A kind of attack in which one system, program, or user successfully masquerades as another.

learn more… | top users | synonyms

18
votes
1answer
10k views

How can I spoof a phone call and make it appear to come from another phone?

I'm performing a penetration test against a company. Part of my social engineering procedure is to contact the IT department and try to convince them to that I'm an employee in the company and get ...
16
votes
3answers
65k views

Is it possible to make a phone call appear to come from another phone, even to the network provider?

Quick Question Is it possible that I could call a mobile number, but have the call forwarded through another number active on a different phone that someone else has? I have had unlimited access to ...
15
votes
3answers
2k views

Somebody is spoofing my email to send spam messages, and I have no idea how to block

Someone is using my Google Apps Email ID to send spam messages and I've received 2000+ undelivered and autorespond emails. I have no idea how to block this because the spammer is also using my email ...
13
votes
2answers
887 views

Are SSL browser sessions kept alive across requests?

When a client requests an SSL web resource via a browser (ie: a login request) and then follows up with additional requests are all the requests executed in the same SSL session? Or does the browser ...
10
votes
3answers
175 views

How does SMS spoofing work practically?

I have been researching the web for information on how I can spoof an SMS myself, but I seem to find more on how to detect it, or how to use tools to do it rather on how to do it myself. I have tried ...
8
votes
1answer
12k views

DNS Spoofing vs DNS Cache Poisoning

What is the difference between DNS Spoofing and DNS Cache Poisoning ??? It seems like there are little differences between two attacks, with an exception that DNS server is actually might cache the ...
7
votes
2answers
1k views

Spoof IP adress after a TCP handshake

I know it is not possible to perform a successful TCP Handshake with a spoofed IP-Address. However I wonder: Is it possible to spoof the IP once a TCP handshake was performed successfully? For ...
7
votes
1answer
1k views

If I know a currently working exploit to spoof SMS on a major carrier, what should I do? [closed]

This currently works on all iPhones and one known android phone as of today, a formal complaint has been filed with the carrier and the FCC. I doubt they will do anything about it though since this is ...
7
votes
1answer
108 views

How does Google Analytics prevent fake data attacks against an entity's traffic?

In order to register a "hit" on Google Analytics, the list of things required are: Unique API key(s) for Google AnalyticsPublic: can be gotten from the embedded JavaScript files on the pages for ...
6
votes
1answer
749 views

How to protect from caller-id spoofing?

Yesterday, I listened about caller-id spoofing and was left astonished as it's misuse can result in severe consequences for victim. Please tell me how to protect myself from this prank and is there ...
6
votes
1answer
419 views

Can an SSH server fingerprint be spoofed?

If I simply connect to an SSH server, get its key fingerprint, and immediately disconnect, does the SSH protocol ensure that the server also had the private key in order to get that far into the ...
6
votes
2answers
308 views

Have both my email address and IP been spoofed, or has someone gotten my password, or…?

Just examined a spam email sent to me. The header's "originator" has both my email address and my web site's IP address, (my SMTP). My first thought is that someone has obtained my email password ...
6
votes
1answer
1k views

How to reject e-mails spoofing your own domain targeting your employees at Office365?

One problem Office365 users deal with is that an external SMTP server can spoof the domain of an organization and send e-mails to the domain users; where the e-mails appear to be from employees of the ...
6
votes
1answer
120 views

Does iPhone home button act as Secure Attention Key?

On an iPhone, does pressing the home button act as a Secure Attention Sequence? The home button is a physical button. You can press the home button whereever you are and go back to the home screen. ...
5
votes
2answers
728 views

Phone call to try and gain access

About a hour ago I received a call from a suspicious phone number. They explained that they had received an alert from my PC and needed to gain access to correct the problem before my PC was ...
5
votes
1answer
201 views

IP address spoofing on internet

On a local network, an attacker can craft a custom IP packet with a fake source IP address and send it to a host. I know that the attacker will not receive a response, but there are still attacks for ...
5
votes
3answers
3k views

Which is safer, GSM or CDMA?

