search

ustayready / CredSniper

CredSniper is a phishing framework written with the Python micro-framework Flask and Jinja2 templating which supports capturing 2FA tokens.
Apache License 2.0
1.31k stars 293 forks source link

No 2FA fails #13

Open NikosVlagoidis opened 6 years ago

NikosVlagoidis commented 6 years ago

When I try to spin an instance without the 2FA it fails the creation of the Certificate and leads to the issue #11 .

DakotaNelson commented 6 years ago

Hi @NikosVlagoidis - can you provide steps to reproduce? What command (or series of commands) are you running that results in the error?

NikosVlagoidis commented 6 years ago

Hello I used installation guide on a fresh Digital Ocean droplet. Choose no on two-factor phising. then I got an error for the missing certificates. Even if I put my own certificates with letsencrypt the install.sh script failed. When I decide to put two-factor phising everything worked. Now I cannot reproduce it as everything works fine even without the 2fa.

NikosVlagoidis commented 6 years ago

Testing the module without 2fa and noticed 2 things. No creds kept when even if I successful redirect. And also google calls me for 2 factor. Is that an expected behavior?

NikosVlagoidis commented 6 years ago

Also, I cannot set the config when posting on /config endpoint.

{{domain}}/config?api_token= {{token}} the request is: 

{
    "api_token": "token",
    "enable_2fa": true,
    "module": "gmail"
}

Response is

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
<title>400 Bad Request</title>
<h1>Bad Request</h1>
<p>The browser (or proxy) sent a request that this server could not understand.</p>