Загрузка видео...

Не удалось загрузить видео

На главную

Okta chained with Azure with auto MFA subscription for Okta and frame-buster bypass to perform Bitb ! Evilginx is really nice to setup custom phishing campaign whatever the environment is... Phishlet available here :

OtterHacker's profile picture

OtterHacker

7,521 subscribers

42,029 просмотров • 1 год назад •via X (Twitter)

Новости и политикаНаука и технологии
LIVE

Anya Rossi• Live Now

Private livecam show

Комментарии: 3

Фото профиля Kuba Gretzky
Kuba Gretzky1 год назад

Well done! This is amazing. I'm very happy to see BITB is still doable with some extra JS replacements to remove the click-jacking protections.

Фото профиля Recon
Recon1 год назад

The Right Way to Multisig 1 hour and 40 minutes going deep on vulnerabilities tied to Governance and Multisigs Providing a plethora of tools to mitigate this - Stop leaking your Safe Txs info - Protect yourself against wrench attacks - How to not get phished when signing Safe Txs - 3 Contracts to make most governance setup safer - Great designs to remove governance when you don't need it @theSouilos : Operational Security in Web2.5 @go__su__to : (Safe) Multisigs: 3 Quick Security Considerations @Elliot0x DAO Operation Security: securing everything from deployment scripts to treasury @GalloDaSballo : The simplest governance setup that doesn't suck

Фото профиля MRX
MRX1 год назад

👌

Похожие видео

🚨 Evilginx Pro release is coming soon 🔥 I've just finished rewriting Evilpuppet to prepare it for release. Here is a demo of how it allows red teams to bypass Google's modern anti-phishing protections. 🪝🐟 ⏰ Get 20% OFF Evilginx Mastery course:
2:16

🚨 Evilginx Pro release is coming soon 🔥 I've just finished rewriting Evilpuppet to prepare it for release. Here is a demo of how it allows red teams to bypass Google's modern anti-phishing protections. 🪝🐟 ⏰ Get 20% OFF Evilginx Mastery course:

Kuba Gretzky

43,932 просмотров • 2 лет назад

I'm currently working on reviving the OG social engineering technique for phishing attacks to be natively supported in Evilginx Pro. The Browser-in-the-Browser (BITB) technique (pioneered by mr.d0x) is making a well-deserved comeback soon. - Displays a fake OS pop-up window with the phishing page rendered within. 🖼️ - Customisable URL in the pop-up window's address bar to spoof the legitimate domain. 🔗 - Rendered pop-up window supports moving and resizing. ↔️ - Evades IFraming protections. 🔓 - Auto-detects Windows & macOS (light/dark modes) to make the pop-up window match the visitor's OS theme. 🎨 - Displays any web page in the background to support your social engineering pretext. 🖌️ I will soon release a full-length demo video to demonstrate how it works. For the time being, enjoy the sneak peek of BITB paired with the latest Google phishlet using Phishlets 2.0. Made exclusively for vetted cybersecurity professionals. Coming soon to Evilginx Pro. 🪝🐟
0:33

I'm currently working on reviving the OG social engineering technique for phishing attacks to be natively supported in Evilginx Pro. The Browser-in-the-Browser (BITB) technique (pioneered by mr.d0x) is making a well-deserved comeback soon. - Displays a fake OS pop-up window with the phishing page rendered within. 🖼️ - Customisable URL in the pop-up window's address bar to spoof the legitimate domain. 🔗 - Rendered pop-up window supports moving and resizing. ↔️ - Evades IFraming protections. 🔓 - Auto-detects Windows & macOS (light/dark modes) to make the pop-up window match the visitor's OS theme. 🎨 - Displays any web page in the background to support your social engineering pretext. 🖌️ I will soon release a full-length demo video to demonstrate how it works. For the time being, enjoy the sneak peek of BITB paired with the latest Google phishlet using Phishlets 2.0. Made exclusively for vetted cybersecurity professionals. Coming soon to Evilginx Pro. 🪝🐟

