Questions tagged [network]

Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].

Filter by
Sorted by
Tagged with
2
votes
0answers
77 views

Is there a name for creating a malicious subdomain under of legit domains, like XXbadsiteXX.blob.core.windows.net?

This is similar to domain shadowing, but there is no compromise taking place of a registrar account; these sites let users create subdomains. I was wondering if there is a proper name for this kind of ...
0
votes
0answers
3 views

How do you disable NetBIOS traffic on Mac OS? [migrated]

I noticed after running Responder on my internal network that my MacBook Pro is sending out NetBIOS name query requests looking for __MSBROWSE__ and WORKGROUP which Responder will send a poisoned ...
1
vote
1answer
120 views

Why is home Windows 10 machine listening on port 8080 by default?

Ever since we upgraded one of our home windows machines to Windows 10, Kaspersky has been logging blocked network intrusion attempts over port 8080. The exploit is a strange one and tries to hit a ...
64
votes
8answers
118k views

What is the difference in security between a VPN- and a SSL-connection?

I would like to design a client-server application where the server is placed on Internet. I assume that I could set up the client-server connection using VPN (is it using IPSec?) or using a SSL ...
5
votes
1answer
554 views

Government/ISP tracking of internet activity trivial to evade?

The recently announced Investigatory Powers Bill in the United Kingdom will mean that ISPs must store the internet activity of everyone for one year. Anyone who wishes to evade such tracking can use ...
0
votes
1answer
109 views

Command injection with brace expansion

Does anyone have more experience with bash brace expansions when dealing with command injections that filters whitespaces? I am encountering most likely not a filtering engine, but an bad parsing ...
0
votes
0answers
28 views

Is it normal that the service WMI Performance Adapter always starts when launching Chrome browser? Whats the reason

Is it normal that the service WMI Performance Adapter (WmiApSrv.exe) always starts when launching Chrome browser? Whats the reason? I have heared this service can be maliciously used to "communicate" ...
2
votes
1answer
48 views

HMAC and integrity

I'm studying network security and I found this question in my slide, but don't have an answer. Discuss the use of keyed HMACs for guaranteeing the integrity of a file being transmitted over the ...
-1
votes
0answers
40 views

How to learn offensive network security in practical way? [closed]

I have a knowledge in TCP/IP stack and socket programming, I know C, C++, asm x86 and operating systems core concepts. As I see, a lot of network security related books contain a lot of theory and ...
2
votes
0answers
27 views

Can NAT Table be vulnerable toward any poisoning attacks?

I am learning the general concept of network security, and becomes aware of two poisoning attacks on the network infrastructures, that is, DNS poisoning attacks and ARP poisoning attacks. They are ...
1
vote
1answer
142 views

Disabling external DNS lookups - is this really so beneficial for security?

I have recently started working for a company which disables external DNS resolution from the machines inside the network by not adding external forwarders to the internal DNS servers - the reasoning ...
4
votes
1answer
242 views

How can Nmap bypass Windows Server firewall rules?

I need to block all communication (inbound/outbound) from server A to server B (all ports/all protocols). Server A should communicate with every machine except server B. I can't place firewall rules ...
2
votes
1answer
1k views

Is it as easy to crack a wifi password, as shown in the video?

I was browsing YouTube and I came across this video In the video they show how to crack the password of a wifi using CommView, Aircrack and Wordlist. According to the video it takes about two ...
1
vote
3answers
120 views

MITM: Is and How is it possible to manipulate HTTP POST data sent by the host to the server

Is it and how is it possible to modify a HTTP POST parameter that is being sent by the host to a server assuming that you are in a man-in-the-middle position in a network? HOST(POST=foobar) --------> ...
13
votes
4answers
46k views

How does Team Viewer establish a Remote Desktop Connection?

I am wondering how is it possible for Team Viewer to establish the remote desktop connection over the internet even if the user has not enabled the 3389 port ? I am searching over the internet but ...
1
vote
2answers
68 views

Can a VPN provider or actors within its infrastructure access open ports on the client machine?

