Hot answers tagged

49

It is unlikely a hacker stealing internet access will have the sophistication (or need) to make the wireless network change between different names. It is more likely that someone/some device nearby installed a new wireless network that happen to broadcast on the same channel as yours (there are only 3 or 4 non-overlapping ones to choose from) and have a ...


16

The HSTS header stops MitM attacks by instructing the browser to always send HTTPS (as opposed to HTTP) request to the domain until the policy expires. So a browser that respects the header would send a request to https://example.com even if the user clicked a link to http://example.com. The logic behind HSTS has not changed since it was defined in an RFC ...


10

If you router offers a real DMZ then the rest of the network would be safe even if your Windows PC is compromised. A real DMZ is a separate network which has no or only very restricted access to the internal network. But, what most SoHo routers call DMZ is actually an exposed host, i.e. traffic from outside is forwarded to a single host inside the internal ...


9

Here are some things you can try that may help you out. As you stated that you are not too computer savvy, I'll not be giving you any difficult instruction if I can help it. Possibly try turning off your router when not in use. This may reset your password to the default (I believe this might be printed on the device itself) If you can plug a hard line ...


8

SSLStrip worked rewriting https requests to plain http, removing the protection and allowing both eavesdropping and modification. A server with HSTS protection will set a header on a HTTPS request asking the browser to only contact that server using HTTPS: Strict-Transport-Security: max-age=31536000 In this case, for one year the browser will only ...


7

To your fear that a local hacker is trying to compromise your internet connection and/or your computer, it's actually quite hard to "fake" an WPA2-AES protected access point: the handshake doesn't expose the key and if there were a rogue device posing as the AT&T router, the handshake would fail with an error message. So, as long as you heeded any ...


6

As you may have noticed this has nothing to do with security whatsoever. Instead, the practice of killing long-lived dormant TCP connections has to do with bugs - it's a work-around for buggy software. One of the more famous examples of software leaving TCP sessions hanging is Internet Explorer (at least up to version 7). IE had the habit of not ending TCP ...


4

there are lots of attack vectors, such as : Sniffing admin/user passwords and exploiting systems using them Accessing an anonymous shares and planting malware there(if they're not read-only) Performing MitM attacks to steal data Exploiting IPv6 in LAN : it's often an IPv4 LAN's but people forget to disable IPv6, so it's a prioritized by OS, especially ...


4

Anything can happen and what exactly happens depends on the server side code of the web application. Some believe in extensions, some believe in the content, some can be tricked with polyglot attacks, ... Thus in the best case nothing happens or you get an error because content is not allowed and in the worst case you can execute code on the server. If done ...


3

A lot of home networking "helper" apps, for network printers, network webcams, etc. will continuously scan the local network looking for devices. Some network appliances will too, like NAS devices, for similar reasons (looking for local printers). Is the device doing the scanning a Windows PC with a bunch of typical desktop apps installed? That would be ...


3

You can't, as there are too many addresses to scan for. Typically a residential ISP will assign a /64 subnet per customer, which means there are 18446744073709551616 possible addresses behind that router. That is a lot of IPs to scan. Also, the fact that IPv6 addresses are publicly routable doesn't mean the router can't get in the way and firewall off your ...


3

The support for proxy with nmap is very limited. Especially you cannot do any kind of ICMP (ping) or UDP scans, no SYN stealth scan, no OS detection etc. This means that the default nmap commands you are using will not work with a proxy and depending on the implementation will either fail or will bypass the proxy. You have to limit yourself to only the kind ...


3

If you are looking to map out your immediate LAN, a simple ARP sniffer (probably written in Python with the scapy library), would work just fine. But, if you're looking to find the entire network topology, there is a way to do it, but the circumstances are a bit specific. If the network utilizes Cisco routers, and those routers route dynamically using ...


3

Some background information for context : Some organizations save full-packet captures for their high-security or production networks. There are commercial products which do this too. People definitely do what you are talking about but not always for the reason you mention although that's a good side benefit. Ideally what you want is an optical tap at key ...