Kuba Gretzky

34,248 просмотров • 1 месяц назад

‼️ A threat actor operating under the alias petrushka is selling a phishing-as-a-service (PhaaS) platform called Bluekit. The service offers 40+ phishing templates, Evilginx-based adversary-in-the-middle capabilities, 2FA bypass with geolocation and browser spoofing, antibot cloaking, cookie and credential harvesting, AI voice cloning, and bulletproof hosting with Monero payment support.
1:33

‼️ A threat actor operating under the alias petrushka is selling a phishing-as-a-service (PhaaS) platform called Bluekit. The service offers 40+ phishing templates, Evilginx-based adversary-in-the-middle capabilities, 2FA bypass with geolocation and browser spoofing, antibot cloaking, cookie and credential harvesting, AI voice cloning, and bulletproof hosting with Monero payment support.

Dark Web Informer

52,514 просмотров • 4 месяцев назад

Is reverse proxy phishing slowly dying? 💀🎣 This is what I've been trying to find out during the past several months. Major websites have caught up and vastly improved their security, successfully detecting malicious traffic originating from reverse-proxy phishing servers. The attackers have changed their tactics and begun utilising a new method that involves using a real web browser to sign in on the phished user's behalf. In the video I've just released, I am demonstrating a live demo of a modern phishing attack using the Credential Relay Phishing technique, which evades all current anti-phishing measures deployed against reverse-proxy phishing. To simulate a phishing attack against a Google account secured with FIDO MFA, I am using the latest features of Evilginx Pro to downgrade the FIDO MFA to less secure & phishable MFA alternatives. Additionally, the attack simulation employs a Browser-in-the-Browser social engineering technique to spoof the phishing URL in the address bar of the fake pop-up window, displaying the sign-in page. Everything you see in the video is ready to use in the latest beta version of Evilginx Pro, available exclusively to vetted cybersecurity professionals working within cybersecurity companies or internal red teams. Evilginx Pro's latest features include: Phishlets 2.0: A complete rewrite of the old phishlets format now allows for modification of every part of HTTP traffic going through the reverse proxy server. The new format allows hosting of static website content utilising external modules such as Evilpuppet to simulate Credential Relay Phishing attacks. Downgrading FIDO MFA: With the most recent implementation of Evilpuppet, it is now possible to control a separate background browser session and sign in on behalf of the phished user, allowing the attacker to be the one responsible for choosing which MFA method the user should authenticate with. Browser-in-the-Browser: It is now possible to embed any phishing page within a fake browser pop-up window, rendered with JavaScript and stylised for the OS on which the page is displayed. This enables the construction of extremely convincing social engineering attacks, as the URL in the pop-up window can be spoofed to any value using legitimate hostnames. If you want to use these features in your next red team engagement or assess your company's readiness against modern phishing attacks, make sure to give Evilginx Pro a try. Hope you enjoy the video! 💗 Happy phishing! 🪝🐟 Kuba
12:59

