Tag Info

New answers tagged

1

The answer is yes, it is possible. However, there are some significant limitations. Through the use of IP spoofing, it could be possible to establish a connection which could be used to deliver a payload to the target, but it will not be possible to establish a true bi-directional TCP connection. In simple terms, the attacker can get the target machine to ...


1

I do not know of any other methods to crack WEP as this is probably the fastest way and a technique you can be sure will end up giving you the key. That said, you may want to check that command aireplay-ng -3 –b 98:fc:11:c9:14:22 –h 00:c0:ca:50:f8:32 mon0 The second mac in there is supposed to belong to a client already authenticated on the AP when you ...


0

To answer your question, it's not necessarily. For example, if there are no clients, Open is less secure. In general, shared is less secure because you can deauthenticate a client, which forces it to associate again. You then capture the shared key authentication handshake. In open mode, this handshake doesn't happen.


0

Shared authentication uses a challenge/response protocol to connect, and this makes it very susceptible to a dictionary attack offline. Using WEP in shared mode, You just need to enter a secret shared key to connect, and this is where the attack can be easily perpetrated. Hope that helps!


1

Shared would send a plaintext query to authenticate clients which would be encrypted and returned. This left the key vulnerable to a known-plaintext attack. Open would allow anyone to authenticate, but wouldn't pass plaintext around, making the key harder to guess. Here and here are links to more details.


-1

While i was reading your question i assumed you'd be on wireless, which is a broadcast medium. I assume you're also capturing on all interfaces. Take note b = append_to_buf(b, "\x32\x04\x30\x48\x60\x6c", 6); there are six times 00 appended


1

First and foremost, anything non-trivial is theoretically possible. Now, on to practicality. It is exceedingly improbable that you'd get infected in this situation. The router is kind of like a phone system in an office: instead of global "phone numbers" (IP addresses), your internal machines only get "extensions" (internal, non-routable addresses). ...


1

It is possible for several reasons - but your intuition is fundamentally correct, because the fundamental issue is always the "attack surface." And network security is all about minimizing the attack surface (and locking down the surface that must be exposed). You probably have a combination router/firewall at your "edge" that serves as the default gateway ...


4

What's the purpose of that in terms of security / hacking? The hostname(s) of resources can provide valuable information to narrow the scope of an attacker's task by providing information about available machines and resources. The underlying space of network (IP) addresses is sparsely populated (and IP:port combinations even more so), so narrowing down ...


1

By just being connected to the Internet ther is risk of being vulnerated. This risk can be mitigated with software updates and some security products (antimalware, firewall, intrusion detection systems, etc...). On an ideal setting, the risk is very low. You would be running behind one or two routers on a NAT, with a fully updated operating system, no ...


2

It all comes down to properly inform your client. You got hired for a reason, it's your job to explain your client this will not attract hackers. What's your scope? Isn't this stated in your statement of work (SOW)? Explain to them that if they want their public facing assets to be secure, an nmap scan is one step of the many ways to determine the level of ...


8

Subdomain enumeration techniques are passive methods used during a pre-attack phase or during information gathering phase of a pentest assignment. Enumerating subdomains is crucial as they may point to different parts of a web application or may lead to another website hosted on another server with a different IP address. This allows you to come up with ...


6

What's the purpose of that in terms of security / hacking? It might show you other vhosts on the same domain. Think about blog.example.com which can be an old WordPress installation full with bugs and allows you to access a shared MySQL database or FTP user. Another example is for example admin.example.com. This can be relevant for your hacking ...


0

I recently wrote 2 articles exactly about that, however in polish language: http://fajne.it/zelazne-zasady-dla-uzytkownikow-sieci-tor.html http://fajne.it/jak-skutecznie-obronic-swoj-komputer.html Let me repeat the key advices: Encrypt everything, everywhere. No exceptions. Every disk should ideally be encrypted with different key. Use separate IT ...


29

A few years ago (2003), there was this worm called "Blaster" (or MSBlast, Lovesan etc. - read more on https://en.wikipedia.org/wiki/Blaster_(computer_worm)). It spread by using a vulnerability in an RPC service, running on Windows XP and 2000. At the time where it was "worst", you could get infected within minutes, if you didn't have a firewall set up. I ...


1

With your disconnected computer, you are describing an Air Gap. A quote at a recent security conference: "An air gap just means higher latency in the network" You are right that it is very difficult to be perfectly secure. Instead of trying to be perfect, try to improve. Do a self-assessment and calculate what your biggest risks are and then use ...


