Kiwifarms Hacked

G

guest

Guest
53tnuu (1).jpg
 

TheNanaDook

I'll need to see if he explains what happens but if the proxy is just a passthrough I don't see how you can do a session based attack.

My understanding is that its a man in the middle exploit. If tls terminated at the host then it shouldn't be possible. For you bovine retards


Your browser --> proxy --> backend host

If your connection is https then your traffic is encrypted with tls. If the proxy server contains the private key it can decrypt https/tls traffic and forward along http or plaintext. Now I don't know what he's dealing with on the ddos side so there may be reasons for that.


Typically though, the proxy just forwards the encrypted traffic and the private key is stored on the backend server and decrypted there. This is pretty much what cloudflare does.

So if the proxy was comprised I think it would need to have had the private key and thus be terminating ssl there. But I'm a retard so who knows.
I read this:

“A bad actor was able to upload a webpage disguised as an audio file to XenForo. Elsewhere, he was able to load this webpage (probably as an inline frame), causing random users to make automated requests and send their authentication cookies off-site, so that the attacker could use it to gain access to their account. My admin account was compromised through this mechanism.”

If this is true, it could explain grabbing their session info, if this XenForo site is a dumb shit and stores session id in a non http only cookie, or even dumber, session storage. If he’s on a shared server, yeah they probably got the info. Of course, if they knew this exploit would get kiwi farms, very likely it was intentional.
 
Top