- April 21, 2020 at 6:31 pm #34613Mackendy CharlesParticipantApril 23, 2020 at 2:48 pm #34773
Basically there are 2 challenges:
1. Websites that use normal https like zsecurity.org, stackoverflow.com ….etc you should be able to bypass all of these even if accessed directly.
2. Websites that use HSTS like facebook and twitter, these websites will only load over HTTPS if accessed directly because the browser has a list of famous websites that use HSTS, therefore it will only load them over https, the only way around this is to use the custom hstshijack caplet that Zaid provided, this will only work if the user searches for the website using a search engine that does not use HSTS, for example if they use the local google domain such as google.ie to search for facebook / twitter …etc in this case the script will replace the .com at the end with .corn bypassing the list of famous websites that the browser has and allowing us to downgrade these websites to http.
Also please don’t forget to remove the browsing data (cache, history…..etc) before doing the attack, you wouldn’t need to do this in a real life scenario but this happens sometimes when you keep accessing the same website over and over across a very short period of time.
Please don’t hesitate to contact if you need anything else.April 24, 2020 at 4:41 pm #34852Mackendy CharlesParticipant
thank you Mr. VashishtApril 25, 2020 at 3:09 pm #34911
You’re welcome, I’m glad we could help:)April 26, 2020 at 12:29 pm #34992obainostevenParticipant
problem of failed to acquire the virtual box com objectApril 27, 2020 at 4:24 pm #35103
Please open a new discussion in the forum with all the details, and will reply ASAP, for it’s really hard for us to keep track of what several people are doing in the same post.
Thank you for your comprehension.
- You must be logged in to reply to this topic.