Phishing attacks with two factor authentication

Question

Making our own phishing page isn't a big deal. Copying source code from website and modifying link just does our job. But what if we want to add phishing page for 2FA in the same code?

Consider the scenario Attacker and Victim are both on same network (router) without any firewall.

Attacker burps victim with a phishing page and forces to login.

When victim login attacker gets the information. He enters that information through his own device.

Now the website asks for 2FA.So attacker makes a 2FA phishing page and sends it to victim.

Victim unaware that 2FA was he received was for another device inputs the code.

Attacker gets 2FA credentials and inputs it in his device. Maybe it can work.

My question is that is it possible to combine code for login page and 2FA page into single code and how. In short when attacker inputs his login details and clicks login he should directly get 2FA page.

I want method

Answer 1

Yes this is doable. And there are existing platforms that do the heavy lifting for you concerning the typical applications: - https://github.com/ustayready/CredSniper - https://github.com/kgretzky/evilginx2

Conceptually they front the real application and pass on all authentication factors. You can even have the victim use the real application transparently, whilst you harvest credentials, 2fa codes and session identifiers.

Answer 2

I hope this goes without saying, but I assume you have the consent of the "victim" in this situation.

It will require a little more effort than just changing the link, you may have to add some JavaScript

Lets say the page you are sending them requires two inputs in a form

<form id="1" action="...">
  <input type="text" name="username">
  <input type="password" name="password">
</form>

You want to actually put two forms on the page and use javascript to send you the credentials and toggle the forms.

Start with one hidden

<form id="1" action="..." onsubmit="yourJsFunction(this)">
  <input type="text" name="username">
  <input type="password" name="password">
</form>
<form id="2" class="hidden" action="...">
  <input type="text" name="otp">
</form>

When the user submits the form, the data will go to your javascript function and you can then submit the data to your server via Ajax, hide the first form, and display the second one.

<form id="1" action="..." class="hidden" onsubmit="yourJsFunction(this)">
  <input type="text" name="username">
  <input type="password" name="password">
</form>
<form id="2" action="...">
  <input type="text" name="otp">
</form>

Should be a trivial javascript function to write.

Answer 3

Naive 2FA like SMS will always be vulnerable to this, and there's not much you can do about it. Instead, you should use something like WebAuthn/U2F, which fix it by tying the sent credential to the domain it's being sent to (i.e., if a user falls victim to a phishing site and activates U2F, the credential it gets will only be good for logging into the phishing site and not to the real site, thus stopping the attack).