Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

1
vote
1answer
15 views

Other computers/customers of my Internet Service Provider appears under my “Network” section in Windows Explorer

I could see many computers under "Network" section on the left sidebar of Windows Explorer, but I am the only one who uses computer on my home. So I suppose all those computers are also using the ...
32
votes
7answers
108k views

Why is WPA Enterprise more secure than WPA2?

In personal mode WPA2 is more secure than WPA. However, I have read that WPA Enterprise provides stronger security than WPA2 and I am unsure exactly how this is achieved.
0
votes
1answer
2k views

Can't connect to fake AP with airbase-ng

I use kali-rolling on a virutal machine and I try to set up a fake access point using airbase-ng, but my devices won't connect to it whatsoever. My steps are: I put my wirless adapter in monitor mode ...
1
vote
1answer
88 views

Can an unprivileged program modify an HTTP request response on the local machine?

Imagine you have a simple GET request going to server 123.456.111.222. Your client executable creates a winsock on the server IP (TCP) and sends the HTTP request (unencrypted) to the server. If a ...
2
votes
2answers
143 views

How can a malware retrive victim data without compromising the malware owner?

I was wondering how can malware, for example a keylogger, deliver its data without compromising its owner? Because as soon as you know you got a malicious program running on your computer you could ...
1
vote
1answer
118 views

Why might malware make a DNS request for an epoch time converter?

I am analyzing malware and I see that two executables when run in a sandbox made DNS requests for www.epochconverter.com Why would an attacker risk detection by making a network request to ...
0
votes
0answers
50 views

Why is generated different traffic for the same attack?

I created a scenario in VirtualBox (configured as internal network) with two machines: Windows XP and Kali Linux. I used ms08_067_netapi exploit from Metasploit and the payload windows/meterpreter/...
0
votes
1answer
50 views

Can I use a normal wifi adapter instead of a alfa card for evil twin attack?

I am new to security and more leaned on application security. But now I learning attacks like the evil twin I need an wifi adapter (correct me if I am wrong ) to do the attack. I live in a remote ...
6
votes
1answer
1k views

How to detect malicious code sending information to attacker's server in linux

Suppose you have some malicious code on your linux laptop, for example a rootkit or trojan or something like that. Now restrict your attention to the case that the malicious code does transfer some ...
1
vote
1answer
270 views

Is it possible to run Responder and/or Layer 2 ARP Poisoning over OpenVPN or an OpenVPN Ethernet Bridge?

Situation: We usually perform penetration tests from Linux machines connected to the clients local network. However for this test the client wants the start point to be a windows machine and has thus ...
0
votes
1answer
74 views

Does SSLSTRIP in MITMF only works when the victim visits for the first time?

I just started learning MITM attacks and I use MITMF to perfom these attacks. I have one question regarding to sslstrip. I notice that sslstrip only works when we first clear the cache and history in ...
0
votes
1answer
78 views

Isolate devices on the same network

I asked a similar question on this topic and some guys recommended use VLANs or guest network, so I asked to a friend and he will give to me a router with guest network function. However, there is a ...
1
vote
1answer
133 views

Techniques used by highly sophisticated entities to snoop on VPN or SSH traffic?

It is mentioned in almost every where that very strong agencies, and governments are able to watch the online activity of the people. Aside from techniques like attacking computer networks, and ...
1
vote
1answer
71 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
0
votes
1answer
52 views

network icon on lock screen, group policy

In an office setting, where it is an open space design, should I ensure that the laptop has 'Do not display network selection UI', enabled? Why or why not
21
votes
1answer
12k views

Is SOCKS secure?

In order to create a VPN, I open an SSH tunnel with a command like ssh -D 9000 user@host, and then I set my system's proxy settings to use SOCKS5 through localhost:9000. Well, setting up my home ...
0
votes
1answer
101 views

ARP poisoning NAC

I need some help in understanding the technique of Genians/Trustwave NAC regarding ARP poisoning. As seen here Bypassing Trustwave NAC, it looks like a good method, but I don't simply get it. With ARP ...
0
votes
1answer
135 views

PC turned on by itself and sending packages even when turned off

My father told to me that his PC has turned on by itself. I have no idea about what this can be, and this has never occurred before. After this, he turned off the PC and I checked my router, and seen ...
0
votes
2answers
105 views

Malware spreading through jump server and SSH data transfer

Can someone explain to me how jump servers mitigate the risk of malware infection please? Whilst I understand some of the benefits of having a jump server as an extra layer of defence i.e. ...
0
votes
2answers
984 views

Do any open-source firewalls support remote management? [closed]

Remote management is essential if you have to run more than three network devices, and is supported by all commercial firewall products. For example: Palo Alto Networks: In addition to control ...
0
votes
0answers
5 views

Is it possible to put my network card into Monitor mode without root privileges [migrated]

I want to put my network card into monitor mode to try out some simple network packet capturing but i need to have root on my user account in order to enable it. is There someway to do this without ...
0
votes
0answers
30 views

How to decrypt wifi traffic in realtime and write it to file with Tshark?

I have Wireshark setup to decrypt and display packets in realtime. But I need to have them written to file in realtime also. Someone suggested Tshark, but I can only get it to write to file and not ...
0
votes
1answer
46 views

How to access a shared webhosting webpage without the domainname?