I have read in the past (no sure where) that unfortunately there exist illegal devices that permit crooks to eavesdrop on GSM mobile phone conversations. I recently also heard that some people had ...
5
votes
3answers
111 views

How will popular WiFi clients react to an evil twin

If I create an evil twin hotspot next to a legitimate AP and simply clone the SSID, I know that my WiFi client will see these as 2 different APs and both will show up in a list of available networks ...
4
votes
2answers
1k views

Data on Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, using ...
4
votes
1answer
20k views

How to track a Spoofed SMS on Iphone

A mate pulled a quality prank on me the other day by sending me a SMS via a Spoofed number. He's bought a SMS gateway and can set the message ID/phone number to be 'God' (or whatever he wants(letters ...
4
votes
2answers
554 views

Why would someone create an OpenPGP public key with my name and email address?

By chance, I typed gpg2 --search myemailaddress on the command line, and searched public keyservers for my email address (I'd actually just meant to search my local keyring, for which I should have ...
4
votes
1answer
87 views

How can I prove calls or messages from a spoofed number are fake? [closed]

Situation There are 3 people. Person A, B and the victim, C. Person A asks person B to spoof their phone number to look like the phone number of person C. Person A wants to report person C for ...
4
votes
1answer
86 views

Are there any statistics about packet filtering to prevent IP spoofing on the internet?

DDoS attacks via spoofed DNS(sec) are daily news for the last few years, but packet filtering should prevent IP spoofing on the internet. I tried (as an exercise) to spoof a packet on my VPS and on ...
4
votes
1answer
6k views

SMS Spoofing not available in kali

Has the SMS Spoofing option been removed from the Social Engineering Toolkit ? I run 3.14-kali1-amd64. I get only the options shown below. Tried updating both kali and SET but i still dont get the ...
4
votes
1answer
158 views

Known examples of spoofed Change Request?

A Change Request from a client (in the commercial sense of the word) to an organisation supplying an IT system to that client, can add or modify requirements for that system. Are there any known ...
3
votes
2answers
29k views

Sniffing, Snooping, Spoofing

Could somebody please explain me the differences between the following attacks? sniffing snooping spoofing My professors used them all in his documents, but I'm not sure, if those are 3 ...
3
votes
2answers
84 views

Why do email that didn't pass SPF checks go to my mailbox?

I tried a website that supposedly sends spoofed email. I sent myself an email impersonating another email address and the message showed up in my yahoo mailbox even though according to the headers it ...
3
votes
3answers
4k views

How to detect & prevent fake emails?

I hope This not same as this one E-mail can be made to appear like it came from a big organization? I'm not asking how to protect a brands & and large organizations (Google , yahoo, etc ..), ...
3
votes
3answers
741 views

I'm getting spam e-mail…from myself?

I noticed yesterday that I had received spam e-mail, but my own e-mail address was listed as the sender. Naturally, I changed my password. This is probably a spoof, but I don't know enough about ...
3
votes
3answers
7k views

No SMS Spoofing attack vector in Kali Linux! [closed]

I just realized that there is no SMS spoofing attack vector included in the latest version of Kali Linux. Is there a work around?
3
votes
2answers
73 views

Mobile apps and apps store security

This question is with regards to mobile apps and apps stores. Is it possible to program a mobile app that looks like a legitimate app, say for a bank, with the aim that people will download and use ...
3
votes
1answer
149 views

Tracking down the source of email attacks

For the past week our company's IDS has been blocking 100-200 meeting invite emails per day from a specific client that are loaded with buffer overflows targeted at Exchange 2003. The payloads are ...
3
votes
1answer
52 views

How to protect from WPAD attacks?