From my understanding of a VPN, it essentially creates a network between the two 'machines'. So if I have open ports (e.g. HTTP, SSH) on my client machine, can this be accessed by the VPN provider or ...
20
votes
3answers
3k views

Why is it called a stateful and a stateless firewall?

I'm just wondering about the naming of these firewall behaviours. My basic understanding is that stateful filtering lets inbound traffic to return the outbound response without explicitly specifying ...
2
votes
1answer
47 views

Automatically change connection of VPN when accessing certain websites

So I am quite new to VPNs, just downloaded and installed NORDVPN despite the latest admission of security breach for a trial period. I am also running BitDefender TS on my computer. I wanted to know ...
0
votes
1answer
400 views

Do vendors put backdoors on network devices?

There are several articles about "planting backdoors on network devices by vendors intentionally" , for example Hardware Vendor Offers Backdoor with Every Product. They found backdoors that were made ...
0
votes
0answers
41 views

Why are files with curl output being generated in random directories?

I'm on MacOS, there is a file called er being created randomly in different directories. When I read its content, it has the output of curl, like this: LiFan 3:32 PM % Total % Received % Xferd ...
1
vote
1answer
99 views

Can an unprivileged program modify an HTTP request response on the local machine?

Imagine you have a simple GET request going to server 123.456.111.222. Your client executable creates a winsock on the server IP (TCP) and sends the HTTP request (unencrypted) to the server. If a ...
1
vote
1answer
399 views

Is it possible to run Responder and/or Layer 2 ARP Poisoning over OpenVPN or an OpenVPN Ethernet Bridge?

Situation: We usually perform penetration tests from Linux machines connected to the clients local network. However for this test the client wants the start point to be a windows machine and has thus ...
0
votes
1answer
196 views

Does SSLSTRIP in MITMF only works when the victim visits for the first time?

I just started learning MITM attacks and I use MITMF to perfom these attacks. I have one question regarding to sslstrip. I notice that sslstrip only works when we first clear the cache and history in ...
8
votes
3answers
4k views

Restrict network access for a single process with SELinux or AppArmor

I have a Python script that access the network, and I want to deny it network access sometimes. How can I achieve this with SELinux or AppArmor? I want to be able to launch this specific script with ...
4
votes
1answer
2k views

Forensics - trace back DNS query origin on host?

So I tried to search the web for answers but didn't find any. Is there any way to trace back which exe file or application caused the computer to make a specific DNS query?
0
votes
1answer
213 views

Isolate devices on the same network

I asked a similar question on this topic and some guys recommended use VLANs or guest network, so I asked to a friend and he will give to me a router with guest network function. However, there is a ...
1
vote
1answer
157 views

Techniques used by highly sophisticated entities to snoop on VPN or SSH traffic?

It is mentioned in almost every where that very strong agencies, and governments are able to watch the online activity of the people. Aside from techniques like attacking computer networks, and ...
0
votes
1answer
63 views

network icon on lock screen, group policy

In an office setting, where it is an open space design, should I ensure that the laptop has 'Do not display network selection UI', enabled? Why or why not
0
votes
1answer
139 views

ARP poisoning NAC

I need some help in understanding the technique of Genians/Trustwave NAC regarding ARP poisoning. As seen here Bypassing Trustwave NAC, it looks like a good method, but I don't simply get it. With ARP ...
1
vote
0answers
334 views

List of default SNMP MIB tree values / OIDs? [closed]

I'm trying to find a resource that lists default SNMP mib values and object identifiers for various vendors / operating systems to use with snmpwalk. I have a list of MIB tree values for Microsoft ...
8
votes
2answers
3k views

LTE networks and MITM

2G would leave you vulnerable to spoofed base stations. 3G tried to somewhat fix that using mutual authentication. Now, I tried to check how LTE handles this but I couldn’t find any usefull ...
0
votes
2answers
198 views

Bad Connections Blocked

With a new Windows 10 computer, McAfee Livesafe is reporting nearly 20,000 bad connections blocked. I ran some tests from Gibson Research, including the UPnP Exposure Test and the All Port Scan. The ...
0
votes
0answers
36 views

Why is TLS called application-level protocol? [duplicate]

I read this paragraph from rabbitmq networking page: Clients communicate with RabbitMQ over the network. All protocols supported by the broker are TCP-based. Both RabbitMQ and the operating system ...
-1
votes
1answer
47 views

threat intelligence gateway [closed]

A TOG (threat intelligence gateway) is a hardware piece that sits between the router and the firewall. The TIG uses the threat intelligence and filters out the malicious urls and IPs before reaching ...
2
votes
2answers
79 views

How to mimic a HTTP POST request?

