Tag Info

Hot answers tagged

8

Contrary to the intuition, fact that https://foo.com changes to http://foo.com in modern browser means foo.com does support https, and whoever is issuing the redirect has certificate for foo.com (and not any certificate, one that your browser trusts). Otherwise server at foo.com wouldn't be able to instruct your browser to redirect, because redirect command ...


7

The authors of the page you are referring to fail to understand some basic concepts and make otherwise false statements. Because of that I don't think that you should take any statements or conclusions from this article for real. Some examples: This certificate identifies itself (via CN field) as *.google.com despite being served during a putative ...


3

If I am not mistaken, importing your own SSL certificates is just for the connections which you make to the device's own web interface so that won't help you to accomplish your goal. What you would need to do is: Create your own root CA Make those devices trust your own root certificate Redirect all SSL traffic from those devices to your proxy When a ...


3

Suppose Victim A has your standard off-the-shelf Linksys wireless router which, by default, doesn't have encryption enabled on the wireless network which it broadcasts. Suppose Victim A never changed the default administration password either to gain access into the router's web interface to change settings (usually admin, admin). These two situations are ...


3

The same software library that Superfish uses is present in other products beside those found in Lenovo products last year: http://www.tripwire.com/state-of-security/latest-security-news/researchers-reveal-evidence-of-other-superfish-style-attacks-in-the-wild/ Then there are the 2011 Comodo and DigiNotar breaches, which may be the most famous, early root ...


3

First of all, the answer depends on your SSH client. Let's assume you are using latest OpenSSH client. The SSH2 protocol starts like this: Client -> Server: Initiate connection, send client software version + SSH version Server -> Client: Server software version and SSH version Client -> Server: Client supported algorhitms Server -> Client: ...


3

Is there a way the weblogic server with an established SSL connection can re-use the client's cert to connect to the db? No, there is no SSL equivalent to SSH Agent Forwarding; the SSL server cannot forward the client certificate credentials to another server. Now, that's not to say you can't leverage the credentials. If your weblogic server ...


3

Not necessarily. There are numerous attack vectors that can expose you to a man-in-the-middle-attack in this instance: A Rogue Access Point. Someone impersonates your AP and forwards the traffic on to the AP, thus allowing them to perform a man in the middle attack on your network traffic. DNS-based attack (as pointed out by schroeder's comment): What ...


2

My Old Answer: If a site is not using https, it's already "sniffable", so it doesn't matter that it redirects from https to http. There's nothing additional to take advantage of, since it's already http. Instead, if a site is purely https, that's where the MITM attack could take advantage of changing the protocol to http. This is certainly possible, and ...


2

Both chains are actually OK. The third certificate in both cases matches a real root CA (I checked against my machine's root, which fingerprints I then checked against the CA's sites via HTTPS on a separate iPad which is newly-purchased and should have proper certificates installed). Here's what's happening: Certificates and public keys don't have a ...


2

First of all, thanks for the interesting question. I did not know about the details of CSRF before and had to look up the answer to your question myself, but I think I know the correct explanation for Django's behavior now. The Django developers are treating HTTP and HTTPS refers differently because users expect different things from insecure and secure web ...


2

PART 1: Generic explanation, unnecessary to read if you have read the question. The first (how does the packet arrive at the attacker): Victim sends a packet with source IP '192.168.1.3' and source MAC '00:00:00:00:00:03' to destination IP 'DEST' and destination MAC '00:00:00:00:00:01'. Where 'DEST' is some external IP like '47.32.1.6' The router ...


1

You can do ARP spoofing to make victim send DNS queries to you (the attacker). You can then reply with DNS type A records having an IP address that you control. The SSL certificate validation, will however fail because you will not be able to impersonate as Facebook when doing SSL key establishment.


1

The best solution is when ettercap does not MiTM the SSL connection, just forwards it to Burp, and Burp can be set up as a transparent SSL MiTM proxy. In this case, the client will see Burp's server certificate, which has to be trusted by the client. As you can see on the following, only 2 SSL connection is set up. SSL1 SSL2 Client ...


1

I don't see anything particularly out of the ordinary. IPv4 adresses move around. Google doesn't use EV-certification as EV doesn't allow wildcards. This person doesn't know that a certificate can contain multiple domain names in the subjectAlternativeName field, he only looks at the canonical name, which is indeed google.com for Google domains.



Only top voted, non community-wiki answers of a minimum length are eligible