This post describes how an attacker can set up a fake Wifi network and prompt a login screen on the user’s device when a victim tries to connect. Goals The objective of this Wifi captive portal is to mimic the behaviour of a legitimate access point protected by a portal login page for demonstrational purposes. […]

Automatic completion of passwords in web forms allows attackers to grab your password if an XSS vulnerability exists. We don’t usually associate XSS vulnerabilities with compromised passwords, but it is sometimes possible to steal login credentials through XSS vulnerabilities on a website. Take a look at the example attack below.

HTTP Auth offers attackers easy phishing. This post describes how it is done and how the attacker could circumvent the constant reappearing of the authentication prompt.