跳转至

Phishing MFA

What is MFA？

Multi-factor authentication (MFA) is an identity verification method in which a user must supply at least 2 pieces of evidence, such as their password and a temporary passcode, to prove their identity.

How MFA works

To access sensitive systems and assets—like a banking app, a confidential database or even a restricted office building—users must often pass some form of authentication process. That is, they have to prove they are an authorized user.

In the most basic authentication systems, a password is all it takes. In an MFA security system, users need at least two pieces of evidence, called "authentication factors," to prove their identities.

Say a user is logging into their employer's corporate network, which is protected by an MFA solution. The system would ask for the first authentication factor, typically a username and password combination.

If the first factor is valid, the system will ask for a second. There is more variation in second factors, which can range from one-time passcodes to biometrics and more. If the user wants to access a particularly sensitive part of the network, they may even need to supply a third factor.

The user can only access the system if every required factor checks out. If anything is wrong, the login attempt will fail.

参考：What is Multi-Factor Authentication? | IBM

What is noVNC？

参考：

windows通过浏览器访问noVNC（基于web的远程桌面）-CSDN博客

【noVNC】使用noVNC实现浏览器网页访问vnc（基于web的远程桌面）-CSDN博客

Phishing MFA

Via Proxy MitM

The previous attack is pretty clever as you are faking a real website and gathering the information set by the user. Unfortunately, if the user didn't put the correct password or if the application you faked is configured with 2FA, this information won't allow you to impersonate the tricked user.

This is where tools like evilginx2, CredSniper and muraena are useful. This tool will allow you to generate a MitM like attack. Basically, the attacks works in the following way:

  1. You impersonate the login form of the real webpage.
  2. The user send his credentials to your fake page and the tool send those to the real webpage, checking if the credentials work.
  3. If the account is configured with 2FA, the MitM page will ask for it and once the user introduces it the tool will send it to the real web page.
  4. Once the user is authenticated you (as attacker) will have captured the credentials, the 2FA, the cookie and any information of every interaction your while the tool is performing a MitM.

Via VNC

What if instead of sending the victim to a malicious page with the same looks as the original one, you send him to a VNC session with a browser connected to the real web page? You will be able to see what he does, steal the password, the MFA used, the cookies... You can do this with EvilnVNC