Is reverse proxy phishing slowly dying? 💀🎣 This is what I've been trying to find out during the past several months. Major websites have caught up and vastly improved their security, successfully detecting malicious traffic originating from reverse-proxy phishing servers. The attackers have changed their tactics and begun utilising a new method that involves using a real web browser to sign in on the phished user's behalf. In the video I've just released, I am demonstrating a live demo of a modern phishing attack using the Credential Relay Phishing technique, which evades all current anti-phishing measures deployed against reverse-proxy phishing. To simulate a phishing attack against a Google account secured with FIDO MFA, I am using the latest features of Evilginx Pro to downgrade the FIDO MFA to less secure & phishable MFA alternatives. Additionally, the attack simulation employs a Browser-in-the-Browser social engineering technique to spoof the phishing URL in the address bar of the fake pop-up window, displaying the sign-in page. Everything you see in the video is ready to use in the latest beta version of Evilginx Pro, available exclusively to vetted cybersecurity professionals working within cybersecurity companies or internal red teams. Evilginx Pro's latest features include: Phishlets 2.0: A complete rewrite of the old phishlets format now allows for modification of every part of HTTP traffic going through the reverse proxy server. The new format allows hosting of static website content utilising external modules such as Evilpuppet to simulate Credential Relay Phishing attacks. Downgrading FIDO MFA: With the most recent implementation of Evilpuppet, it is now possible to control a separate background browser session and sign in on behalf of the phished user, allowing the attacker to be the one responsible for choosing which MFA method the user should authenticate with. Browser-in-the-Browser: It is now possible to embed any phishing page within a fake browser pop-up window, rendered with JavaScript and stylised for the OS on which the page is displayed. This enables the construction of extremely convincing social engineering attacks, as the URL in the pop-up window can be spoofed to any value using legitimate hostnames. If you want to use these features in your next red team engagement or assess your company's readiness against modern phishing attacks, make sure to give Evilginx Pro a try. Hope you enjoy the video! 💗 Happy phishing! 🪝🐟 Kuba

Kuba Gretzky

25,614 просмотров • 1 месяц назад

Remember when I told you guys the best piece of equipment to perform Split Squats with is a Smith Machine? Yeah, well… I LIED The BEST piece of equipment to perform Split Squats with is actually a Rogers Squat Pro The setup and execution here is simply MASTERFUL
0:58

Remember when I told you guys the best piece of equipment to perform Split Squats with is a Smith Machine? Yeah, well… I LIED The BEST piece of equipment to perform Split Squats with is actually a Rogers Squat Pro The setup and execution here is simply MASTERFUL

Dean Turner

36,401 просмотров • 6 месяцев назад

I've just updated the M365 2.0 phishlet for Evilginx Pro with full Browser-in-the-Browser compatibility. 🪝🐟 To remove frame-busting code from any website (allowing it to be iframed): - Remove the "Content-Security-Policy" and "X-Frame-Options" HTTP headers. - Find and remove JavaScript that references "top.location" or "self !== top". - Remove "target='_top'" from HTML forms. Let me know if you'd like me to make a hands-on tutorial showing how to identify and remove frame-busting code from the MS sign-in page using Chrome DevTools and Burp Suite.
0:33

I've just updated the M365 2.0 phishlet for Evilginx Pro with full Browser-in-the-Browser compatibility. 🪝🐟 To remove frame-busting code from any website (allowing it to be iframed): - Remove the "Content-Security-Policy" and "X-Frame-Options" HTTP headers. - Find and remove JavaScript that references "top.location" or "self !== top". - Remove "target='_top'" from HTML forms. Let me know if you'd like me to make a hands-on tutorial showing how to identify and remove frame-busting code from the MS sign-in page using Chrome DevTools and Burp Suite.

Kuba Gretzky

11,955 просмотров • 19 дней назад

Azure Developers – .NET Day is on it's way! Join us on April 30th for a full day dedicated to .NET developers and the Azure ecosystem with an online event packed with expert-led sessions. Learn more here 👉
0:29

Azure Developers – .NET Day is on it's way! Join us on April 30th for a full day dedicated to .NET developers and the Azure ecosystem with an online event packed with expert-led sessions. Learn more here 👉

.NET

11,678 просмотров • 2 лет назад

Clerk is now available on the Vercel Marketplace! With one-click setup, automatic environment variable sync, and unified billing through Vercel, it's easier than ever to integrate Clerk into your Vercel projects.
0:39

Clerk is now available on the Vercel Marketplace! With one-click setup, automatic environment variable sync, and unified billing through Vercel, it's easier than ever to integrate Clerk into your Vercel projects.

