Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

140 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
5
votes
0answers
189 views

How to send Wi-Fi management frames from macOS?

I realise that this question has been touched on before as linked here. However, none of the solutions suggested solved my question and it fails to answer the overarching question of how to send all ...
4
votes
1answer
630 views

Pivoting with Metasploit

I am trying to exploit a Windows VM on a different subnet behind a dual home Linux VM where I already have a shell. To keep it simple, I have a meterpreter reverse_tcp shell on the Linux VM (192.168....
4
votes
1answer
898 views

Powershell Empire - Token Impersonation

I have been struggling trying to get token impersonation to work in Empire 2.0. I use the credentials/mimitokens module to list and elevate to use a specific users token - I see mimikatz' output ...
4
votes
2answers
1k views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
4
votes
1answer
1k views

How do TSC (TKIP sequence counter) calculate into WPA?

I'm reading about 802.11, from IEEE's PDF, from page 1191, and in particularly I'm reading about TKIP. To decrypt and encrypt, you use a TSC (TKIP Sequence Counter) as you can see in these images: ...
3
votes
1answer
226 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
3
votes
0answers
79 views

Can I detect unique identifiers from random radio chatter?

I am trying to find out if I can uniquely identify smartphones (I would like to find constant identifiers such as IMEI) by passively sniffing the cellular data frequencies. I know that sensitive data ...
2
votes
0answers
115 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
2
votes
0answers
173 views

How to prevent a DHCP Starvation attack in a wireless network

Is there any way to prevent a DHCP Starvation attack when using a wireless network with anonymous users? Port security cannot be used since maxing the number of clients that can connect on a port ...
2
votes
0answers
91 views

Loosing internet connection while connected to specific VPN server?

I have noticed a strange behaviour earlier today on my VPN on a specific server. When I run a trace route command while connected to VPN (on a specific countries server) my internet will not work for ...
2
votes
1answer
204 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
2
votes
1answer
880 views

Potential router malware? Receiving “Access Denied” and other weird blocks from various websites

So I've been having some weird browsing behavior over the last few weeks and it's gotten a lot worse the last few days. I've been getting blocked/banned by various websites off and on. Here are a few ...
2
votes
0answers
91 views

Decrypting DH traffic in DMZ

We have various servers in our DMZ's. Some of them are behind load balancers (but only few). We also have BlueCoat SSL Visibility Appliances currently deployed in passive-tap mode (we get the inbound ...
2
votes
2answers
144 views

Wi-fi Certificate Permission and Access to phone/data

There are several questions addressing similar questions, but not quite the same (others ask about MITM Attacks). They also state conflicting and opposing answers/responses, so I ask here 3 specific ...
2
votes
0answers
1k views

Using burp suite, how can I intercept traffic from one localhost port, but not another one

I have one webapp available on localhost:12345, and another service running on `localhost:6789'. I want to monitor the traffic to/from the webapp (12345), but universally pass the traffic to the ...
2
votes
1answer
446 views

How to “Scan for hosts” only using ettercap (“text”) terminal interface?

I've been looking for a command to "Scan for hosts" in terminal ("text") ettercap. Do anyone knows how to scan the local subnet from the ettercap terminal? The graphical ("gtk") ettercap has the ...
2
votes
0answers
156 views

Duplicate packets in packet injection

I've been trying to develop a few scripts that can forge custom 802.11 frames and inject them through a monitor mode interface. I have gone through the development documentation of radiotap headers ...
2
votes
2answers
270 views

Can dual NIC Snort machine cause threats to bypass firewall?

I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic. Setup I am thinking about: Snort computer with two NICs One NIC connected to hub/tap outside firewall (...
2
votes
0answers
540 views

DNS Cache Poisoning

I'm in a process of learning how to perform a DNS cache poisoning attack. I run everything on an isolated VM environment, for educational purposes only. The setup is a linux machine with Unbound DNS ...
2
votes
0answers
30 views

What are the security implications of using local-link XMPP on an untrusted network?

I'd like to setup XMPP local-link messaging (Bonjour) on my laptop for use at home. However, I'm concerned about ensuring this is not leaking any information when I connect to an untrusted network. ...
2
votes
0answers
115 views

Securing apple remote desktop to brute force attacks on a public LAN

A client of ours uses Apple remote desktop for IT support in the office. To access a computer remote management needs to be enabled via System Preferences > Sharing and the user who is requesting ...
2
votes
0answers
312 views

Harden / Lock down SMB share

We have to use an embedded SMB server to transfer medical records to and from patients' phones. The medical records are AES-encrypted on the phones, in transit and on the embedded device. But then... ...
2
votes
0answers
234 views

Host process for windows services network activity between other computer on same network

Wondering if this is normal? I have two PCs hooked up to a router and when the other one powers up and I check my firewall I see that there's some sporadic network activity going on (mainly upload/...
2
votes
0answers
31 views

Secure userserver authentication with authserver

So, lets say we have Bob, Alice and Peter. Peter is trusted by Bob and Peter has an authserver. Bob hosts a userserver and Alice wants to connect to Bob over an insecure channel. But Bob needs to know ...
2
votes
0answers
680 views

Inconsistent duplicate TCP packets

How often does it happen that we benignly see a TCP packet that is retransmitted but has a different payload the second time? In other words, how often is it that we see a TCP packet with sequence ...
2
votes
0answers
105 views

Rogue Containment on a wired network (mostly)

I work as a security analyst for a large company. The answer must provide remote support. We are currently looking to build a piece of software (integrating existing products with home grown ...
2
votes
0answers
952 views

Isolating Computer on Home Network Using Multiple Routers

My goal is to isolate a computer on my home network. This computer (a rapsberry pi) should be considered untrusted and is accessible from the internet (port 22). I need a solution that will prevent ...
2
votes
0answers
74 views

Determining time it would take to exhaust IVs on 802.11b/g/n

I'm trying to learn about WEP attacks at the moment. I know that attacks against WEP require collisions of the initialization vectors. Is there a way to determine how long it would take for the ...
2
votes
0answers
127 views

Wayland Partial Encryption for Mouse / Keyboard? (Also X and RDP)

Question What are the best practices for implementing Partial Encryption, to encrypt just the input devices (mouse/keyboard, etc), not the actual video display, during remote desktop sessions using X,...
2
votes
0answers
132 views

please give me an specific example about “a lattice model of secure information flow”?