5

It might be possible to be infected if your computer is directly accessible from the Internet (without NAT, router, etc.). But the attacker will need to find a vulnerablity in TCP stack of your operating system that would allow him to execute arbitrary code on the machine (e.g. by sending a malformed packet), and those are very uncommon nowadays. There can ...


4

I say put up an IDS and/or enable firewall logging capable of detecting port scans. Wait for one to happen naturally, and then show the client the evidence that they're already being port-scanned. Alternately, you can simply schedule some downtime, unplug the WAN interface from the Internet, plug it into a standalone local router that pretends to be the ...


1

Edit: If you are connected to the Internet, then yes it is possible. When you say connected to the Internet (doing nothing else) Do you browse websites? Receive email? Connect to any other computer from the Internet? If you do any of these things, you can still get infected. If you do none of these things, then it is still possible (although ...


1

If you are just connected to the Internet (so you are not downloading anything), your computer cannot be infected, but attacker can get to your computer through an open ports. Another problem will be if you already have virus in the computer (like malware), it can use the connection to send data (e.g. passwords) to the attacker. So there is no possibility ...


1

Short: Don't download anything and you will be fine. Long: If you aren't downloading any file from the Internet there is almost no possibilty that your computer will be infected. If you aren't downloading any file from the Internet and you only fear from viruses that affect your computer directly then the only way to actually infect your computer is through ...


1

There is no way to completely stop the hacker, you can only slow him down. No protection is 100% effective (yet).


4

Before the attacker can send any data to the SSH server, he has to complete a TCP handshake. This means the attacker has to guess a 32 bit sequence number. (If SYN cookies are used, the attacker's chances may improve.) Assuming your server is generating good sequence numbers, this will significantly reduce an attackers ability to attack your SSH server ...


5

In short no. Because SSH runs on TCP (although there is a UDP version, this is unusual) a TCP handshake is required to commence the SSH protocol's own authentication and its following communication. A private address will not cross your perimeter router to and from the public internet so any spoofing of an internal address as it comes inbound (assuming no ...


0

From the UI snippet alone, we cannot tell much, but given your pseudo-code of: http:// + {Whatever host they typed} + : {Whatever port they typed} + /path/ You might be in danger of someone crafting the following input: http:// + {evil.com/evil_script.php?http://10.16.1.159} + : {8080} + /path/ In this case, the evil script now can input to your website ...


3

The same exact rules apply to webcams as in the thread you referenced. If you put your webcam on an obscure port (not just 8080 or a common variant) then Shodan will not find it while crawling. If you keep your webcam protected from anonymous access (set unique user/pass settings for all accounts on the cam) then outsiders will not be able to see it even ...


2

Those are default Linux "consoles" or virtual terminals (VTs), Alt+F1-F6. I don't remember seeing a system that didn't have them installed by default. You'd disable them by removing them from your init/systemd/upstart/whatever scripts. Documentation for your Linux distribution probably mentions that.


1

The Short answer to this is Yes, its insecure. To explain, you must first understand what a Bridge is. A bridge in it's simplest definition is connecting two or more networks together. I would say this basic concept has been muddied since bridging to a layperson has been obfuscated by "All in one" devices. What you are essential doing is mapping the ...


2

To be honest, as far as information security is concerned, any device connected to the Internet is vulnerable. Microsoft is correct in saying so. Imagine a scenario where you have multiple internal network nodes that communicate only internally. You decide to open up just one port on one node in the network to freely communicate with the external internet. ...


4

I assume you are talking about the Mask Attack and not Brute-force Attack which is outdated and replaced by Mask Attack. I had to add --pwd-min=8 to the list of parameters to force it to start at 8 digits from the get-go. Source: http://hashcat.net/forum/thread-1538.html


0

The exact answer will depend on the specific client implementations. But based on my experience most clients will in the default configuration automatically connect if they are within range of an access point with an SSID and encryption method which the client has been used before. If the network is unencrypted there is no more information needed on the ...


1

When attempting a login and entering the wrong password, I would state that there is no reasonable reason to keep the password entered - the user can't see the characters, and thus can't see any mistake they may have made, nor correct it, so they'd have to start over anyway. Additionally, there is a reasonable reason to not store invalid passwords for any ...


3

When the credentials are wrong, the server sends you back a page containing the filled username and perhaps also the password. That should be done with https, and caching headers asking not to store it, but there's the possibility that the error page that was sent with the provided password in the source is stored somewhere (browser cache, an intermediate ...


0

How mature is the clients cyber security program? If the customer has never had a penetration test before, they have little to gain from an unannounced test. In this case things should be very collaborative and open. If however the customer has their own fully staffed SOC (Security Operations Center) that regularly detects and responds to threats, a pentest ...


