3 ms·
With HTTPS a lot of this doesn't work anymore. You generally need to install a MITM certificate on the target device so that it doesn't say "HEY EVERY WEBSITE Y
by runnerup 4y ago
With HTTPS a lot of this doesn't work anymore. You generally need to install a MITM certificate on the target device so that it doesn't say "HEY EVERY WEBSITE YOU VISIT HAS A CERTIFICATE ISSUE!" and fail to load unless you find an esoteric button/link/series of clicks that lets you load the insecure page.
- ospray 4y agoAs a pen tester this ^, controlling the network doesn't help for browser stuff. The fastest way is usually phishing.
- hsbauauvhabzb 4y agoYou can capture netntlm hashes if you control the network, but you’d still have to crack them. HSTS and secure cookie flags help a lot with sslstrip type attacks though.