We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

Filter by
Sorted by
Tagged with
0
votes
0answers
18 views

Employee's computer repeatedly tries connecting to Iranian IP. Are they infected?

According to our firewall, a desktop used by one of our Cloud Architects has been trying to make connections to an Iranian IP address 37.202.224.139, UDP port 58878. We noticed this behavior began ...
0
votes
0answers
3 views

How do you disable NetBIOS traffic on Mac OS? [migrated]

I noticed after running Responder on my internal network that my MacBook Pro is sending out NetBIOS name query requests looking for __MSBROWSE__ and WORKGROUP which Responder will send a poisoned ...
1
vote
1answer
131 views

Why is home Windows 10 machine listening on port 8080 by default?

Ever since we upgraded one of our home windows machines to Windows 10, Kaspersky has been logging blocked network intrusion attempts over port 8080. The exploit is a strange one and tries to hit a ...
0
votes
0answers
29 views

Is it normal that the service WMI Performance Adapter always starts when launching Chrome browser? Whats the reason

Is it normal that the service WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the reason? I have heared this service can be maliciously used to "communicate" ...
2
votes
1answer
48 views

HMAC and integrity

I'm studying network security and I found this question in my slide, but don't have an answer. Discuss the use of keyed HMACs for guaranteeing the integrity of a file being transmitted over the ...
2
votes
0answers
27 views

Can NAT Table be vulnerable toward any poisoning attacks?

I am learning the general concept of network security, and becomes aware of two poisoning attacks on the network infrastructures, that is, DNS poisoning attacks and ARP poisoning attacks. They are ...
2
votes
0answers
79 views

Is there a name for creating a malicious subdomain under of legit domains, like XXbadsiteXX.blob.core.windows.net?

This is similar to domain shadowing, but there is no compromise taking place of a registrar account; these sites let users create subdomains. I was wondering if there is a proper name for this kind of ...
1
vote
3answers
120 views

MITM: Is and How is it possible to manipulate HTTP POST data sent by the host to the server

Is it and how is it possible to modify a HTTP POST parameter that is being sent by the host to a server assuming that you are in a man-in-the-middle position in a network? HOST(POST=foobar) --------> ...
1
vote
2answers
68 views

Can a VPN provider or actors within its infrastructure access open ports on the client machine?

From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, can this be accessed by the VPN provider or ...
2
votes
1answer
47 views

Automatically change connection of VPN when accessing certain websites

So I am quite new to VPNs, just downloaded and installed NORDVPN despite the latest admission of security breach for a trial period. I am also running BitDefender TS on my computer. I wanted to know ...
0
votes
0answers
41 views

Why are files with curl output being generated in random directories? [on hold]

I'm on MacOS, there is a file called er being created randomly in different directories. When I read its content, it has the output of curl, like this: LiFan 3:32 PM % Total % Received % Xferd ...
0
votes
0answers
36 views

Why is TLS called application-level protocol? [duplicate]

I read this paragraph from rabbitmq networking page: Clients communicate with RabbitMQ over the network. All protocols supported by the broker are TCP-based. Both RabbitMQ and the operating system ...
-1
votes
1answer
47 views

threat intelligence gateway [closed]

A TOG (threat intelligence gateway) is a hardware piece that sits between the router and the firewall. The TIG uses the threat intelligence and filters out the malicious urls and IPs before reaching ...
2
votes
2answers
79 views

How to mimic a HTTP POST request?

I want to mimic a HTTP POST request that I intercepted and have raw on a file, what would be the best way to send it and be certain that I sent exactly the same request? example file: (private data ...
3
votes
1answer
168 views

It is not a hotspot, it was made to look like one while attacking my network [closed]

It is my first time posting on this forum, so correct me if I do things incorrectly. My ISP is Xfinity. I use their modem/router. I have been noticing unusual activities from my network and an ...
3
votes
1answer
285 views

How secure/safe is Eduroam?

