At the end of this tutorial the author gives a few ideas for improving a basic phishing attack.

One of them intrigued me, in particular: Is it possible to use the credentials that a victim enters in your phishing page and use, say Facebook's or Twitter's (or whichever) API and send those credentials to the actual service, hence creating a genuine session so that the victim never realized that they've been phished?

3 Answers 3


Yes it is possible for a phishing site to act as a proxy between the user and the expected website and thereby record/inject data. It would require something more sophisticated than just SSLstrip sitting on the phishing site though.

The URL in the browser would reference the phishing site throughout the session.


I think it all depends how the credentials are actually managed by these APIs. I truly don't know how Facebook or Twitter handle these informations. If the authentication is only done by the username and password, so.. I think it's possible.

But if the username and password are used, in addiction of a third credential that is only available in the victim's computer and is not caught by your phishing page.. that may not work.

If your question is mainly related to the affirmation of the victim never realizing it has been phished, I think it would be very difficult, if not impracticable.

  • The third credential does not help unless it is a device enrollment token - I'm not aware of Facebook or Twitter using such.
    – symcbean
    Mar 22, 2017 at 10:29

As far as I know, this is why we use csrf (Cross-site request forgery) tokens.

Theoretically, anything can submit POST data to a URL which accepts POST data...

Say dodgysite.com/login handles a POST request to log users in. All this site accepts is username / password. Any script should be able to send a request, including your phishing site.

Whilst securesite.com/login may in addition handle a unique csrf token, which wouldn't accept the request if the token doesn't match. As this token is randomly generated every time the login form is loaded, it would be impossible for a malicious actor to submit valid POST data from elsewhere.

In addition to checking each request for a valid csrf token, securesite.com/login should also check the request comes from the same origin (ie, the legit login form on the website).

If these two requirements are not satisfied, then yes, you would be able to interact with the login form from a malicious application.

  • 1
    I don't see how a csrf token provides any protection against a mitm.
    – symcbean
    Apr 21, 2017 at 21:58

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .