New answers tagged

0

Don't worry. You are not being hacked. It is perfectly normal for your computer to detect one or more wireless networks other than your own. Mine is currently showing half-a-dozen - I live in a residential area and all my neighbours have wireless Internet too! This sounds very much as if a close neighbour has a wireless network on the same channel as ...


2

This is happening because your AP is able to filter out the MAC address and block it after an x amount of requests. What you need to do is to change the MAC address every x requests so the router won't be able to lock you out. Use reaver mac address changer: Reaver -i mon0 -c x -b xx:xx:xx:xx:xx:xx -vv --mac=vv:vv:vv:vv:vv:vv Warning: This might crash your ...


6

To your fear that a local hacker is trying to compromise your internet connection and/or your computer, it's actually quite hard to "fake" an WPA2-AES protected access point: the handshake doesn't expose the key and if there were a rogue device posing as the AT&T router, the handshake would fail with an error message. So, as long as you heeded any ...


46

It is unlikely a hacker stealing internet access will have the sophistication (or need) to make the wireless network change between different names. It is more likely that someone/some device nearby installed a new wireless network that happen to broadcast on the same channel as yours (there are only 3 or 4 non-overlapping ones to choose from) and have a ...


9

Here are some things you can try that may help you out. As you stated that you are not too computer savvy, I'll not be giving you any difficult instruction if I can help it. Possibly try turning off your router when not in use. This may reset your password to the default (I believe this might be printed on the device itself) If you can plug a hard line ...


0

(your system uses systemd if entering the ps -A command shows systemd with PID 1) If your operating system uses systemd: tty1 was instantiated by the command /sbin/agetty --noclear --keep-baud console 115200 38400 9600 vt102 as your ps -A extract shows. tty1 is always started on startup. Why? See Lennart Poettering's post "systemd for Administrators, ...


-2

Try This code to Stop ARP Attack netsh interface ip add neighbors "Wi-Fi" "Your IP" "YOUR MAC ADDRESS" example netsh interface ip add neighbors "Wi-Fi" "192.168.62.6" "02-17-FC-5F-06-CD" it will not detect but it will stop the ARP poisoning attack .. I just want to help you guys if you will trap in an attack then you can stop doing attack on you .... ...


2

You'll need to find a secure channel to exchange the new password over. Communicating verbally would work just fine. As to an automatic notification, the only way to do this would be to flash your router with custom firmware which would allow you to write scripts to add functionality, such as DD-WRT. However, DD-WRT is unsupported on the Huawei WS319. As ...


3

You can't, as there are too many addresses to scan for. Typically a residential ISP will assign a /64 subnet per customer, which means there are 18446744073709551616 possible addresses behind that router. That is a lot of IPs to scan. Also, the fact that IPv6 addresses are publicly routable doesn't mean the router can't get in the way and firewall off your ...


4

there are lots of attack vectors, such as : Sniffing admin/user passwords and exploiting systems using them Accessing an anonymous shares and planting malware there(if they're not read-only) Performing MitM attacks to steal data Exploiting IPv6 in LAN : it's often an IPv4 LAN's but people forget to disable IPv6, so it's a prioritized by OS, especially ...


3

A lot of home networking "helper" apps, for network printers, network webcams, etc. will continuously scan the local network looking for devices. Some network appliances will too, like NAS devices, for similar reasons (looking for local printers). Is the device doing the scanning a Windows PC with a bunch of typical desktop apps installed? That would be ...


1

Short answer: No, not everyone can send a modified certificate to the client. Every certificate is digitally signed and the clients check these signatures. So you either need to ... create a fake signature (which is cryptographically hard), get a certificate autority to sign your certificate (which they should refuse to, because you are not owner of ...


1

It depends. If the server and people who recive the code try to use it as a PNG, the PNG viewer could not work or give an error. Also there is a website which turns JS into a valid, displayable PNG. But the code wont run unless you try to execute it. You could also rename a file hello3pm.exe to hello(special unicode symbol)3pm.exe and it'll display as ...


4

Anything can happen and what exactly happens depends on the server side code of the web application. Some believe in extensions, some believe in the content, some can be tricked with polyglot attacks, ... Thus in the best case nothing happens or you get an error because content is not allowed and in the worst case you can execute code on the server. If done ...


1

Okay with my first test, I used etherape GUI to show what types of packets were being sent when I replayed the injected packet. What I saw was the color code for "UDP UNKNOWN" which leads me to believe it is a possible issue with Nemesis itself. In wireshark, there was no response from my router as a result of replaying the packet. Subsequent tests using ...


2

The approaches you mention are a bit confusing, and I will explain why. In a properly designed infrastructure many of the bulletpoints you listed would be addressed: Hourly host discovery scans - If you implement strong port security on your switches, and used NAC - PacketFence (since you mentioned open source, I did also) you wouldn't need to worry about ...


0

If the host that is trying to connect to your port 4444 on your Kali is on the Internet, you'll need to configure port forwarding on the router you use to access the Internet - that is, your router needs to redirect connections from 4444 coming from the Internet to your internal VM (this process varies according to the router, so just Google a guide for more ...


0

In your case,You use bridge connection in VMware which means that your windows machine ip like 192.168.1.11 then your kali Linux ip would be 192.168.1.x you could see your ip address just type in terminal ifconfig and use namp to know how many port on your system is open. for that Here is command: sudo nmap yourip now you could see that what process ...