Currently I read the paper "A lattice model of secure information flow", but I think this paper is so abstract. Could you please give me an specific example and describe what the secure information ...
2
votes
2answers
303 views

Relaxed access to tcpdump

I'm looking to do some packet sniffing on a computer that I do not have privileged access on. I am considering asking the admins to allow users in a specific group access to tcpdump. Specifically, I ...
1
vote
1answer
95 views

Centralized brute force login detection using netflow data

Is brute force login detection feasible with netflow data? With the netflow data one could check the number of incoming packets to a specific destination port (for each flow). If the number is below a ...
1
vote
0answers
47 views

Does a browsers' vpn feature securely modify my ipv6 address?

If I use inbuilt vpn feature of a browser, does it modify my ipv6 address, making me safe as far as my mac address is concerned ? OS - Ubuntu 16.04. Browser - Opera
1
vote
0answers
77 views

What information for identification does a WiFi router get from a connecting device (Android)? What information can be spoofed?

When I want my device to connect to a WiFi router and make the router not recognize the device I have to change the MAC and the hostname. Is this right? And what information will also be usually ...
1
vote
1answer
92 views

Can an unprivileged program modify an HTTP request response on the local machine?

Imagine you have a simple GET request going to server 123.456.111.222. Your client executable creates a winsock on the server IP (TCP) and sends the HTTP request (unencrypted) to the server. If a ...
1
vote
1answer
156 views

Techniques used by highly sophisticated entities to snoop on VPN or SSH traffic?

It is mentioned in almost every where that very strong agencies, and governments are able to watch the online activity of the people. Aside from techniques like attacking computer networks, and ...
1
vote
1answer
78 views

lan-side denial of service affecting target's CPU performance

Why does a LAN-side UDP flood take up the target's CPU resources and make it sluggish? i.e: the mouse doesn't respond properly, opening an application is slow... Note: The computers are both ...
1
vote
0answers
32 views

How should I secure my database in Microservice architecture

Can someone tell me whether I should secure may connections to the database from my microservice? Should I worry about the communication between my microservice and database?
1
vote
0answers
30 views

Can a single domain be deleted from HSTS list through GPO

I have proxy performing a IWA authentication which intercepts the web request and redirects it towards the proxy's host name for auth. The redirect url is over http however the HSTS list on the end ...
1
vote
0answers
39 views

Are parts of my system susceptible to IP based malicious attack even with effective IPtables rules?

Yesterday I installed Cent OS 6 and had to flush the default IPtables rules (IPtables -F) in order to access a web app via my browser. Having very little experience with Linux/Network security this ...
1
vote
0answers
38 views

Is it possible to circumvent (ignore) routing table without root permissions?

The local host is configured to send all non-local traffic to a restrictive firewall VM configured in the routing table (route). Preliminary scanning shows that other routers are available on the ...
1
vote
0answers
40 views

How to secure unique identification of physical resources in a distributed system?

I'm attempting to build a mechanism to prevent frauds and provide traceability of physical resources in a distributed system. The idea is straightforward: the resource travels hop-by-hop on a network ...
1
vote
1answer
370 views

Is it possible to run Responder and/or Layer 2 ARP Poisoning over OpenVPN or an OpenVPN Ethernet Bridge?

Situation: We usually perform penetration tests from Linux machines connected to the clients local network. However for this test the client wants the start point to be a windows machine and has thus ...
1
vote
1answer
134 views

Disabling external DNS lookups - is this really so beneficial for security?

I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning ...
1
vote
0answers
155 views

scapy Deauthentication address understanding

I have the problem to understand from_DS, to_DS with Deauthentication packet, deauthentication packets are type=Managment, FCfield managment and control frames always FROM_DS = 0 , TO_DS=0, ...
1
vote
0answers
2k views

Nmap only detect virtual hosts and not physical hosts (maybe segmented network)

When my network settings is set to NAT and interface is eth0, this is the output of a simple nmap scan root@pc:~# nmap 192.168.0.0/24 Starting Nmap 7.60 ( https://nmap.org ) at 2018-03-04 18:47 EST ...
1
vote
0answers
96 views

Small data exfiltration protocol?

I have a small amount of data I want to send at regular intervals, such as from an IoT device. How would I design a network protocol or use existing protocols in such a way that my ISP cannot block ...
1
vote
1answer
343 views

SMSC spoofing attack

I attended a seminar on Telecom networks few day back and there I came to know how vulnerable our signalling network (SS7/ SIGTRAN) is. The speaker discussed an attack in which a spoofed SMSC is ...
1
vote
0answers
468 views

Replay attack in Wi-Fi (802.11) network

I am trying to create a small smartphone activated lock for my house via Wi-Fi. The setup is like this: The solenoid of the lock is connected to an esp8266 that acts as an access point, and has an ...
1
vote
0answers
206 views

Idle Scan with Windows 10 machine as a Zombie

I'm learning how to do an Idle scan and I'm practicing on my personal computers: I have a machine with port 21 open. I sent a SYN/ACK ping on the Windows 10 machine (the zombie) and I get x as the IP-...