If you are in a Windows network, and you basically connect to a website ; And there is an attacker on Linux who changes the hostname to WPAD and configures WPAD.dat in his system, all your PC's ...
3
votes
2answers
149 views

Does Visa Checkout have preventive measures against spoofing?

A few online merchants are offering special deals for using Visa Checkout, a payment service similar to PayPal, so I've been trying to learn something about it before signing up. When you are on a ...
3
votes
1answer
518 views

Rogue WPAD server attack

Today I encountered something I have certainly not seen before first hand. Our IDS blocked some outbound traffic attempts from 5 servers with no WAN access. This traffic was leading to an inactive ...
3
votes
1answer
13k views

Is there any way to detect caller ID spoofing?

To be specific the main problem is that I want to detect if the caller ID of the incoming cal I get is real or spoofed? Most VoIP servers now allow their clients to use any caller ID they want. Also, ...
3
votes
1answer
432 views

WPA2 enterprise credentials involved in encryption?

Since encryption keys are session-based in WPA2 enterprise, if person A obtains person B's credentials, will person B's encryption key still be safe? Is there any way person A could use person B's ...
2
votes
2answers
3k views

Is this a valid Windows update page

In my chrome browser if I google for Windows Update the first hit is windowsupdate.microsoft.com/‎ When I click on it I am redirected to ...
2
votes
2answers
2k views

What happens when a spoofed source IP packet is dispatched out of a private network with NATing

Suppose as an attacker i want to carry out a Ping or SYN Flood attack.. I can change the source IP of the packets generated at my machine to a false/spoofed public IP address so that replies go to ...
2
votes
1answer
926 views

Can I check if a work colleague logged into my user account on a shared computer?

I think that someone at work has logged onto my user account when I'm not in work and moved some files from my desk top to my work in progress. Can this happen? They may know my user name as this is ...
2
votes
1answer
63 views

Securely sending packets without them being spoofed

I'm working on a simple multiplayer game to break the ice with network programming. I have a system where if the player moves, the server receives a move packet that contains some stuff like the ...
2
votes
1answer
2k views

What is TCP spoofing?

I know about IP spoofing is it the same thing? The question originated from the question Is TCP more secure than UDP?
2
votes
1answer
213 views

Is it possible to cause a DOS attack on a domain by spoofing the DC's NTP request?

According to this page: Be aware that the Network Time Protocol (NTP) is unauthenticated, and unencrypted, and it is possible for an intruder to spoof the time root source, causing the wrong ...
2
votes
3answers
295 views

Security concerns with TCP holding onto out-of-order packets?

Consider the following... Alice and Bob are communicating over TCP. Currently, the next expected TCP sequence number is 1000. Charlie, pretending to be Alice, sends a spoofed TCP packet to Bob with ...
2
votes
1answer
1k views

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi [duplicate]

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
2
votes
1answer
457 views

What is setuid based script root spoofing?

I'm reading this and I'm little confused. What exactly is this setuid based script root spoofing?
2
votes
1answer
2k views

Is it possible for someone to send a spoofed text message via iMessage to my iPhone4?

After the reports of the SMS spoofing security issue Apple released a statement claiming that the iMessage system was 'secure' and should be used to prevent text spoofing. I have received several ...
2
votes
0answers
95 views

How could someone trick Norton Safe Web into thinking my website has PHP files that don't exist?

I'm in a bit of a quandary over Norton Safe Web's rating of my company's website. My question is: is it possible for someone to fool Norton Safe Web into thinking that our website has PHP files which ...
2
votes
0answers
110 views

WPA2-Enterprise - unable to find a way around Lanner Electronics

I have currently been working in an environment where I am connected to a WPA2-Enterprise network requiring me to enter my username and password for the network whenever I connect. I have been asked ...
2
votes
1answer
1k views

External network DNS spoofing

I've been thinking recently if its possible to DNS spoof an external network. Let's say for example you are attacker.com and your victim is of course victim.com. Then I've thought of 2 scenarios: 1. ...