Bypassing Authentication on SSH Bastion Hosts

Re:Bypassing Authentication on SSH Bastion Hosts by pmoriarty on Tuesday November 12, 2019 @01:53PM (#21516908)

Hmm.. So how would that work exactly?

The source for that page only has Javascript in it.

Anyway, when I try to load that page in Firefox while blocking scripts with uMatrix, I get this error:

"The website you are visiting is protected and accelerated by Incapsula. Your computer may have been infected by malware and therefore flagged by the Incapsula network. Incapsula displays this page for you to verify that an actual human is the source of the traffic to this site, and not malicious software."

And then it tells me it wants me to click a "I am not a robot" checkbox.. but, of course, there isn't one, because I'm not allowing Javascript.

[ Parent | on HN ]

Re:Bypassing Authentication on SSH Bastion Hosts by inetknght on Tuesday November 12, 2019 @02:03PM (#21517004)

I also use uMatrix and probably with stricter settings than you do (* * * block) and also NoScript. I don't know what you're doing wrong; I load it just fine by following the exact instructions I said: prepend the URL with `about:reader?url=` and go. Page loads fine.

[ Parent | on HN ]

Re:Bypassing Authentication on SSH Bastion Hosts by pmoriarty on Tuesday November 12, 2019 @02:30PM (#21517257)

Yes, prepending 'about:reader?url=' did work, but I still wonder why. I suspect that Firefox's reader mode must be using Javascript behind uMatrix's back.

[ Parent | on HN ]

Re:Bypassing Authentication on SSH Bastion Hosts by inetknght on Tuesday November 12, 2019 @02:36PM (#21517303)

Interesting. I wonder what limitations there are to that.

[ Parent | on HN ]