41–50 of 71 posts
I found a few leads googling around Palo Alto Networks docs website: - "Advanced URL Filtering" seems to have a feature where web content is either can be evaluated "inline" or "web payload data is also submitted to Advanced URL Filtering in the cloud" [1]. - If a URL is considered 2 spooky to load on the user's endpoint, it can instead be loaded via "Remote Browser Isolation" in a remote-desktop-like session, on dem…
Earlier quoted context omitted.
Would that explain getting past an auth wall though, i.e. loading the HTML page as if the user were logged in but without auth headers and cookies?
You may be slightly misreading the write-up. Note the following two bits: > What we found were user agents purporting to be from a range of devices including mobile devices, all only ever loading a single page without any existing state like cookies. > The behavior itself is also strange, how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? I don't think they…
This led us to believe this page was MitM rather than crawled directly (as they would not be able to impersonate the user)
Earlier quoted context omitted.
Would that explain getting past an auth wall though, i.e. loading the HTML page as if the user were logged in but without auth headers and cookies?
You may be slightly misreading the write-up. Note the following two bits: > What we found were user agents purporting to be from a range of devices including mobile devices, all only ever loading a single page without any existing state like cookies. > The behavior itself is also strange, how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? I don't think they…
Hm, are you sure? From the article:
> Would render and execute all scripts on that page as if it was that user
> [...] scans pages by grabbing the page contents, sending it to a render queue and then processing it [...]
I know a system that fits the bill for the observed behavior: https://news.ycombinator.com/item?id=39051083
But apparently PAN can do it too: https://news.ycombinator.com/item?id=39051077
My machine wanted me to accept a client certificate from palo alto networks.
I did not and kept refusing.
I think they had some sort of intrusive mitm proxy that filtered everything everyone was doing/browsing.
Earlier quoted context omitted.
You may be slightly misreading the write-up. Note the following two bits: > What we found were user agents purporting to be from a range of devices including mobile devices, all only ever loading a single page without any existing state like cookies. > The behavior itself is also strange, how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? I don't think they…
OP here, I was trying to say that these pages were behind an authwall and loading with userids from a specific user but without any of their cookies to support that auth. This led us to believe this page was MitM rather than crawled directly (as they would not be able to impersonate the user)
Could be interesting, but I cant read this shit with flashing images.
Unrelated to the article directly, it's kinda neat that the site's text selection highlight color is randomized on every mousedown.
Josh on our team is so happy people discovered and liked his easter egg!
Sad, because it sounded interesting, but no way I could focus enough to actually comprehend it.
I'm missing something > strange devices show up for some of our customers' users > how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? Either - The customer has screwed up user auth big time and some X knows that.... lets go with no - OP's data is wrong or they are reading it wrong - They are explaining it badly.
Earlier quoted context omitted.
You may be slightly misreading the write-up. Note the following two bits: > What we found were user agents purporting to be from a range of devices including mobile devices, all only ever loading a single page without any existing state like cookies. > The behavior itself is also strange, how did it load these pages which were often behind an authwall without ever logging in or having auth cookies? I don't think they…
> I don't think they mean to say that pages behind authentication were successfully loaded without authenticating. Hm, are you sure? From the article: > Would render and execute all scripts on that page as if it was that user > [...] scans pages by grabbing the page contents, sending it to a render queue and then processing it [...] I know a system that fits the bill for the observed behavior: https://news.ycombinato…
> > Would render and execute all scripts on that page as if it was that user
If there is a valid user ID (or other user/session identifier) in the request URL or body, but not valid auth cookies, the system may respond with a page that references the same scripts as the user would get but with no data. In that case the scripts would run (perhaps requesting further resources, directly or by placing things that reference them into the DOM, which is how they know the scripts ran) as they would for the user but just render a “no data” message where the information would be.