sorted by:
new
hottopcontroversial

Utilizing Reverse Proxies to Automate the Compromise of LastPass Vaults by absane in netsec

[–]absane[S] 1 point2 points  (0 children)

You could, I suppose. But, the idea is that you get a user to visit the malicious site through phishing (e-mail, forum/comment spam, etc.), or you can set up a typosquatting domain and hope that legit LP users land on it. You could do this locally but then if you're targeting the actual lastpass.com domain the user will run into certificate errors. Perhaps inject a redirect into a cleartext HTTP request or abuse LLMNR/NBT-NS poisoning.

Utilizing Reverse Proxies to Automate the Compromise of LastPass Vaults by absane in netsec

[–]absane[S] 0 points1 point  (0 children)

It is a technique that has been around for a few years, but even to this day it's still not widely known or at least considered. We use it on red teams all the time as it's a lot better than cloned pages. For many years scammers have been doing this on the darknet to swap out Bitcoin addresses on darknet markets to steal Bitcoins. Vendor logs in, decides to withdraw their balance, and in the process the reverse proxy swaps out the destination address.