3

What you describe isn't technically an attack. Nothing is exposed, nothing is exploited, and the parties involved are not affected. What you are describing is a phase of an attack called "Information gathering". Any targeted attack will involve Info Gathering at some point so that the attacker knows what to do to gain what is desired (DoS, access, data, ...


0

As mentioned by echelon, Zeus source code is available in GitHub. Availability of its source code (leaked in 2011) is one of the reasons many modern botnets are evolved from Zeus. Be careful when infecting with your botnet several VM/computers you control, you don't want the to infect real user machines with your toy botnet! For additional security you ...


1

Speaking of isolated pentesting, compartmentalisation is your friend. It's always good if someone knows what you're up to. Could be the Board, CEO, CSO, ICT director, or any other lower management but people that are going to be pentested should not be informed if you want to observe genuine reactions. There are some cons though, mostly if your testing is ...


0

Here's two factors against announcing: A real attacker who is a user but was waiting for the most opportune moment for the attack (or not sure whether to attack at all), may just find the opportune moment in an announced pentest, when it becomes normal-ish for unusual things to happen. People who would otherwise gleefully grant access to restricted assets ...


0

I think there is one aspect of this comparison that was overlooked. user185 came close but didn't quite get there. I agree that these are apples and oranges and feel a better apples to apples comparison to be HTTPS and SSH. HTTPS and SSH utilize different layers of the OSI model and therefore encrypt the data at different times in the transmission. Then ...


0

The factors are largely one of trust, and risk. Do you trust that people won't go and suddenly add in new security that didn't exist before? Trust is incredibly important in security, and generally under-appreciated in the IT community. Trust between the security department and the rest of the company makes everyone's job easier. When people trust you, ...


1

SilverlightFox, I feel that there are 3 main points one must keep in mind when disclosing a penetration test to personel: What systems are you targeting? - The most important because depending on what is in scope, technicians for these services might need to made aware so that they can prepare and remediate any issues that arise. What are the laws and ...


2

For me the answer to this question largely revolves around the type of testing being undertaken. If you have a "proper" penetration test where the testers are simulating an attack, a decent quantity of the benefit of the test is seeing how/whether the attack is noticed and how the internal users/IT react (e.g. do they report it to the helpdesk if something ...


0

Considering the impact of an actual penetration by malicious parties (which is very high for most modern businesses), the best practice would be to do pen tests only as part of a much larger scope of action on penetration countermeasures. For example, the first pen-test you do might be fully notified. You can then record any objections, and perhaps even ...


1

One crucial thing is to refer to the company's Information Security Policy. These policies will also decide what an employee is allowed and not allowed to do in the company with aspect of IT security. It also decides what will be the penalty if an employee breaches a security policy. So for eg: if the policy says that the company can monitor any one any ...


1

That mainly depends on whether the user should know of the test. Of course, since you're simulating a real attack, you may or may not tell them, where comes the dilemma of things users would do. It's just that you should inform all those users for whom you are not testing the preparedness of attack. That's safe enough, because real attacks can come anytime ...


2

The default value of $GATEWAY_PROBE_HOST is 8.8.8.8, which the module initially contacts with a TTL value of 1. This is done to discover the current default gateway (since TTL will expire at the default gateway and it will send an ICMP time exceeded message). It seems like you have an invalid IP address in the GATEWAY_PROBE_HOST datastore option. Run the ...


1

I would recommend u block alle UDP-Ports 1-65535, also all TCP-Ports except one which brings you further to your squid-proxy running with filters and ACLs to undertake more filtering options. uTorrent wont have a chance to connect!


-1

Your INTERFACE field is empty! You have to set it to the interface from which the packets will be sent. Also it is a good idea to first ping the remote machine to check if it is alive. To find list of interfaces on Linux machine. Use ifconfig -a command. To find list of interfaces on a Windows machine. Use netsh interface show interface command.


1

Not sure how helpful this is but have you tried <?php as your content rather. [Untested] I've only personally setup TCP DDoS blocks using snort+snortsam for uni project. Also check you have defined correct NIC in conf file. Hope someone can give you a more direct answer.


0

Just to add on HTTPS. It does not provide privacy of what you're requesting and getting answers from. It provides privacy for the content. So what is leaked is: Canonical Name of the Certificate - i.e. domain for which the cert was issued for. SNI (or Server Name Indication) - i.e. domain for which the request was made for. SNI was introduced to allow ...



Top 50 recent answers are included