Tag Info

Hot answers tagged

17

Most SSH clients will do that for you. With the ssh client provided with any good Linux system, simply type: ssh -D 5000 -N theservername where theservername is the name of the SSH server to which you want to tunnel the requests. Then set your Web browser to use localhost, on port 5000, as SOCKS proxy. And voila! all your HTTP and HTTPS requests will go ...


15

Using valid SSL/TLS connection by making sure you're always connecting to the https:// version of the website and that the browser isn't giving you any warnings or errors, is your first line of defence. An addon called HTTPS Everywhere can be very helpful here. The approach you're proposing (SSH to your trusted network) is a very standard approach. I use it ...


13

The implication of X11 forwarding is that it opens a channel from the server back to the client. In a simple SSH session, the client is more trusted than the server: anyone in control of the client can run commands on the server (assuming shell access), but the converse is not true. With X11 forwarding, the server is likely to gain shell access to the ...


13

The most systematic answer is to implement split horizon DNS in your infrastructure, such that only internal addresses resolve; clients then must use a proxy server to connect out to the internet, and the proxy server resolves external DNS for them. This is particularly effective if your core network doesn't have a default route, so that packets destined ...


10

Tunnelling is useful because it allows you to connect to any other machine on the network. Once you compromise one internal machine, you can use it as a platform for other attacks. Simply installing tools such as nmap on the compromised machine won't allow you much freedom in terms of actually exploring the network, beyond preliminary scans. Getting a VPN ...


9

You can indeed use tun/tap tunneling. The easiest way I know of to do so is using OpenVPN. There are graphical clients for that for most OSs. If you use 'tap' tunneling, your laptop will show up on the remote LAN, since layer 2 network traffic is also sent through the tunnel. Using 'tun' tunneling however, which occurs at layer 3, only your IP traffic is ...


9

What's up? Here's the meat and potatoes: nurf@sessmacheen $ ssh -f -L localport:localaddress:remoteport \ user@remoteaddress sleep 10; nc localaddress localport This is assuming that sshd is listening on the remote box, which I think I can infer from your post. Ok! So ssh is passed -f, which just backgrounds it after the connection is made, and ...


7

Can't recall the name, but I know there's been at least one commercial product which used port 53 to phone home (not a full TCP/IP tunnel though). I would seriously question the (f)utility of trying to prevent this kind of thing by attempting to block specific outbound traffic though. Firewalls were never intended to filter outbound traffic, tunnels, ...


7

In general, we set the shell to /bin/false and provide the -N option when creating the tunnel, something like; ssh -D 4444 -N -i ~/keys/user_id_rsa user@remote.com The -N switch tells ssh not to execute any commands upon connection, without it your connection will immediately close due to the /bin/false shell. You could use /bin/rbash to provide some ...


7

Tor isn't safe from man-in-the-middle attacks. The unsafe component are the Tor exit nodes. These make the actual, unencrypted request and therefore can read and modify your traffic. Tor provides anonymity by not letting them know where the request came from, but the actual traffic between the exit node and the Internet is not different from normal traffic, ...


6

I'd say that tunnelling is important due to the freedom that it allows with specific types of testing. This really only applies to external tests as if you start the test on the Internal network tunnelling is less important (although it could be useful for getting data out of the network). On an external test you might find an issue that allows for command ...


6

Actually, Moxie Marlinspike created a tool called SSLStrip. He actually tested it on his TOR-node, and found that a lot of people didn't notice that the encryption was gone. His talk is worth a watch: Tricks on defeating SSL //M00kaw


5

I realize this is an old question, but I just ran across it and thought I'd post my perspective for sake of the next guy. The best answer is caelyx's response: architect the network so only the proxy can resolve external DNS hostnames. As he points out, retrofitting this into a production environment is difficult. A compromise is to block all udp/53 ...


5

To be able to run SSH tunneling, you must have an account on the "edge" machine. It is difficult to permit tunneling without giving a complete shell access on that machine. That's a shell as a generic user. Theoretically, Unix-like systems enforce strict security rules with regards to local users, so that giving a shell access to a user is not a big deal. In ...


5

Have you considered using a transparent proxy? It can automatically intercept all traffic and feed it to the proxy. If you're asking about Tor, check out the Tor transparent proxy, which might do exactly what you want. You might also check out Torouter.