I want to mimic a HTTP POST request that I intercepted and have raw on a file, what would be the best way to send it and be certain that I sent exactly the same request? example file: (private data ...
1
vote
1answer
251 views

Multiple Independent Levels of Security vs Multilevel security

I am looking for a way to isolate two different networks from each other. Suppose we have 2 different networks (public and private). I am looking for a way to connect to these two networks via a ...
1
vote
1answer
254 views

How to pick an enterprise VPN provider?

We have always deployed our own VPN using an open source package, but as our company is growing we've become increasingly aware of the importance of scaling this solution, especially now we operate ...
3
votes
1answer
167 views

It is not a hotspot, it was made to look like one while attacking my network [closed]

It is my first time posting on this forum, so correct me if I do things incorrectly. My ISP is Xfinity. I use their modem/router. I have been noticing unusual activities from my network and an ...
4
votes
3answers
662 views

Share network with neighbor

My neighbor asked me if I wanted to share his network with me. Internet access is a little more expensive here than I am used to in my country. Before saying yes I wanted to know if I had risks in ...
3
votes
1answer
285 views

How secure/safe is Eduroam?

The higher education institution that I attend uses Eduroam, a infrastructure and IT company that often caters for the infrastructure and network needs of research and educational organisations. I am ...
0
votes
2answers
67 views

firewall behaviour

If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he ...
0
votes
1answer
45 views

ip_forward reverting back to 0 during ettercap subnet scanning [closed]

Im trying to arp spoof a local network but the /proc/sys/net/ipv4/ip_forward is reverting back to 0 when ettercap is performing subnet scan on a network hub. Even if i change it back to 1 after the ...
4
votes
2answers
1k views

Unknown MAC in network

A few days ago, I noticed an unknown MAC address in the statistics page of my home router. The OUI lookup yields Cisco as manufacturer. However, I don't have such a device in my network -- actually, I ...
0
votes
0answers
38 views

Is it OK to use HTTP for internal communication between two micro-services deployed on AWS ECS fargate?

I have micro services deployed as AWS ECS Fargate containers. For internal communication they are using service discovery end point. In my opinion, it is OK to use HTTP for internal communication. ...
0
votes
1answer
790 views

Analyze / Sniff all packets from all devices connected to a router

First of all, before explaining what I'm trying to do, let me clarify that my intentions are not steal any information, as it's only for study purposes, not even for my own entertainment. I'm trying ...
2
votes
1answer
206 views

Ransomware - All computers infected but one

Let's say there is a particular network which has a "monthly" successful cryptolocker attack. Every time, every computer in that network is infected. The set up is like this: 1x Windows 2003 server (...
0
votes
1answer
49 views

SSL decryption/visibility on the host [closed]

Can host app see traffic before network encryption? E.g. can a host-based VPN app see cleartext traffic (http to https) to make any traffic routing decisions? Considering the TCP/IP model, all operate ...
2
votes
2answers
272 views

Can dual NIC Snort machine cause threats to bypass firewall?

I am thinking about building a Linux Snort machine that can listen to both WAN and LAN traffic. Setup I am thinking about: Snort computer with two NICs One NIC connected to hub/tap outside firewall (...
0
votes
1answer
133 views

How safe is NAT in keeping my private network private

To extend on How can a webpage scan my local, internal network from the Internet? how safe is my private network against possible threats like DoS attacks, spoofing attacks, revealing info about my ...
1
vote
1answer
79 views

lan-side denial of service affecting target's CPU performance

Why does a LAN-side UDP flood take up the target's CPU resources and make it sluggish? i.e: the mouse doesn't respond properly, opening an application is slow... Note: The computers are both ...