Tag Info

New answers tagged

1

After reading the linked blog post and after cross referencing his issues with the OAuth 2.0 RFC I have a few issues with his concerns. In the first section of his blog post, he has two major issues with using OAuth within a single page web application using the Resource Owner Password Credentials Grant: The client_id and client_secret are baked into the ...


3

You can still see the traffic pattern when looking at the encrypted SSH connection, but you don't see the target host of the requests. But if you know what the target host might be you could still do the same kind of traffic analysis - at least if you only have a few connections at the same time. For a similar kind of flow control analysis but for SSH see ...


1

WPAD attack is a common attack technique among penetration testers (and attackers) usually performed on the network segment where workstations can be found. Doing WPAD attack on servers might make sense, but it is not common. E.g. there can be an auto-update mechanism which downloads regularly something from the internet. But as you said, your servers had no ...


0

The orthodox way to accomplish this would be to use SSL interception, such as SSLBump, with Squid. If you don't want to intercept SSL traffic, you can do this via DNS. This would have the effect of blocking the entire website regardless of protocol, e.g. http vs https vs ftp, based on DNS. So you could blacklist "facebook.com" and have your DNS server ...


0

When traffic is HTTPS, you can't see the full url visited by the user without doing a MiTM (sslbump). That's said, you can see the domain requested either by looking at the string after the "CONNECT" sent to your proxy by the client or by inspecting the beginning of the TLS handshake (thanks to the SNI extension). You can also block using DNS. You need ...


3

I originally made a comment on some answer, but I think that the person asking the question is confusing anonymity with IP spoofing, which are different beasts altogether, so I'll go into a bit more detail. In a typical environment, you can not spoof an IP address for an HTTP request, and this is because an HTTP request is running over the TCP stack. ...


3

When i read your question, TOR browser immediately came to my mind, the idea behind tor browser is "bouncing your communications around a distributed network of relays run by volunteers all around the world". this not only changes your IP address every a couple of minutes (please check specific timing in the browser), but with one click (onion button > new ...


10

There's a number of ways that you could achieve this As @raz says in comments use Tor. The Tor network is designed to anonymise Internet traffic so this would fit your bill quite well. Using something like Tails OS could be an easy way to get started for you in that line. As @zviad-gabroshvili says use a proxy. there are a wide range of proxy services ...


4

I cant create a comment, so this is my two cents. You can of course send a HTTP request under a different IP number (other than yourself, "anonymous"), using NMAP. But the one down side would be that you will never get your HTTP request back, because if the server responds it will respond to the spoofed IP address. Unless you set the IP address to some ...


6

If you are running Linux, you can install proxychains by opening terminal(Ctrl+Alt+T) and in terminal type sudo apt-get install proxychains and press Enter, second option you can use is that use http_proxy. Check proxy list here: http://proxylist.hidemyass.com/search-1299183#listable In terminal type: export http_proxy="http://x.x.x.x:port", press Enter. To ...


0

Is there a way to hide every IP address in a home? Is there a way to get every device in the house to be proxied with one sign in from one device, or is that dreaming? Here a Gyro Gearloose's idea how to make it work when you are not a home. Modern smartphones are able to share your Internet connection to other devices via Bluetooth or WiFi. What you ...


1

X-Forwarded-For header may be used to forward client's real IP in case of source NAT. But not all application use them. This header is often inserted by load-balancers or reverse-proxies, depending the architecture in place, when the application needs to know the real IP belonging to a client. When this header is inserted, the application can see 2 IPs: ...


1

Burp Suite can do this to MITM HTTP and HTTPS traffic. This is very easy via Invisible proxy mode: Normally, web proxies need to receive the full URL in the first line of the request in order to determine which destination host to forward the request to (they do not look at the Host header to determine the destination). If invisible proxying is ...


0

The site is probably just checking whether your IP address is in the known list of ToR exit nodes. A pretty much identical question exists here : http://tor.stackexchange.com/questions/1229/how-to-chain-proxy-after-tor While I somewhat question your motivation (are you attempting to bypass this block due to you actually being a spammer?), I'm going to err ...


4

Here are some issues about static resources (SR) that I can think of: SR that are not served via HTTPS in combination with cookies that don't have the Secure flag will leak the respective sensitive cookies and also cause browser warnings JS resources that are not served via HTTPS can be modified by an attacker with a privileged network position and can be ...


0

Using a VPN service that has a trusted nature like Private Internet Acces, as they don't log user's activities ( well, many claim that but this VPN has gathered a good reviews from privacy advocates including Rick Falkvinge,EFF etc with automated email masking services like Blur from Abine Inc. can help you a lot. You can't be anonymous using these but up to ...



Top 50 recent answers are included