4

I often use Tor for this kind of tunneling. If Tor works in your network environment, set up a hidden service. The directory /var/lib/tor (GNU/Linux) has a subdirectory for your hidden service. Inside is a file called hostname. You add a section in you .ssh/config: Host *.onion ProxyCommand socat STDIO SOCKS4A:127.0.0.1:%h:%p,socksport=9050 plus maybe ...


4

Before trying to trade performance for security, I suggest actually measuring the performance. The overhead for SSH encryption is slight; it increases data size by less than 1%, and CPU usage is low unless you have a pretty weak CPU or a pretty fast network (a Core2 CPU can keep up with 10 MBytes/s SSH by using less than 15% of a single core). So chances are ...


4

Yes there is, but not the reason you may think off directly. The problem is that your traffic is secure so your ISP can't see what you are sending, and if you are using just IPs, he won't even see whereto you are connecting (he will only see traffic flowing between you and your SSH server). The problem is that you need to take care of your DNS requests. If ...


4

Question 1: Is there a better way to do it ? Like store a key here and whenever I try to SSH to the box, it authenticates me based on that key present in my laptop whatever my IP happens to be ? Yes, it's called SSH Keys. This concept has been explained already hundreds of thousands of times. Adding another explanation here is unnecessary. Issue 2: ...


3

I have seen this happen. It is mainly used by cheap geeks to avoid having to pay for public wireless. What they do is that they set up a server at home ether a fake DNS or just a random VPN at home. And when they are out and about they might have to connect to the internet so they look for any open wireless and connect and if it wants you to pay then you ...


3

Yes, it's possible for the root user on B to snoop your traffic, although you don't say exactly what OS it is. On Linux, that might include the ttysnoop program or using a debugger against sshd. I've used tunnel-in-a-tunnel a lot (as well as SSH over PPP over SSH, which is yet another layer), and it doesn't necessarily have a serious performance or latency ...


3

I have thought about this topic in the past and prepared five options for dealing with open wireless. I ranked them 1-5, with 1 being the most preferred. Don't use open APs Don't "remember this network" for open APs or "Forget this network" Use a SSH Tunnel, an IPSEC VPN, or a SSL VPN back to a known safe area, so MITM will fail Use SSL Everywhere and ...


3

If someone has access to B in the given scenario, they could set up a proxy to perform a man-in-the-middle attack on the connection from A to C. This would allow them to decrypt any traffic between A and C, if it is not otherwise encrypted at a higher level. The attacker would configure B to present itself to A as C while using the attacker's key pair. ...


3

Have your own VPN. Connect to a public wireless network, then begin a VPN session to your server / home server, then you can navigate with some level of privacy as if you where on your home.


3

Watch out that you are surfing possible only on pages that support SSL. There is for example a plugin for Google Chrome / Firefox you can force a SSL connection. Its called HTTPS eveywhere. Download links: Firefox Chrome Another option would be to use a VPN and establish a tunneled connection. And my favorite option is to surf via remote desktop on a ...


3

The actual physical layer or data link layer do not present a security concern as long as you force mutual authentication and use a properly secure ciphersuite. There is no direct risk with physical layer access. There is a future risk with it. As somebody with access to the physical layer or data link layer has the possibility to store all traffic ...


3

The most common solution I see is to have the firewalls at each location set up to only allow the tunnel to connect to specified endpoints. This means it can still be used for the purposes intended, but can't be used to access other locations. A pre-requisite is that you maintain centralised control over firewalls and endpoints, so there is no way to avoid ...


3

I had the same problem, constant pings to 202.39.253.11. I have removed ASUS Ai SUITE II and ran the uninstall cleaner and the pings have stopped The cleaner was at http://rog.asus.com/forum/showthread.php?28319-AI-Suite-II-uninstall-cleaner


3

Short answer is that I'm afraid that this isn't really a problem that you can solve with technical measures. If your daughter has physical access to a computer and a higher level of knowledge about how they operate than other people in the household, it's likely she'll be able to affect how they run to her liking. That said there are some technical means ...


2

It's actually very easy to create a single port tunnel to take advantage of whatever port is open on a router. This happens a lot in security testing - maybe I can take advantage on a vulnerability on a server, but I then want to do something useful with it such as escalate the attack further. What I then usually do is run netcat to create an outgoing ...



Only top voted, non community-wiki answers of a minimum length are eligible