search

foospidy / payloads

Git All the Payloads! A collection of web attack payloads.
GNU General Public License v3.0
3.63k stars 968 forks source link

which one do i need XSS or DNS rebinding for evil twin ? #4

Open minanagehsalalma opened 5 years ago

minanagehsalalma commented 5 years ago

how can i perform dns rebinding using evil twin in local level ? as the title says i want to perform this attack https://sinister.ly/Thread-DNS-Rebinding-Attack

using evil twin on local level

the curl command to login into the router

curl "http://192.168.1.1/" --data "frashnum=&action=login&Frm_Logintoken=25&Username=admin&Password=admin"
the curl command to get the page that contains the wifi password

curl -v -X GET "http://192.168.1.1/getpage.gch?pid=1002^&nextpage=net_t.gch" -o 565.html
this how i was planing to perform the attack evil twining a wifi using fluxion or whatever .... when the user opens the captive portal sign in network page (that has dns rebinding scripts in it )is detected we stop the ddos ... the user auto connects to his wifi then the page refreshes and execute the dns rebinding attack to get the wifi password from his router ....

but now i don't know how will get the html file back if want to use it in local level only I thought about another way by enabling the second ssid instead of the getting WiFi password

and there is a second problem is how will the page refresh when the server is offline .

can we make it check if it's connected the internet if yes then execute the code ?!

what do you think folks ?

guschoYB commented 2 years ago

En español señor araña por favor

minanagehsalalma commented 2 years ago

@guschoYB sorry no Español