Hot answers tagged

93

If what you describe is true, your chat room is designed badly. The view of the server and what packets it receives should be forwarded to other users should be independent from whatever packets are coming in or going out. Manipulating the traffic on a client should only interfere with that client's view of the chat room, never with other clients. If you ...


50

The short answer: use better chat room software. Your question is lacking details about what kind of chat room program you're using. I am going to assume that it's either a simple client-server model, or a direct peer-to-peer. Either way, you have a sender who types and sends a message, and a receiver (either another client, or a centralized server). From ...


25

Your question is lacking detailed description of what's going on. Therefore, it's impossible to solve the problem you described. However, it might be helpful to point out a different one. If what you described is true, that isn't your problem. Your problem is a much bigger one. Namely that you trust the user. Never trust the user! I assume that you tell ...


5

You have to know what software the administrators are using to sniff the packets, additionally you have to know a vulnerability that is capable of crashing the application. If these requirements apply, the answer to your question is yes. For reference, take a look at past wireshark vulnerabilitys: https://www.cvedetails.com/vulnerability-list/vendor_id-...


5

Yes. A Harris Stingray, Boeing DRT box, or other cell simulator can intercept SMS messages. These are monitoring devices that have secretly been used by police agencies for over a decade. They come with strict non-disclosure agreements where the agencies that purchase them are not even allowed to acknowledge their existence to the public, and certainly ...


4

You can intercept the traffic by building a bridge between the AP and the uplink. This can be done by using the bridgeutils and two network interfaces. The software side is described here. This will allow you to capture and view all traffic. You can then display the data in wireshark or use a transparent proxy to get the informations you want in a protocol ...


4

You cannot open a remote file with GPG through FTP. Instead you would need to download the file to the local system and open it there. Because of this the decryption will be done only locally (and will be independent from that way the file arrived on the local system) and thus password for the file will thus stay local too.


3

You may not understand https, so I'd like to explain it a little bit. What Happens With HTTPS? Since it uses HTTPS, you generally don't have to worry about packet sniffing if it's properly implemented. With or without HTTPS, the program is not safe from packet sniffing (few things are). Is that a problem? No. Why? Because with properly implemented crypto, ...


3

NMAP has a sniffer-detect script built-into it, it's probably the most simple solution out there. I have seen no comparison of the two tools on their effectiveness. Note that all these solutions do is try and find interfaces running promiscuous mode, there are many ways to sniff a network which would leave no traces at all, for instance taps and spans.


3

The NSS SSL Keylog file is a non-obtrusive way to extract SSL session keys from an application using the NSS library for SSL/TLS, but there is no standard way to do the same in all applications. (A generic approach would involve a man in the middle attack, but this is not really non-obtrusive.) The idea of the extracting session keys directly from the ...


3

I presume that by "router", you mean each of these is a "router/NAT/firewall" combination appliance. Most home routers include firewall capabilities, which is most likely what you're relying upon here. (Note that NAT is a connection sharing technology, but not a defense mechanism.) To directly answer your question, if a hacker gets inside your first ...


2

The difficulties involved in passively intercepting mobile telephone signals can be summed up as follows: Capturing the signals Analyzing the traffic Decrypting the traffic Capturing the signals on the downlink (base station to mobile) is relatively straightforward. You have to be in range of the transmitter and have a suitable receiver. GSM is a popular ...


2

SSL/TLS encryption is done end-to-end, meaning only each end can successfully decrypt the session. The point of it being that Wireshark, or other network capture/sniffing tools, cannot eavesdrop on the data contained. In a LAN or corporate environment, SSL interception looks like this: Client workstations tries to go to https://somesite. Inspection ...


2

According to the paper "WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages" from 2015 WhatsApp does not use HTTP(S) but: WhatsApp uses the FunXMPP protocol for message exchange which is a binary-efficient encoded Extensible Messaging and Presence Protocol (XMPP) Which means that you will not be able to ...


