Tag Info

New answers tagged

3

I played around with Family Safety on Windows 8.1, and from what I can tell, it's seems to be smart enough to check the validity of the original certificate before it proceeds to replace it with a Microsoft certificate. From the screenshot below, you can tell that when I visited Google, Google's real certificate was replaced by the Microsoft Family Safety ...


0

If you have access to the remote machine you can achieve this by installing packet capture software (e.g. tcpdump) on the remote machine and piping the output of the software back to you through an established channel (e.g. SSH) into your local instance of Wireshark. Needless to say, you should filter out the pipe traffic on the packet capturing software to ...


1

1.Yes it is correct. There are 2 possible ways: A) Alice blindly accept the new fingerprint from the attacker mallory. Alice and Mallory could connect and authenticate each other. Problem here for Mallory is, that he couldnt sign the session id, exchanged with Bob. Because Mallory dont own the private key from Alice. And also Mallory couldn`t ...


1

Pure speculation without more info, but it could well be a case of HTTP proxying. HTTPS proxying is not feasible without a complex set up, which would be why you see a different IP over HTTPS (your IP) than over HTTP (the proxy's IP). While this indeed can be used to "spy" on your HTTP traffic, it could also be a caching service, used to reduce unnecessary ...


0

EvilFOCA will introduce you to a few common network MITM concepts. It runs on Windows and is very easy to setup and control.


1

This may or may not even be possible depending on what checks Nintendo does. If Nintendo only trusts their own certificate, signed by them, then you will be unable to make a key pair for the proxy that your DS will trust. Normal SSL/TLS MITM proxies require that the client trust the certificate used by the proxy as a root cert, that way the proxy can make ...


1

The fact that the user is going to the site at all. I'm guessing that there would likely have been a DNS request for the domain name, and that request wouldn't have been encrypted, so the hacker knows at the very least that the user is accessing this specific site. Yes, the DNS request will reveal the host name if the DNS request can be MITM'd and the ...


3

In an SSL connection, the GET or POST portion is encrypted. For example: visitor: https://www.yoursite.com/shoppingcart.aspx www.yoursite.com visible GET /shoppingcart.aspx encrypted HTTP/1.0 encrypted What you're thinking about is called an inference attack, where with little bits of information, an attacker can put together ...


1

With MitM over a HTTPS website, the greatest threat comes from the ability to replace the site's SSL cert with his rogue one. Yes, the user will receive a warning that the site does not match the cert but users are likely to just click continue. Once the cert has been replaced, he can decrypt all communication as he has the private key for his own cert. If ...


1

If the software is using a fixed port and an hostname rather than IP to connect you could redirect the traffic to your local computer and use, e.g. ncat to remove and readd ssl, then inspect the traffic in between. Comment if you need more details.


3

Wireshark should be able to do it. However, the process is not as straightforward as you would have to scan the memory for the master secret. Here is a tutorial on how to decrypt SSL without access to the master private key. http://www.cloudshield.com/blog/advanced-malware/how-to-decrypt-openssl-sessions-using-wireshark-and-ssl-session-identifiers/


0

In the case of OpenVPN the certificate is already known to the client, there is no exchange at that point, so MiTM is mitigated based on the idea that they would have to compromise the server cert in order to mislead the client into communicating with the middle device. If the MiTM presented an alternate cert for communication, the client would reject it, ...



Top 50 recent answers are included