The higher education institution that I attend uses Eduroam, a infrastructure and IT company that often caters for the infrastructure and network needs of research and educational organisations. I am ...
0
votes
2answers
68 views

firewall behaviour

If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he ...
0
votes
1answer
48 views

ip_forward reverting back to 0 during ettercap subnet scanning [closed]

Im trying to arp spoof a local network but the /proc/sys/net/ipv4/ip_forward is reverting back to 0 when ettercap is performing subnet scan on a network hub. Even if i change it back to 1 after the ...
0
votes
0answers
38 views

Is it OK to use HTTP for internal communication between two micro-services deployed on AWS ECS fargate?

I have micro services deployed as AWS ECS Fargate containers. For internal communication they are using service discovery end point. In my opinion, it is OK to use HTTP for internal communication. ...
0
votes
1answer
49 views

SSL decryption/visibility on the host [closed]

Can host app see traffic before network encryption? E.g. can a host-based VPN app see cleartext traffic (http to https) to make any traffic routing decisions? Considering the TCP/IP model, all operate ...
0
votes
1answer
134 views

How safe is NAT in keeping my private network private

To extend on How can a webpage scan my local, internal network from the Internet? how safe is my private network against possible threats like DoS attacks, spoofing attacks, revealing info about my ...
20
votes
3answers
3k views

Why is it called a stateful and a stateless firewall?

I'm just wondering about the naming of these firewall behaviours. My basic understanding is that stateful filtering lets inbound traffic to return the outbound response without explicitly specifying ...
0
votes
1answer
80 views

What is the difference between a jumpbox and a reverse proxy?

These two seem to be an intermediary for external network and internal network. What is the correct use for each deployment? What are their differences?
0
votes
1answer
81 views

Nmap scan slow on some IP ranges [closed]

I'm a security newbie trying to scan a VPN in the range 10.0.0.0 - 10.0.15.254 using nmap on Kali Linux. The routing table: route -n Kernel IP routing table Destination Gateway Genmask ...
-1
votes
1answer
56 views

Would a firewall contain an explicit allow rule at the top?

Someone in an interview today told me every firewall has two rules: explicit allow at the top and explicit block at the bottom. Form the way I've always understood things firewalls are normally set to ...
5
votes
1answer
81 views

Detecting (and locating) rogue PXE server on a local area network

The computers on our office building are (via BIOS) configured to boot PXE as first option. This is a useful setting, as long as, when needed, we can remotely restore non-booting machines and all that ...
0
votes
0answers
16 views

Snort stops generating alerts when HOME_NET changed to public addresses

I have used snort for traffic analysis quite often and it worked fine as it generates rules that are corresponding to packets doing malicious activities on my HOME_NET which is always private ...
0
votes
1answer
77 views

How to create content rule in Snort

The aim is to detect, if anyone in the HOME_NET is searching for a particular term - say "terrorism" and generate an alert via a content based rule. I am using Snort 2.9 installed in a virtual ...
2
votes
1answer
110 views

Encryption on Mobile Devices - Multiparty Encryption - Key Management

I have the following setting: Let A, A', A'' be different mobile devices. They want to sent a secret message M to all (or some of) the C,C', C''. The message is passed on to B that stores it for some ...
0
votes
1answer
167 views

Preventing Basic Directory Traversal Attack in Linux application

I have a Raspberry Pi connected to my network and keep getting this vulnerability warning from my security software. I turned off the apache2 web server on the Pi, which fixed my port 80 issue but ...
0
votes
0answers
26 views

How to bypass egress traffic filtering for a reverse shell? [duplicate]

Say I have access to a linux server as non-root user (gained RCE using an exploit), say I am only able to run commands via http in bash/sh but I'm unable the to make the targeted server connect back ...
0
votes
0answers
45 views

How to read SlowHTTPTest range attack when Nginx is the server?

