My concept is this:

  1. Client connects to Malicious\Eviltwin AP
  2. Client connects to www.facebook.com but this one is a fake offline site by the fake dns server
  3. Client enters user and password ---> attacker gets credentials
  4. Attacker use the creds to enter into 2Factor Auth page of facebook
  5. Attacker replicate/prompts 2FA fake page also offline and gets the 2FA Code
  6. Attacker gain full access to the account
  7. Sends error message to client and then prompt him into the real facebook

My questions are:

  • Is this thing working in a real scenario? 2FA can't block access of the attacker?
  • Can you host offline https site and fake certificates to make less suspicious the site?
  • I don't understand what you're trying to accomplish, and I don't understand how the user connects to an offline site in step 2.
    – MCW
    Commented Nov 19, 2015 at 14:00
  • could you also explain your questions a bit more? Particularly the first one? I do not understand what 2FA can't block access of the attacker? means... Commented Nov 19, 2015 at 14:11

3 Answers 3


Seems like your intent is to defeat Two-Factor Authentication. There are a few ways to do this, some of which use your setup.

What is Two-Factor Authentication?

Two-Factor Authentication is essentially an added layer of security. If someone steals your password, and you have 2FA enabled, it is unlikely that they'd be allowed to log in without additional login details. For example, the World of Warcraft authenticator, a text message, or an email containing an access code.

Is Your Attack Possible?

  1. Is this thing working in a real scenario? 2FA can't block access of the attacker?

This is two questions:

  1. This is likely working in a real scenario.
  2. Correct, 2FA is relatively dumb when it comes to detecting something like this. 2FA only tries to verify, with an additional layer of security, that you are who you say you are when connecting from an unknown source.

However, https poses a challenge. How do you get the user to install a fake certificate in their browser? Most browsers are going to warn the individuals right off the bat if something is going on. Do you think most users will click, "I understand the risks, let me visit anwyay"?

You may not even need to use ssl in some cases. You could probably redirect them to http:// instead of https://, and they wouldn't notice it. A tech-savvy user may not even realize it.

Moreover, I would modify your attack:

  1. Collect their browser fingerprint
  2. After they attempt to login, redirect them to the true Facebook website with a login action.
  3. Use their browser fingerprint to log in.

Why? Because Facebook will alert them of the login. If it matches the IP address they're connecting from, and it shows the same browser fingerprint, then Facebook would likely presume you're just using Incognito mode with another browser window since your cookie sessions are different.

  1. Can you host offline https site and fake certificates to make less suspicious the site?

What you are describing is essentially a man-in-the-middle attack alongside DNS hijacking for the purposes of phishing.

Yes, this is definitely possible. I've done something like this before as a test to try and defeat World of Warcraft's authenticator (I was bored, and wanted to see if it could be done; only did it to myself), and it worked pretty well - but I did not use DNS hijacking for that, only a MiTM.

How do you defeat Two-Factor Authentication?

I realize some of these methods will not be a direct response to your question. I'm simply providing an alternative viewpoint, as your goal is to break 2FA. You have to think outside the box.

  • In many cases, 2FA can be defeated by a keylogger / trojan.

    • "But Mr. Buffalo, why would I use a keylogger? How would I even infect them?" If you control the rogue access point, you can direct the user to a fake login page, or an EULA page with a "continue" button, and you can host a drive-by-download exploit on the page. Most users aren't going to look for this.
    • In cases where different IP addresses and browser fingerprints are detected by the login system and rejected, such as World of Warcraft's secret auto-ban program that bans individuals connecting to North American servers who are located in China, and other "high-risk" countries, even if they're legitimate users, then you can defeat these detection systems by using the victim's internet connection as a proxy.
  • 2FA can be defeated with your method, but would be even better if modified with the above suggestions.

    • In cases of web browsing, you should also steal the victim's browser fingerprint and use it. This is a lot more work than you think, but if you pull it off, then it will appear to originate from the victim's machine, and not yours. Scary, isn't it? Someone could impersonate you with incredible precision, and even get you in trouble for breaking the law when it wasn't you who did it. This is a good reason why IP addresses can't be considered a person.

In either scenario, it requires a lot of work.


It seems like you have already tried it; what were the results? In theory your attack could work however there are a few key items to consider:

  • The biggest hold up is time, you would need to automate this process so you can essentially prompt the victim in near real time for the 2FA key. This may lead to issues because of its complex setup and maintenance.
  • Facebook does log the IP addresses and last login attempts so a savvy user could identify this, but this isnt so much of a show stopper.
  • Some 2FA setups may detect that the 2FA device and actual browser logging into facebook are mismatched and fail to log in (or prompt for more security questions).

The bottom line is that it may simply be easier to perform a rubber hose attack to get whatever data you are really after because at the end of the day your attack requires a lot of setup and is really only effective if you know at least some amount about your intended target.

  • Yep i tried it but only on http...the HTTPS needs a more complex structure with fake certificates.. It's just a phishing offline site with local DNS redirection that allows to host fake clones of online sites ...you have also to clone the 2FA pages and host them offline
    – S4mick
    Commented Nov 19, 2015 at 13:58
  • Yeah if you are trying to clone an HTTPS and you want to use the proper TLS cert, that simply wouldnt work -unless you had the TLD TLS cert... However, you could simply create your own cert and use that to make it https as most users (especially your intended victims) do not check to see who the cert is signed by but rather only check to see if there is actually a cert (that is just look at the httpS portion of a url). Also, if you are just trying to steal credentials there are far easier ways if you already pwn the network they are connected to... Commented Nov 19, 2015 at 14:05

To trigger the server to make a 2FA Code, you need to be the server, using a social engineering attack vector will not be enough, you can only duplicate the webpage but not the code that generates and sends the key....

Assuming that you can build a server, your server must have the original servers key, has to be trusted by the receivers 2FA system and must mimic it in it's entirety.

Assuming (1/Million Chance), that you even can do this, the 2FA upon entry invalidates (i.e. After the 2FA is used, it is worthless) so even if you harvest it, it is invalid.

  • Actually i replicated the facebook page and also the script in PHP for login and i made a proof of concept that logs the password on a txt file via the login.php script..so it works
    – S4mick
    Commented Oct 20, 2015 at 10:54
  • I think the suggestion @S4mick is making is that he would induce the real facebook system to request 2FA from the user, whilst simultaneously asking the user to enter the 2FA response into his spoofed facebook site. Commented Oct 20, 2015 at 10:56
  • So, is it even possible, the process @S4mick is using is a normal phishing script, nothing new but if you can replicate the 2FA Server and Algorithm and get the key of the 2FA user, that is something interesting Commented Oct 20, 2015 at 11:02
  • No he's not trying to replicate the 2FA Server and Algorithm, he's suggesting using social engineering to man in the middle attack the 2FA process. :) Commented Oct 20, 2015 at 11:07
  • Okay, but to get the 2FA output, he needs the output, which he can't using a simple social engineering attack, it'll need to be more complex Commented Oct 20, 2015 at 11:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .