missing b64 replace on Referer on request

Question

missing b64 replace on Referer on request

makovez opened this issue 3 years ago · comments

Hi, i have noticed that if the fake domain is b64 encoded on "Referer" header on request to target site it is not replaced by the correct b64 domain so the fake domain is actually being sent in the Referer header if b64 encoded.

Giuseppe Trotta · Answer 1 · Sun Jun 06 2021 22:55:22 GMT+0800 (China Standard Time)

Is the Referer header included in the list of HTTP headers to transform? Maybe provide an example so I can even debug it.

Giuseppe Trotta · Answer 2 · Sun Jun 06 2021 23:08:16 GMT+0800 (China Standard Time)

Proxied where? It's not clear what's the flow and what you want to do. If it is from your browser to muraena it still makes sense to have the phishing domain in it.
But to me this doesn't seem a bug but more a problem of configuration .. MiTM Muraena to check what's going on (see here: https://github.com/muraenateam/muraena/wiki/Debugging)

Giuseppe Trotta · Answer 3 · Mon Jun 07 2021 15:39:24 GMT+0800 (China Standard Time)

Thanks, well spotted @soermejo!

Makovez · Answer 4 · Mon Jun 07 2021 15:55:45 GMT+0800 (China Standard Time)

Thanks to you for fixing the issue