.json file). 5) The extension is now successfully installed! Open up TradingView to play around with the newly injected buttons in the top header. Github Repo ->

Roshan Kumar

14,810 views • 6 months ago

I've been building a music player with Next.js for fun. Here's a quick demo of how it works (it's open source!) • Demo: • Code: If you want to learn more about how it's built, here's more details ↓ I'm using Postgres (with Drizzle) to store information about the songs and playlists. Audio and image files are stored in Vercel Blob (object storage), and the URLs are then referenced in the database. For the UI, I'm using shadcn/ui (so Tailwind CSS and Radix). This made it easy to copy/paste in some nice components, like the dropdown menus. I built the entire first version of the UI in v0 and then iterated from there, feeding it my Drizzle schema as a source in the project and having it scaffold some of the boilerplate for me: I added support for keyboard navigation (using arrow keys) or vim motions (j/k to go up/down, and h/l to go between playlists and tracks). Also, space to toggle the now playing song, and / to focus the search input. The search function has a nice utility to highlight the currently searched text on the page in yellow. Then, I was exploring how to pass metadata from my application to macOS or iOS. Turns out there's an API for that – MediaSession. Web apps can share metadata about what media is playing (title, artist, album artwork) and sync play/pause/seek with system media controls. Works across modern browsers — even integrates with iOS dynamic island and shows up on lock screens: I set up my app like a PWA – it has a manifest.json file, so it can be installed to my iOS home screen or added to my dock on macOS. On iOS, it then uses the full screen height `100dvh` (dynamic viewport) and has padding on the bottom for the safe area with the `env()` CSS function. Finally, I was able to use the Vercel AI SDK in a script to clean up the metadata on audio files I downloaded from YouTube. Bonus: I even was able to dogfood the React Compiler, which helped me fix a performance bug! That's all! It's fun to make personal software:

Lee Robinson

118,242 views • 1 year ago

As a Twitch streamer, do you struggle with keeping your viewership up when on a BRB or Starting Soon screen? Clip reels are a perfect, fun way to keep attention. And they showcase your content. But they're a LOT of work to maintain. Well.. at least they were😎 What if you could have a simple browser source that automatically played an always-fresh clip reel? What if you could have a simple browser source that would show the clip reel of your last stream, like a "Previously On..." TV show intro? Now you can!! When you use the Highlight Hunter by FrostyTools, you find the best moments from your VOD, automatically. You can already easily turn them into Twitch clips, or download the snippets to edit for a perfect short-form video, or download entire montages of VODs to share with your community. BUT NOW, you can just grab one of two simple browser source links, to pop into your OBS or Meld Studio One of them will roll all your favorited snippets in random order, like a shuffling playlist of your best highlights. Great for BRB screens, or any time you want to entertain with your best moments. The other will play the linear montage of your latest VOD, for a "Previously On..." experience that helps catch viewers up if they missed it or forgot. Great for Starting Soon screens to seamlessly tie the streams together (and pairs great with our Showstarter chatbot feature 😉). The best part? As you continue to use the Highlight Hunter, these update automatically! New favorite snippets since last stream? They're in the reel already! Ran the Highlight Hunter on your latest VOD? Its montage will automatically play on your 'Previously On..' browser source when you start stream up next time. This is a SUPER powerful update; check it out ASAP!

Ken aka Frosty

103,009 views • 10 months ago

A lot of you complaining about shooting in 2k25 dont understand how the shooting actually works and are just calling it bad so let me break it down real quick The shooting itself is pretty EASY, if you cant green your first few shots you're just mistiming and need to learn your timing or get better, for example you can green your first 2 jumpshots very easily. NOW LETS GET TO THE PROBLEM. But after say for example you make 2 shots in a row, MOST OF THE TIME 2k will give you NO GREEN WINDOW at all on the next shot, leaving it completely up to RNG (random) whether your next shot will go in (will most likely miss). So essentially 2k is punishing you for greening multiple shots in a row by forcing you to eventually miss your next shot most of the time. In this clip in a ranked 1v1 match, my opponent greens 2 shots in a row then i confidently leave him WIDE OPEN for the 3rd shot knowing that he will 100% MISS because of the algorithm and he does...then i do the exact same thing again after he makes 2 more shots in a row, i leave him WIDE OPEN for his 3rd shot knowing he will miss again and he does indeed miss... You should not be PUNISHED for timing your jumpshot correctly by being given no green window after you make a sequence of shots, THAT IS THE PROBLEM WITH THE SHOOTING...it is not hard to time your shot in general, the issue is after you make a few shots, you're given NO GREEN WINDOW, which is leaving it up to RNG which should not be a thing. And if there's any brainrot kids who can't understand me saying that the shooting is easy but then also saying that the way they made the algorithm to make you miss is bad, i am specifically talking about the times where it gives you no green window after making a few shots, which is not on every single shot... 2k needs to revert this because it should not be impossible to make specific jumpshots, especially after making a few shots you think you would be rewarded and it would be easier to make the next ones correct? Well they made it harder instead.

HankDaTank

538,428 views • 1 year ago

This is a very nice description of the problem. I think the first part of the solution is to not give into the hyper productivity hype: running a gazillion things in parallel. There's likely only a handful of humans that have the mental make-up to survive the permanent context switches. You can train your brain to become better at it, but there's a limit to that, and I found that it will lead to much worse outcomes in terms of output quality of both you and your clanker. I'm no neuroscientist, but I would assume there's a hard limit on how many things your brain can juggle at a time, probably made worse by the complexity that is code. I generally don't do more than 2-3 things in parallel. I use virtual desktops as "bundle of things that belong to a task", so terminals + editor + browser. Works fine, doesn't need any special OS support, expose on the virtual desktop let's me quickly switch to the task specific app I need. I also have a little pi extension that shows me what GH issue/PR the clanker session is about, with a link I can click to open the issue/PR in the browser. Plus 1 virtual desktop for entertainment, so the brain can get some rest. (better alternative: get up and walk a bit every 45 minutes) Video: - First desktop: pi session for a PR, extension shows me what PR I work on, can click to open in browser, aux terminal for random BS, editor, browser. Yes, I could split instead of having two terminal windows. I'm old. - Second desktop: clawdbot pi session, aux terminal for testing, editor, browser - Third desktop: entertainment booth

Mario Zechner

40,284 views • 7 months ago