2

Yes. You are looking for promiscuous mode or monitor mode. http://security.stackexchange.com/a/37000/28585


2

With new versions of wireshark: Make sure the traffic is decoded as SSL, i.e. setup the SSL analyzer for this TCP stream in Analyze >> Decode As. Now it will show the SSL details for the packets. Pick the packet which contains the certificate, in this case packet 6. In the packet details expand Secure Socket Layer etc until you get to the certificate ...


2

You can not stop user from intercepting the traffic that your application generates. There're following alternatives that you can do for making your application works correctly :- 1) User Secured Connection(SSL/TLS). Although users on the same network will be able to view the network traffic generated, but they'll not able to figure out any meaning out ...


2

Short Answer: Mostly Likely Not. Your Traffic will be encrypted. However, it is possible to read the data by other means. If the sniffer is some type of malware on either your machine or the receiving end as it could view the data before the payload is encrypted or after its de-capsulated. If the attacker obtained the SSL certificate and is performing ...


2

Depends. If the server responded to the PHP Easter eggs they found out you're on PHP. Now they're probably running through a list of common PHP frameworks looking for those URLs. You need to make sure those URLs aren't able to be accessed by anyone other than yourself and your predefined IP address in the .htaccess file. Otherwise they'll eventually find the ...


2

Can I convert directly from a .der to a .pfx/.p12? I don't think so because Openssl uses PEM encoding for certificates by default unless you set it explicitly using -inform or -outform arguments. There is no such option listed in the pkcs12 command. Do I need a .key (not provided via http://burp/cert:8080) in order to do the conversion? You ...


1

Interesting video. In my opinion, to setup this kind on technique, you need to: 1) Own a domain name, say mysite.com 2) Each domain name has an "Authoritative name server". Usually the Authoritative name server are managed by the company that sold you the domain name. 3) You need to setup you own Authoritative DNS server on a public IP address, then ...


1

You can passively determine the operating system by figuring out TTL's and Window Sizes from analyzing Wireshark packet captures. These two sites may at least get you started: http://www.netresec.com/?page=Blog&month=2011-11&post=Passive-OS-Fingerprinting https://ask.wireshark.org/questions/2009/i-have-a-pcap-file-and-im-trying-to-find-out-the-...


1

Mark's answer is correct regarding the HTTPS and packet capture. To answer your second question: While the traffic is encrypted, that does not guarantee that the messages themselves are encrypted. It may be possible for someone else to recover and read your messages off the chat server. This is a much less likely vector, but it may be possible for the chat ...


1

I have a similar set-up, a whitelisted linux ftp server, receiving an encrypted file in the clear, and have asked similar questions. For one, I have it set up as anonymous, since what is the point of a login in the clear? Second, it is whitelisted, so the only theoretical vulnerability is IP spoofing. I read up on IP spoofing specifically in regard to ftp, ...


1

It's hard to say what your definition of "OK" is, but generally, I'd say, no, you're not ok with your current setup. I'll cover your points individually. The data being transferred is strongly encrypted. This is good. In other words, you could put the file with a download link up on a public website. If you trust the encryption, then your data is ...


1

The best way to mitigate this attack is likely to have good knowledge of the systems on your internal network and control access as much as possible. One common way to address this is to make use of things like 802.1x authentication for endpoints, such that connecting a rogue system to the network will not provide an IP address and the connectivity that ...


1

Question #3 is much too open ended to answer. For the others, the answer depends on the router model in question and, in function of that, the exact meaning of "admin access". If the router is a Cisco IOS based device and you have privilege level 15 access you can use the regular packet sniffing commands of IOS which would certainly allow you to achieve ...


1

From the client definitely yes, an attacker can sniff packets. This is not dependent or related to the MAC address at all. The OSI model bi-furcates the physical access and makes it openly accessible, which means that this is possible. Said so, there are ways as well to bypass filtering for MAC addresses on different access points making it a little ...



Only top voted, non community-wiki answers of a minimum length are eligible