ATTPwn icon indicating copy to clipboard operation
ATTPwn copied to clipboard

Feature request: Bind to Loopback interface only or add authentication

Open clr2of8 opened this issue 3 years ago • 1 comments

The application binds to 0.0.0.0 making the web interface available to anyone on the network which is problematic since the web application requires no authentication/log-in. This leaves the web interface insecurely exposed.

clr2of8 avatar Oct 02 '20 17:10 clr2of8

The application binds to 0.0.0.0 making the web interface available to anyone on the network which is problematic since the web application requires no authentication/log-in. This leaves the web interface insecurely exposed.

Hello, thank you very much for highlighting the security problem of not having a login method and that the server is available in 0.0.0.0, to solve it we have integrated a login system and as an extra we added 2FA with Latch.

You can see these changes in the following Pull Request: #13

guillerpsanchez avatar Dec 03 '20 10:12 guillerpsanchez