{"action":"created","issue":{"url":"https://api.github.com/repos/securestate/king-phisher/issues/280","repository_url":"https://api.github.com/repos/securestate/king-phisher","labels_url":"https://api.github.com/repos/securestate/king-phisher/issues/280/labels{/name}","comments_url":"https://api.github.com/repos/securestate/king-phisher/issues/280/comments","events_url":"https://api.github.com/repos/securestate/king-phisher/issues/280/events","html_url":"https://github.com/securestate/king-phisher/issues/280","id":309585951,"number":280,"title":"Feature Request: MFA Codes?","user":{"login":"binary-blurb","id":25695119,"avatar_url":"https://avatars1.githubusercontent.com/u/25695119?v=4","gravatar_id":"","url":"https://api.github.com/users/binary-blurb","html_url":"https://github.com/binary-blurb","followers_url":"https://api.github.com/users/binary-blurb/followers","following_url":"https://api.github.com/users/binary-blurb/following{/other_user}","gists_url":"https://api.github.com/users/binary-blurb/gists{/gist_id}","starred_url":"https://api.github.com/users/binary-blurb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binary-blurb/subscriptions","organizations_url":"https://api.github.com/users/binary-blurb/orgs","repos_url":"https://api.github.com/users/binary-blurb/repos","events_url":"https://api.github.com/users/binary-blurb/events{/privacy}","received_events_url":"https://api.github.com/users/binary-blurb/received_events","type":"User","site_admin":false},"labels":[{"id":73073963,"url":"https://api.github.com/repos/securestate/king-phisher/labels/question","name":"question","color":"cc317c","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2018-03-29T01:18:28Z","updated_at":"2018-03-29T03:41:43Z","closed_at":null,"author_association":"NONE","body":"Hey KP Team,\r\n\r\nFirst off, thanks so much for putting this software together. I am starting to see multi-factor authentication deployed on more of the services that I am phishing credentials for. I like to do everything in King Phisher when it comes to phishing, so I was curious what the possibility was of having KP not only scrape and store the 'username' and 'password' parameters, but also a parameter like 'mfa'. In practice, this functionality would have the normally cloned web page with the MFA field initially hidden. On click of submitting credentials, some JavaScript or jQuery would be used to reveal the MFA code field and it would prompt the user to enter their MFA code. On the threat actor side, the cred would be received, punched into whatever authentication portal, the user would receive their code to their phone or use their rolling token, punch it into the KP page, and then the attacker would manually relay the MFA code in a time restrictive manner to the authentication portal that they are attempting to gain access to.\r\n\r\nJust curious on the potential to put something like this into place. I've been working with the lack of this feature by posting the MFA code to a PHP script that writes it to a file in the interim (similar to setoolkit), but I wanted to hear your thoughts. I'd be happy to throw some coins your way if you'd consider.\r\n\r\nThanks for reading!"},"comment":{"url":"https://api.github.com/repos/securestate/king-phisher/issues/comments/377111469","html_url":"https://github.com/securestate/king-phisher/issues/280#issuecomment-377111469","issue_url":"https://api.github.com/repos/securestate/king-phisher/issues/280","id":377111469,"user":{"login":"binary-blurb","id":25695119,"avatar_url":"https://avatars1.githubusercontent.com/u/25695119?v=4","gravatar_id":"","url":"https://api.github.com/users/binary-blurb","html_url":"https://github.com/binary-blurb","followers_url":"https://api.github.com/users/binary-blurb/followers","following_url":"https://api.github.com/users/binary-blurb/following{/other_user}","gists_url":"https://api.github.com/users/binary-blurb/gists{/gist_id}","starred_url":"https://api.github.com/users/binary-blurb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/binary-blurb/subscriptions","organizations_url":"https://api.github.com/users/binary-blurb/orgs","repos_url":"https://api.github.com/users/binary-blurb/repos","events_url":"https://api.github.com/users/binary-blurb/events{/privacy}","received_events_url":"https://api.github.com/users/binary-blurb/received_events","type":"User","site_admin":false},"created_at":"2018-03-29T03:41:43Z","updated_at":"2018-03-29T03:41:43Z","author_association":"NONE","body":"I see the Jinja documentation stuff, but had yet to dive that far into King Phisher beyond using some of the more simple variables in my emails. Would that parameter be embedded within my cloned site and it would pass the parameter username and mfa to KP instead of username and password. Is that right, or is it still passing the password form field ID, which I could clear with an onclick event after cred submission to prep for MFA submission via the same password form field (clear the password but not the username)? I'll check that stuff out to see if I can do what you suggest. That would make my workflow a bit simpler. The new credential submission would be fine as long as the username is the same. I read some other documentation where just the password won't be stored, so the username must be passed with the password and / or MFA code. And to be clear, KingPhisher will not accept WebKitForms in like an XHR, right? Only key value pairs? I tried to make the user experience of getting phished a little cleaner using onSubmit events with some JavaScript to send form contents via XHR so the page doesn't reload, but I haven't been able to get those values into KP.\r\n\r\nI agree with that third paragraph. That pie in the sky crossed my mind for automatically relaying creds, scraping auth portal forms, putting in the credentials on the auth portal I'm attempting to gain access to, POSTing them, and then automatically submitting a GET request every 5 minutes or so to keep the session alive. Would be great to not babysit the campaign to ensure the temporal MFA codes can be used... That'd be sick, but complex for all the different portal types."}}
{"actor":{"display_login":"binary-blurb"}}