Tag Info

Hot answers tagged

42

The entire point of SSL is its resistance to eavesdropping by man-in-the-middle attacks like the one you're proposing. If you cannot make the client device trust your self-signed certificate, then your only options are: Intercept an initial HTTP request and never let the communication be upgraded to HTTPS (but this will not work if the if the client ...


11

Any suggestions? Is is doable? You need to own a certificate trusted by the device to intercept the traffic. How this can be achieved depends on how proper and open the certificate validation on the device is. The device might have a buggy or non-existing validation of certificates. This is typically No validation at all, in which case you could use ...


9

As you guessed, Facebook uses HTTPS, what that means is that requests to Facebook.com regardless of whether they are GET or POST requests are not sent over HTTP, instead they are sent over HTTPS in an encrypted form which the 'http' filter in Wireshark wont be able to display as regular HTTP requests. If you want to view the encrypted HTTPS traffic including ...


5

If I understand correctly, your connection to the Internet gateway is wired and everyone else is WiFi. If that is the case, the WiFi users cannot capture your FTP credentials because there is no need for the WiFi AP to transmit them, and it won't. But really, the answer is to convince the people at the other end to replace FTP with SFTP.


5

If you sniff on the exit node and the connection is not https/hidden service, then you will have the traffic in clear but you will not be able to know from who it came. Unless the traffic itself is revealing the identity. In other cases, as far as we know, you can't decrypt tor. As other said, tor will be useless if it was possible.


4

According to scuzzy-delta, yes: It is possible to detect that someone on your network is using Tor (e.g. You're a network administrator at a workplace, and an employee is using it), and the fact that you're using it is in itself interesting information. His answer: http://security.stackexchange.com/a/27848/76663 Using a bridged TOR connection is a ...


3

If user B is in same network, so he can use ARP poisoning for capturing the data that transfer from user A to the server. This type of attack called MITM ( man in the middle) attack. But if user B is not in the same network, the only way is that installs a backdoor or trojan on the computer of A. Anothe way is that before that user A open web browser, user ...


3

I would recommend using Fiddler for this instead. First you will need to MITM yourself though as Facebook sends this request over HTTPS. You can do this in fiddler by going to Tools -> Fiddler Options -> HTTPS and ticking: Capture HTTPS Connects Decrypt HTTPS Traffic Then you will see a scary warning, as shown below: Clicking Yes will install an ...


3

Take a Look at the FREAK tls vulnerability. you should be able to inject data into the SSL negotiation to trick the device into a RSA Export cipher, and from there the decryption of traffic by a man in the middle is significantly easier ( aka possible. ) Charles is written in java, shouldn't be too hard to modify to exploit this automatically.


3

Can This be done? I would say yes, but with some caveats. Depending on the cable and the data, you would need some very expensive / sensitive equipment to pull this off. To me this is a similar issue to the old Van Eck Phreaking (http://en.wikipedia.org/wiki/Van_Eck_phreaking). Intel has some tech to circumvent this kind of attack: ...


3

In a WiFi network, all information which is sent over the network is broadcasted over the air. Usually network interfaces are configured to just ignore any network traffic not addressed to them, but there are tools available which change them to "promiscuous mode" which allows them to also log and show any traffic which they receive even though it is ...


3

No. This is the point of SSL, to prevent this kind of unauthorized snooping. To authorize your proxy you need to tell the device to trust the proxy certificate, and tell the device clients to trust your certificate or use the devices private key, which it sounds like you don't have access to. For more information: ...


3

No, the very nature of HTTPS is that the certificate is required to decrypt it. You could sniff the traffic, but it would be encrypted and useless to you.


3

In "Promiscous mode", the driver still outputs standard ethernet frames belonging to the one wireless network you are currently associated to (identified by the BSSID). Possibly the device will only dump packets from the AP to wireless devices, but not packets from wireless clients to the AP, as receiving packets from non-AP devices is not used in AP client ...


2

No, this is not the case. A certificate signed by a CA contains only the public key, but for decrypting you need the private key too. This private key is not needed for the CA to sign the key, so they usually don't have it either. But, some CA offer to simplify the process of certificate generation by generating a key pair for the certificate too. In this ...