2

You are correct in that UDP does not have a state like TCP has, so in a literal sense there is no session to hijack. However, because of this it is impossible to verify the identity of the sender of an UDP packet. All you have to go on is the sender IP in the UDP header, and that could trivially be spoofed. In that sense, it is easier to session hijack UDP ...


2

You have almost always timeout on inactive TCP session implemented in routers, switches and all that low level network machinery. It has little to do with security in the sense of protection against a deliberate attack, but just try to not exhaust resources because of buggy software failing to close connection, or other hardware errors in external network ...


2

It is actually expected that they would all have the same MAC address - MAC addresses do not survive the hop from router to router, so what you are seeing is likely the MAC address of your ISP's router (the closest MAC to your router).


2

The approaches you mention are a bit confusing, and I will explain why. In a properly designed infrastructure many of the bulletpoints you listed would be addressed: Hourly host discovery scans - If you implement strong port security on your switches, and used NAC - PacketFence (since you mentioned open source, I did also) you wouldn't need to worry about ...


2

From iBoss Knowledgebase on HTTPS Filtering: The iBoss blocks DNS outgoing requests which would block secure sites users are trying to connect to that fall under the iBoss filtering policies. If you are experiencing iBoss not filtering secure sites, try to flush the DNS cache by re-booting the computer and the iBoss unit. So yes, it sounds like ...


2

This is happening because your AP is able to filter out the MAC address and block it after an x amount of requests. What you need to do is to change the MAC address every x requests so the router won't be able to lock you out. Use reaver mac address changer: Reaver -i mon0 -c x -b xx:xx:xx:xx:xx:xx -vv --mac=vv:vv:vv:vv:vv:vv Warning: This might crash your ...


2

You'll need to find a secure channel to exchange the new password over. Communicating verbally would work just fine. As to an automatic notification, the only way to do this would be to flash your router with custom firmware which would allow you to write scripts to add functionality, such as DD-WRT. However, DD-WRT is unsupported on the Huawei WS319. As ...


2

I know a few like: Pwn Pro Secpoint Penetrator But I don't know the exact generic name of those devices and I don't think there is one.


1

An application proxy (or more commonly called application level gateway) is a firewall at the application level. A packet filter is a firewall at the packet level. This mean with a packet filter you are not able to filter web traffic for malware since it has no understanding of the applications protocols of the web (i.e. HTTP). An application level gateway ...


1

You are taking the wrong approach here. The purpose (the initial true purpose) of a honeypot as defined by Lance Spitzner was to trap someone inside of a system that seemed to be filled with enough goodies that the attacker would waste time there, giving admins enough time to prevent them from doing damage elsewhere, while studying them. The first open ...


1

Short answer: No, not everyone can send a modified certificate to the client. Every certificate is digitally signed and the clients check these signatures. So you either need to ... create a fake signature (which is cryptographically hard), get a certificate autority to sign your certificate (which they should refuse to, because you are not owner of ...


1

It depends. If the server and people who recive the code try to use it as a PNG, the PNG viewer could not work or give an error. Also there is a website which turns JS into a valid, displayable PNG. But the code wont run unless you try to execute it. You could also rename a file hello3pm.exe to hello(special unicode symbol)3pm.exe and it'll display as ...


1

Okay with my first test, I used etherape GUI to show what types of packets were being sent when I replayed the injected packet. What I saw was the color code for "UDP UNKNOWN" which leads me to believe it is a possible issue with Nemesis itself. In wireshark, there was no response from my router as a result of replaying the packet. Subsequent tests using ...


1

Assuming you have control of the network equipment then yes you can log and monitor their actions. Full packet capture: Ideally you want full-packet capture of all traffic at key ingress/egress points for each segment. You asked for the best way to do this and this would give you the most data about traffic on your network. Even if you can only capture the ...


1

I had this same issue about 2-3 weeks ago, with the same site coming up after running several scans with Roguekiller. Prior to that the browsers would lock up or work very intermittently, (Firefox, Chrome, Edge, IE , Opera, ect.) Using a web browser in a game, running a VM or Tor worked, but even Tor would lock up after an hour. This was on Win 10 64bit, ...



Only top voted, non community-wiki answers of a minimum length are eligible