alt Hacker NewsSomething off in my mind: how did the agent access to Tor network if the traffic outgoing was monitored and intercepted to only allow read-only access to web(I assume this is an MITM L7 proxy that only allows GET methods and specific hosts) ? Did the sandbox dev forgot to block HTTP CONNECT that is used to reach Tor Entry Guards?
Replies
Maxious • yesterday at 1:42 PM
Possibly via compromised php sites with webshells on AWS and DigitalOcean they could run shell commands to install and use Tor. We don't have forensics of the AWS/DigitalOcean sites although maybe can find signs using shodan etc.
There's nothing magic about GET, it found old wikis that would allow you to make edits using GET requests. GET being read-only is only by convention, there's no guarantee of what happens server side with GET or any other HTTP verb. It's up to the server.