2

These days basic Software Defined Radio (SDR) kit has become very affordable so you can now obtain the RTL-SDR USB stick for about $15 and perform some GSM sniffing on a standard laptop running Wireshark. The GSM capture is done using the RTL-SDR and the airprobe tool (which builds on GnuRadio) that relays the packets to Wireshark, via the GSMTAP port (UDP ...


2

The reason you're getting this is because you load certain resources over HTTP. When you look at the page source code, you'll see this: <link rel='stylesheet' id='google-font-body-css' href='http://fonts.googleapis.com/css?family=Open+Sans+Condensed&#038;ver=4.1.1' type='text/css' media='all' /> <link rel='stylesheet' ...


2

These types of question has depends answers. The answer varies depending on the policies of owner of open WiFi and plans among other factors. but This question specially has 2 aspects: (second aspect may be your answer) First one: connecting people to an open WiFi network, without having the owner's permission and following his/her terms of service is ...


2

It depends on how the VPN is set up. One of the possible setups is the following: VPN connection to allow remote access to internal network servers of the company, but all other traffic is direct from you to the internet (so not routed through the VPN). All traffic is routed through the VPN making all traffic between you and the company secure. All other ...


2

If it is a PSTN line a simple tape recorder attached to the lines could do the trick. For ISDN I suspect you need a DAC but its also easy, as long as you have physical access to the line. Any connection using a Telephone line (digital or analogue) is easy to understand for anyone that knows the encoding schema. To realy protect it you should use the same ...


2

You can check network packets against public Tor node list (for example https://torstatus.blutmagie.de/) using WireShark or any other packet sniffing software.


2

There is a possibility that Promiscuous mode can be detected by another device on the network! You can/must configure your sniffer tool/software so that it doesn't allows to detect if you are in promiscuous mode. For that you have to configure your sniffer tool so that your machine doesn't reply to the packets/requests that are usually used to detect the ...


1

HTTP is an inherently "trusting" protocol: it contains little or no built-in security. This means that it is susceptible to the following: Traffic monitoring Anything transmitted over HTTP can be intercepted and read by anyone connected to any network sitting between the source device and the target server. Traffic redirection and manipulation With little ...


1

This sounds like a component of a broader targeted attack involving spear phishing. You might send a link to the victim for Banking.Example.com and begin your DNS reply spam for that domain. That way, you know which domain they are trying to resolve with DNS.


1

As per this StackExchange answer, you can find it using lsof by looking for st=07 on a raw socket: # lsof -n | grep -i st=07 ping 19241 gowenfawr 3u raw 0t0 477269 00000000:0001->00000000:0000 st=07 # ps aux | grep 1924[1] gowenfawr 19241 0.0 0.0 8596 832 pts/0 S+ 07:26 0:00 ping ...


1

Its very possible that your operator inserts a header in outgoing HTTP traffic containing your mobile number, just to allow remote billing, ad targeting, and remote subscription. http://www.htxt.co.za/2014/10/29/vodacom-admits-to-leaking-phone-numbers-to-websites/ Those sites you visit, are those "trusted" sites or are they "random"? If they are random, it ...


1

No, the purpose of a sniffer is to capture all packets, unless a filter has been applied at capture time. Using a new protocol might mean the data can't automatically be rendered or analysed with more effort, but you will find they are all still saved to the file. All the sniffer is doing is analysing captured data in the same way a router or gateway would ...


1

This all depends on which traffic your interested in. If you want to decrypt the traffic between your client and the device, then it is possible with a proxy. In fact, it is very similar to how Superfish works. See Lenovo Is Breaking HTTPS Security on its Recent Laptops for an outline of how superfish works. On the other hand, if you want to decrypt the ...


1

Theoretically speaking, public WiFi networks do provide some level of anonymity. You are right in that since tons of people are behind a single public IP address, it is harder to trace malicious activity to an individual. Practically though, a public network alone really doesn't provide enough anonymity to hide someone from law enforcement - mostly because ...


1

In addition to what Michael Karcher said, monitor mode has the advantage of not having to be associated with the AP. This makes it possible to be completely invisible, and to sniff packets on a network you don't have the password for. In promiscuous mode you have to associate with the AP, so your're sending out packets. Monitor mode can be completely ...



Only top voted, non community-wiki answers of a minimum length are eligible