waelmas / frameless-bitb

A new approach to Browser In The Browser (BITB) without the use of iframes, allowing the bypass of traditional framebusters implemented by login pages like Microsoft and the use with Evilginx.
BSD 3-Clause "New" or "Revised" License
321 stars 35 forks source link

Blank page in the BiB microsoft window #4

Closed par-retest closed 5 months ago

par-retest commented 5 months ago

Hi!

First, thanks for your impressive work.

Very recently (less than a week ago), the browser-in-browser window stopped working upon changing pages: the "enter username" page works properly, but as soon as someone enters their login and validates, tries to go back, or does anything, the BiB page becomes blank.

Since minimizing it and clicking on "login with microsoft" shows the next page, it seems that it could be a re-drawing issue? Indeed, commenting this clearInterval makes things work again until the KMSI page, which simply doesn't appear. It can be fixed by changing https://github.com/waelmas/frameless-bitb/blob/main/pages/secondary/script.js#L6 to login/common, but this all seems like hotfixes that don't address the deeper root cause.

Maybe Microsoft changed some things on their end?

waelmas commented 5 months ago

Hey,

Thanks for reporting this and looking into the root cause.

I managed to replicate it too. It seems to happen only when the password page is branded (company logos etc) which seems to execute some kind of state reset or it removes the win-scroll element and injects it again (still investigating).

The clearInterval trick makes sense based on the above assumptions, but indeed it's more of a hotfix with potential side effects.

Looking now into adding some kind state change detection and/or mounting/unmounting of the win-scroll element to trigger the JS logic in those cases too.

Something like:

waelmas commented 5 months ago

Just pushed a fix (changes to pages/secondary/script.js) Commit: https://github.com/waelmas/frameless-bitb/commit/50d481431e37b90f4722ba4d5114d351d7b1ed92

Please open a new issue if you notice something similar again.

par-retest commented 5 months ago

Awesome, thanks! It fixed one of the issue, but not the KMSI one - I'll open a second issue :)