Clerk

32,902 просмотров • 1 год назад

People used to say San Francisco was dead. Okta CEO Todd McKinnon says those fears were totally overblown: “How many people who moved to Miami are now coming back?” “Is the government perfect? No. Is any government perfect? No. But it's an amazing place, and all the people still want to come here.”
1:09

People used to say San Francisco was dead. Okta CEO Todd McKinnon says those fears were totally overblown: “How many people who moved to Miami are now coming back?” “Is the government perfect? No. Is any government perfect? No. But it's an amazing place, and all the people still want to come here.”

TBPN

22,211 просмотров • 6 месяцев назад

🇺🇸⚠️ SHOCKING - James O'Keefe Exposes Government Conspiracy to Frame Citizens at January 6th Protest. What is SHOCKING is AOC is calling the shots with Biden and Pelosi. Who is really running the show here?
2:11

🇺🇸⚠️ SHOCKING - James O'Keefe Exposes Government Conspiracy to Frame Citizens at January 6th Protest. What is SHOCKING is AOC is calling the shots with Biden and Pelosi. Who is really running the show here?

Paul Kikos 🌐

297,174 просмотров • 3 лет назад

GHOST X BELLE DELPHINE The cutest gaming setup is here! 🫧 Get the Limited Bathwater Edition Keyboard Bundle with a Custom Bathwater Container Keycap, and a chance to win one infused with Belle’s genuine bathwater. Grab yours now!
0:45

GHOST X BELLE DELPHINE The cutest gaming setup is here! 🫧 Get the Limited Bathwater Edition Keyboard Bundle with a Custom Bathwater Container Keycap, and a chance to win one infused with Belle’s genuine bathwater. Grab yours now!

Ghost Keyboards

1,236,534 просмотров • 1 год назад

"This is a 26-man group here, and I'm just here for whatever the team needs me to do. Whatever that is, I'm going to do it." Ronny Mauricio meets with Steve Gelbs after his walk-off hit!
1:39

"This is a 26-man group here, and I'm just here for whatever the team needs me to do. Whatever that is, I'm going to do it." Ronny Mauricio meets with Steve Gelbs after his walk-off hit!

SNY Mets

40,490 просмотров • 4 месяцев назад

I put my plushy inside a virtual environment. I'm trying to figure out very accurate prop tracking between me and whatever I am interacting with. You can see the plushy reacts with my fingers which is really cool
0:32

I put my plushy inside a virtual environment. I'm trying to figure out very accurate prop tracking between me and whatever I am interacting with. You can see the plushy reacts with my fingers which is really cool

CodeMiko

235,391 просмотров • 8 месяцев назад

Christmas is going to the dogs. #ACharlieBrownChristmas is free to stream on Apple TV December 13-14. Available anytime with a subscription.
0:32

Christmas is going to the dogs. #ACharlieBrownChristmas is free to stream on Apple TV December 13-14. Available anytime with a subscription.

Apple TV

61,225 просмотров • 8 месяцев назад

The name of the movie is The Nanny Diaries with Scarlett Johansson, Laura Linney and Paul Giamatti . They really out perform here
2:25

The name of the movie is The Nanny Diaries with Scarlett Johansson, Laura Linney and Paul Giamatti . They really out perform here

ladyperpetual

1,026,213 просмотров • 2 месяцев назад

The full trailer for the #FFXIV x #MHWilds crossover is here! Get ready to face Guardian Arkveld in a brand-new environment, available with the release of Patch 7.35 on October 7!
2:13

The full trailer for the #FFXIV x #MHWilds crossover is here! Get ready to face Guardian Arkveld in a brand-new environment, available with the release of Patch 7.35 on October 7!

FINAL FANTASY XIV

922,291 просмотров • 10 месяцев назад

Yoongi is looking for Jimin to perform with him; this is the cutest thing to see today.
0:38

Yoongi is looking for Jimin to perform with him; this is the cutest thing to see today.

⋆

55,010 просмотров • 5 месяцев назад