Muraena: The Unexpected Phish
summary
Demonstrates a working phishing pipeline that defeats SMS/OTP/push/software 2FA (U2F only resists), using a Go reverse proxy Muraena to transparently MiTM requests and strip/bypass SRI/CSP protections and base64 checks, plus a dockerized headless Chrome orchestration Necrobrowser that steals cookies and programmatically adds SSH key to GitHub, scrapes Gmail/OWA, and automates persistence. Code and demos are released; the authors report stable operation against Google and handle roughly a hundred concurrent victims in tests.
AI-written summary · about
chapters (12)
- 0:00Introduction to phishing risks
- 1:01Myths about two-factor authentication
- 4:40History of man-in-the-middle phishing
- 8:16Muraena reverse proxy features
- 10:44Anti-reverse proxy techniques
- 17:51Bypassing vendor protections
- 18:54Session hijacking with automation
- 23:15Live demo Google phishing
- 27:49Live demo GitHub backdoor
- 31:31Upcoming challenges
- 34:00Future plans and release
- 35:12Q&A session
related talks
40mGet Rich or Get Hunted Trying: Uncovering Large Scale Fraud Operations
56mHacking your Mind and Emotions
54mDark Fairytales From A Phisherman
53mProtecting Crypto Exchanges From A New Wave Of MitB Attacks
49mThe Death of Conventional MFA: How AiTM Attacks Are Changing the Game
40mPurple Team Auth: Hacking & Bypassing MFA Systems, and How to Armor Up
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
31mAnatomy of a Phishing Campaign