I'm running an application hosted on Firebase and did some tests using SlowHTTPTest. For SLOW HEADERS, SLOW BODY, and SLOW READ the output is quite similar, i.e. the service is available which makes ...
0
votes
1answer
97 views

Firebase ports scanning using nmap

Purely for research purposes used nmap to check security of my application deployed to Firebase. However, there some questions which I can't understand: Why Firebase has open so many ports? Something ...
3
votes
2answers
296 views

Can I blindly trust 127.0.0.1?

On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:...
0
votes
0answers
18 views

Issues with finding a gateway with static routing [duplicate]

I am doing this online lab where I am hosting a Kali Linux box in VmWare fusion, and VPNing into the online lab. These are my networking adapters once I connect via VPN: eth0: flags=4163<UP,...
0
votes
3answers
122 views

Setting up a secure modem & router with ISP

I am looking to setup new internet service with an ISP and would like to purchase my own secure modem and router. Googling doesn't seem to give me the list of what I'm looking for, are there any ...
0
votes
2answers
260 views

Google suspicious activity warning persists for 4 days despite my confirming I recognize it, does this indicate additional security issue? [closed]

I had a google suspicious activity warning four days ago triggered by logging in from a location I don't use often. I accepted the offer to view the activity and acknowledged that I recognized it. ...
1
vote
0answers
108 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
0
votes
3answers
120 views

What hardware and or software do I need in order to limit outbound traffic?

I have a situation where my users need to be able to access the internet and search engines to be able to perform their jobs. My problem is that I need to prevent them from being able to upload files ...
0
votes
0answers
24 views

How do you secure your PC and Wifi at a shared office/co-working space like WeWork? [duplicate]

I'm fairly good with PC's but no expert. I'm at a WeWork (coworking) and connecting to WeWork's wifi network. There are a bunch of tech startups, so quite a number of people who could potentially ...
19
votes
3answers
5k views

How Can I Process Untrusted Data Sources Securely? [closed]

Here is the conundrum: At my current company, we process physical discs from numerous third party sources and extract the data from them to ingest to our own system. While we can generally trust the ...
0
votes
1answer
89 views

DMZ an additional router

Recently I had an idea to test use a server (with ubuntu) and I need it to be accessible from the outside with port forwarding. I'm not often at home, but the internet provider doesn't like their ...
0
votes
4answers
117 views

Issues with using Usernames as PC Names

Our organization is looking on changing the naming conventions on our Admin PCs to make it easier for tech staff to remote into user machines. A current favorite idea is to pair user names with the ...
0
votes
2answers
147 views

Easiest way to secure my home network from work pc

I am about to start a work at home position using a mac. I will be using my own personal internet to connect to their servers through their VPN. I want to isolate my work PC from accessing my home ...
-1
votes
2answers
151 views

How to perform a security test/review/penetration testing of Ethernet ports?

I have been engaged by a client who wants its Ethernet ports checked to determine whether port security is functioning effectively. What can be the approach or steps to do check Ethernet port ...
0
votes
1answer
81 views

Preventing host discovery in network

With tools such as Fing (Android app) and netdiscover (Kali Linux tool) its possible to get all connected devices in network. How it's possible to prevent host discovery in a network?
0
votes
2answers
212 views

Why is 0.0.0 an associate of 0.0.0.0? [closed]

When i redirected a single webpage to an address http://0.0.0, i also found that 0.0.0 is an alias of the network address, but since it is only 3 bytes, this seems to be strange. Why would chrome and ...
1
vote
1answer
99 views

Norton Security blocked “Fake Tech Support Website” within router?

Norton Security (software installed on the computer) supposedly blocked a fake website coming from my internet router. (See the full alert details window screenshot). My internet router is a BT Home ...
0
votes
1answer
138 views

How can someone track work activity? [closed]

Problem: Recently we had an interesting thing which happened at work. My colleague was playing some Flash games at work and after some time someone from organization remarked about that and asked to ...
4
votes
1answer
247 views

How were nuclear launch codes authenticated?

What is the history of authenticating nuclear launch codes? Were hashes used for verification? How would a nuclear launch base be able to verify that the code is correct, and how were new codes ...