I would like to know how one can access a shared webhosted webpage without using the domainname. If i directly access the IP adress I get Apache is functioning normally I need to access it since the ...
3
votes
2answers
4k views

What are the advantages to using a VPN over secured/trusted wifi

It's often recommended that you should use a VPN when using unsecured or untrusted networks, such as open public wifi or secured wifi that you don't control. What are the advantages to using a VPN on ...
4
votes
2answers
5k views

NMAP - Closed vs Filtered

A lot of people seem to ask this question, as there are a bunch of posts about it; however I feel like none truly answer the question (that I have found). I want to understand why NMAP decides to ...
5
votes
6answers
32k views

Is there any solution for block the HTTPS traffic using URL filtering?

The URL filtering can block the HTTP traffic but not the HTTPS traffic in Internet Explorer. For example, the website http://www.facebook.com is blocked by the URL filtering while the https://www....
1
vote
3answers
169 views

Does running Windows XP pose a security threat to the whole internal network?

I have a laptop that is not capable of running any versions of Windows above XP reliably, but that I want to connect to use to browse web using the last version of Firefox available for Windows XP. I ...
1
vote
1answer
118 views

Disabling external DNS lookups - is this really so beneficial for security?

I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning ...
0
votes
0answers
11 views

Vmware ports opening [migrated]

I am using vmware ws 14 and i have some Linux distributions installed and i want to open some ports the problem is in my modem when you try to open a port it requires you to chose only from the ...
2
votes
1answer
118 views

Did ZTE put a backdoor in my router? How can I remove it?

I have a ZTE router model ZXHN H198A. Recently, upon connecting to it with Telnet (with some default username-password, of course), I decided to go around the filesystem. Then I noticed that they ...
3
votes
1answer
195 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
3
votes
1answer
202 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
16
votes
3answers
1k views

What techniques and tools do you use to relate security events?

You have central logging going, detailed app logging/alerting (e.g. modsec), network based security alerting (e.g. snort), and whatever else feeding your observation deck. Do you have any cool ...
81
votes
10answers
104k views

Why do people tell me not to use VLANs for security?

I have a network, where a have a couple of VLANS. There is a firewall between the 2 VLANs. I am using HP Procurve switches and have made sure that switch-to-switch links accept tagged frames only and ...
0
votes
0answers
46 views

Why is the attacker allowed to create DNS traffic in a DNS cache poison attack?

According to this article, a DNS cache poisoning attack is performed the following way: Send a large number of resolution requests each spoofed with different source IP information for www....
-2
votes
1answer
72 views

Firewall can detect suspicious file over HTTPS [duplicate]

A firewall/router can intercept HTTPS traffic, analyse it and detect suspicious file download for example. From my understanding, it is acting as a proxy and/or a MITM device. If it is capable of ...
0
votes
1answer
50 views

Finding how many filtered ports of a host that would be listed as “filtered” on Nmap

I just started working on nmap and was confused by this question. I'm unsure if I understood it correctly, so I appreciate your help with this. Using Nmap, find how many ports are filtered in testphp....
0
votes
1answer
72 views

Bypassing URL verification [closed]

I'm dealing with a URL validation function that was made by the developer (instead of using trusted methods). Here is a slightly modified version of the function: public static bool IsValidURL(...
4
votes
2answers
1k views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
2
votes
3answers
129 views

2 vs 3 tier network architecture

I am interested in how a 3-tier network topology (web/app/data) provides improved security than a 2-tier topology (web-app/data). I understand the concept of a DMZ as the initial contact point with ...
0
votes
1answer
57 views

Do wifi access points and routers get some kind of data from devices when a device is able to see them?

I was wondering if when a router is broadcasting its signal, it is able to handshake with devices that are wifi enabled and looking for a wifi network to connect and get some info from them?
0
votes
1answer
457 views

Analyze / Sniff all packets from all devices connected to a router

First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment. I'm trying ...
2
votes
1answer
174 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
3
votes
5answers
380 views

How to introduce delay in scanning tools that do not implement delay without touching source code?

Usually scanning tools implement a switch in order to delay requests and not flood the target. Sometimes there tools that do not implement this delay option. Is there a way to delay packets from ...
2
votes
2answers
237 views

Can dual NIC Snort machine cause threats to bypass firewall?

I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic. Setup I am thinking about: Snort computer with two NICs One NIC connected to hub/tap outside firewall (...
1
vote
0answers
64 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers? [closed]

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
1
vote
1answer
53 views

lan-side denial of service affecting target's CPU performance

Why does a LAN-side UDP flood take up the target's CPU resources and make it sluggish? i.e: the mouse doesn't respond properly, opening an application is slow... Note: The computers are both ...
9
votes
4answers
10k views

Can I block the true IP address using X-Forwarded-For header in IIS?

All the traffic gets to my IIS server through a proxy. I can't block or white list IP addresses because all the traffic comes from the proxy's IP address. Can I use the X-Forwarded-For header with ...
0
votes
1answer
94 views

Can a PC without VPN expose the public IP of another PC with VPN on the same local network?

Computer 1 is surfing the internet while using a VPN and at the same time accesses files on computer 2 (this computer does not have VPN) on the same local network. Since computer 2 does not have a VPN ...
4
votes
1answer
1k views

WebRTC security & encryption

I am building a WebRTC application, and really concerned about security. I have read this quite interesting article : https://webrtc-security.github.io As I am far from being an expert in networking ...