Router safety blackhats
-
This matches our network router details. This is blackhat router credential hackers right? I'm certain but wanted verification from others.
POST /login.cgi HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:82.0) Gecko/20100101 Firefox/82.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 61
Origin: http://192.168.0.1
DNT: 1
Connection: keep-alive
Referer: http://192.168.0.1/
Upgrade-Insecure-Requests: 1admin_username=admin&admin_password=&admin_password=WITH OUR PASSWORD HERE HTTP/1.1 200 Ok
Thank you,
Stephanie -
@smoses huh? Where are you seeing that? there is no login.cgi on pfsense.
-
@johnpoz It's in our network traffic along with a full encoded form, a ton of code and our router credentials including the wan mac address, and the devices on our network. I specifically captured it in our lan / ethernet with Wireshark. They even included our email address associated to the ISP that is logged in our router details. The .isp.com email address.
Does that help? -
J johnpoz referenced this topic on