Tag Info

New answers tagged

1

For a nice visual demonstration you can use the graphical interface of Ettercap (ettercap -G) in combination with Wireshark or mitmproxy to run several types of MiTM attacks. There are several plugins for Ettercap which could help you with the demonstration. I'm trying to demonstrate to a business owner why he needs to secure his network, but he says ...


0

I normally use arpspoof from the dsniff package (https://packages.debian.org/stable/dsniff). This one sends out broadcasts automatically after you terminate spoofing, informing the target IP(s) of the real MAC address for the router. Normally ettercap has this functionality too (http://openmaniak.com/ettercap_arp.php) so this might be an issue with your ...


1

This problem also used to happen to me, and in my case, everything had to do with the use of iptables. I was using iptables without the (-i) interface parameter causing the redirection through my machine to not work, because iptables has no way to know which interface you need to redirect traffic to. I just changed my command and no more DoS on the network: ...


4

If I am not mistaken, importing your own SSL certificates is just for the connections which you make to the device's own web interface so that won't help you to accomplish your goal. What you would need to do is: Create your own root CA Make those devices trust your own root certificate Redirect all SSL traffic from those devices to your proxy When a ...


0

You can use your computer as a proxy server using "Squid" and configure SSL dump by decrypting the traffic, analyze it and re-encrypting it again and send it to its destinations. You will have to import the certificate created by Squid to your connected devices.


0

The short The MITM needs the private key of the server to pose as the server and decrypt private messages you send to to the server. The public key of the server is for authenticating messages signed by the server and sending private messages to the server, so you still need to verify its fingerprint. It's okay if the MITM has the public key too. All that ...


3

Suppose Victim A has your standard off-the-shelf Linksys wireless router which, by default, doesn't have encryption enabled on the wireless network which it broadcasts. Suppose Victim A never changed the default administration password either to gain access into the router's web interface to change settings (usually admin, admin). These two situations are ...


1

You can do ARP spoofing to make victim send DNS queries to you (the attacker). You can then reply with DNS type A records having an IP address that you control. The SSL certificate validation, will however fail because you will not be able to impersonate as Facebook when doing SSL key establishment.


3

The same software library that Superfish uses is present in other products beside those found in Lenovo products last year: http://www.tripwire.com/state-of-security/latest-security-news/researchers-reveal-evidence-of-other-superfish-style-attacks-in-the-wild/ Then there are the 2011 Comodo and DigiNotar breaches, which may be the most famous, early root ...


0

Yes, you can "say" you know fb.com's IP, but give them your own. - I forget what the attack is called at the moment :) You can pretend to be Facebook in that you have a webpage that looks like Facebook's (and use something like SSLStrip to stop automatic redirects to HTTPS), but if the client FORCES use of SSL, you can't spoof Facebook's certificate. Is ...


1

The best solution is when ettercap does not MiTM the SSL connection, just forwards it to Burp, and Burp can be set up as a transparent SSL MiTM proxy. In this case, the client will see Burp's server certificate, which has to be trusted by the client. As you can see on the following, only 2 SSL connection is set up. SSL1 SSL2 Client ...


3

First of all, the answer depends on your SSH client. Let's assume you are using latest OpenSSH client. The SSH2 protocol starts like this: Client -> Server: Initiate connection, send client software version + SSH version Server -> Client: Server software version and SSH version Client -> Server: Client supported algorhitms Server -> Client: ...


2

PART 1: Generic explanation, unnecessary to read if you have read the question. The first (how does the packet arrive at the attacker): Victim sends a packet with source IP '192.168.1.3' and source MAC '00:00:00:00:00:03' to destination IP 'DEST' and destination MAC '00:00:00:00:00:01'. Where 'DEST' is some external IP like '47.32.1.6' The router ...


7

The authors of the page you are referring to fail to understand some basic concepts and make otherwise false statements. Because of that I don't think that you should take any statements or conclusions from this article for real. Some examples: This certificate identifies itself (via CN field) as *.google.com despite being served during a putative ...


1

I don't see anything particularly out of the ordinary. IPv4 adresses move around. Google doesn't use EV-certification as EV doesn't allow wildcards. This person doesn't know that a certificate can contain multiple domain names in the subjectAlternativeName field, he only looks at the canonical name, which is indeed google.com for Google domains.


2

First of all, thanks for the interesting question. I did not know about the details of CSRF before and had to look up the answer to your question myself, but I think I know the correct explanation for Django's behavior now. The Django developers are treating HTTP and HTTPS refers differently because users expect different things from insecure and secure web ...


0

To add to Herringbone_Cat's answer: There is another type of attack called IP hijacking, where the attacker announces that their router has the "better" route to an IP address. If they are convincing enough, the entire internet could start routing traffic to that IP address through the attacker's router. If successful, MITM is just one of many exploits that ...


3

Not necessarily. There are numerous attack vectors that can expose you to a man-in-the-middle-attack in this instance: A Rogue Access Point. Someone impersonates your AP and forwards the traffic on to the AP, thus allowing them to perform a man in the middle attack on your network traffic. DNS-based attack (as pointed out by schroeder's comment): What ...


0

No, nothing is wrong with that. Lot of websites function that way because they know their visitors forget easily to write https:// since they do not even know all of them the difference between HTTP and HTTPS. That is the only purpose of the behavior you described: in order not to loose their audience, lot of websites choose to behave like that. Apache ...


2

My Old Answer: If a site is not using https, it's already "sniffable", so it doesn't matter that it redirects from https to http. There's nothing additional to take advantage of, since it's already http. Instead, if a site is purely https, that's where the MITM attack could take advantage of changing the protocol to http. This is certainly possible, and ...


0

Yes, they can. When they see an attempt to make a TLS connection to a server, they can intercept it and reply with a fake error message stating that the server does not support TLS. This technique is known as SSL stripping.


8

Contrary to the intuition, fact that https://foo.com changes to http://foo.com in modern browser means foo.com does support https, and whoever is issuing the redirect has certificate for foo.com (and not any certificate, one that your browser trusts). Otherwise server at foo.com wouldn't be able to instruct your browser to redirect, because redirect command ...


1

Burp Suite can do this to MITM HTTP and HTTPS traffic. This is very easy via Invisible proxy mode: Normally, web proxies need to receive the full URL in the first line of the request in order to determine which destination host to forward the request to (they do not look at the Host header to determine the destination). If invisible proxying is ...



Top 50 recent answers are included