0

Your local IP address is pretty much useless outside of your network. The only time you need to worry about if someone has your internal IP address is if they also have internal access to your network, either physically or via a Virtual Private Network (VPN). It's very hard to initiate a conversation with a device inside a network from outside the network, ...


2

From iBoss Knowledgebase on HTTPS Filtering: The iBoss blocks DNS outgoing requests which would block secure sites users are trying to connect to that fall under the iBoss filtering policies. If you are experiencing iBoss not filtering secure sites, try to flush the DNS cache by re-booting the computer and the iBoss unit. So yes, it sounds like ...


1

Assuming you have control of the network equipment then yes you can log and monitor their actions. Full packet capture: Ideally you want full-packet capture of all traffic at key ingress/egress points for each segment. You asked for the best way to do this and this would give you the most data about traffic on your network. Even if you can only capture the ...


3

The support for proxy with nmap is very limited. Especially you cannot do any kind of ICMP (ping) or UDP scans, no SYN stealth scan, no OS detection etc. This means that the default nmap commands you are using will not work with a proxy and depending on the implementation will either fail or will bypass the proxy. You have to limit yourself to only the kind ...


2

It is actually expected that they would all have the same MAC address - MAC addresses do not survive the hop from router to router, so what you are seeing is likely the MAC address of your ISP's router (the closest MAC to your router).


1

I had this same issue about 2-3 weeks ago, with the same site coming up after running several scans with Roguekiller. Prior to that the browsers would lock up or work very intermittently, (Firefox, Chrome, Edge, IE , Opera, ect.) Using a web browser in a game, running a VM or Tor worked, but even Tor would lock up after an hour. This was on Win 10 64bit, ...


0

It's difficult to tell just based on this. More information would be needed to make any solid conclusions. If you really want to tell if it's compromised; reboot the system, use netstat to view any active connections. If a rootkit is installed, then you should see an unrecognized connection. The hard part is weeding this connection out amongst all the ...


3

If you are looking to map out your immediate LAN, a simple ARP sniffer (probably written in Python with the scapy library), would work just fine. But, if you're looking to find the entire network topology, there is a way to do it, but the circumstances are a bit specific. If the network utilizes Cisco routers, and those routers route dynamically using ...


3

Some background information for context : Some organizations save full-packet captures for their high-security or production networks. There are commercial products which do this too. People definitely do what you are talking about but not always for the reason you mention although that's a good side benefit. Ideally what you want is an optical tap at key ...


10

If you router offers a real DMZ then the rest of the network would be safe even if your Windows PC is compromised. A real DMZ is a separate network which has no or only very restricted access to the internal network. But, what most SoHo routers call DMZ is actually an exposed host, i.e. traffic from outside is forwarded to a single host inside the internal ...


2

You are correct in that UDP does not have a state like TCP has, so in a literal sense there is no session to hijack. However, because of this it is impossible to verify the identity of the sender of an UDP packet. All you have to go on is the sender IP in the UDP header, and that could trivially be spoofed. In that sense, it is easier to session hijack UDP ...


2

You have almost always timeout on inactive TCP session implemented in routers, switches and all that low level network machinery. It has little to do with security in the sense of protection against a deliberate attack, but just try to not exhaust resources because of buggy software failing to close connection, or other hardware errors in external network ...


6

As you may have noticed this has nothing to do with security whatsoever. Instead, the practice of killing long-lived dormant TCP connections has to do with bugs - it's a work-around for buggy software. One of the more famous examples of software leaving TCP sessions hanging is Internet Explorer (at least up to version 7). IE had the habit of not ending TCP ...


2

Universally Unique ID v 4 with device pre registration sounds about right for this sort of application. When a device is in the factory you flash it's firmware with a UUID in it. Then you register that UUID with the DB. If the UUID exists, you generate and flash a new one. This should be exactly what you want because now if someone grabs a device, they have ...


1

Authentication, authorization, and accounting (AAA) is a term for a framework for controlling access to computer resources, enforcing policies and auditing usage. RBAC (Role Based Access Control) is a way that dictates how a subject can access objects. Two other forms beside RBAC are the highly restrictive mandatory access control model (MAC) is compared to ...


49

I'm completely confused, though. What is the security benefit here? Nothing. The most likely scenario is that something in between is timing out the connection after 5 minutes to conserve resources. That could be a firewall, a WAN accelerator, an SSL accelerator, etc. Or it could be just a bad default setting. Who knows? Network admins often have ...


0

I'm assuming you're talking about configuring Cisco equipment here (based on the aaa new model remark). You can use AAA there to map (groups of) users to specific privilege levels. You can assign a set of allowed commands to each privilege level. This makes AAA on Cisco a form of RBAC.


13

I'm completely confused, though. What is the security benefit here? It might not be a question of security but have a different reason. Unfortunately your question only offers your view so we can only speculate what the real reason might be. One explanation might be that there is a simple stateful packet filter where the states time out after 120 ...


28

This sounds like a good example of a security "cargo cult". A security control has been implemented blindly without understanding the context involved or indeed implementing it correctly. Generally speaking in security the point of an idle timeout it to reduce the risk of situations where a client machine is left unattended and a malicious user gets to the ...



Top 50 recent answers are included