13 ms·
Something off in my mind: how did the agent access to Tor network if the traffic outgoing was monitored and intercepted to only allow read-only access to web(I
by namjh 13d ago
Something off in my mind: how did the agent access to Tor network if the traffic outgoing was monitored and intercepted to only allow read-only access to web(I assume this is an MITM L7 proxy that only allows GET methods and specific hosts) ? Did the sandbox dev forgot to block HTTP CONNECT that is used to reach Tor Entry Guards?
- Maxious 13d agoPossibly via compromised php sites with webshells on AWS and DigitalOcean they could run shell commands to install and use Tor. We don't have forensics of the AWS/DigitalOcean sites although maybe can find signs using shodan etc.
- chasd00 12d agoThere's nothing magic about GET, it found old wikis that would allow you to make edits using GET requests. GET being read-only is only by convention, there's no guarantee of what happens server side with GET or any other HTTP verb. It's up to the server.
- coder-pm 11d agoAnswers are in the article , agents used SSH tunnels, it was evidenced by the wiki’s referrer logs. The Tor - agents did edit the wiki via SOCKS and relay R6 instantly. The questions should be more like was CONNECT open or they didn’t even need it:)