Client Domain Hooking
Client Domain Hooking - Example Attack – duszynski.eu – Piotr Duszyński Client Domain Hooking - Example Attack Written on May 20, 2019 In my last blog post I have released a paper that described all relevant technical aspects of the ‘Client Domain Hooking’, along with a HTTP Strict Transport Security (HSTS) survey made for the TOP 1000 Alexa websites. In this post I will show how to run a simulated, ‘Client domain Hooking’ attack which will be used to evaluate an example browser-based application security posture. “Prerequisites” In order to execute this attack, you will need the following set-up: any active and registered domain name (we will be using ‘cdh.modlishka.io’ as an example). a valid wildcard TLS certificate for the domain that we own (it can be either bought or obtained from the “Let’s Encrypt” service). latest version of Modlishka v.1.1 reverse proxy. target applications, such as the latest version of Chrome browser and example vulnerable WebView based mobile applications....