Questions tagged [network]
Security of network infrastructure and network traffic. For questions about security of network equipment, topology, protocols, traffic, administration, and configuration. Related tags: [packet], [firewall], [network-scanners], [network-access-control].
2,862
questions
2
votes
1
answer
378
views
What is the best way to create a PCAP file containing malicious traffic?
I'm in my last year of university and for my honour's project I am tasked with comparing two intrusion detection systems, snort and suricata, hosted on a virtual machine on my PC.
As I have no access ...
0
votes
0
answers
51
views
Server placement for vendor verification check over the internet. DMZ or Private?
I have various servers on-premises on a private network. Some of these servers need to reach out to vendor websites to check for patch status, license verification etc.
Where should these servers be ...
2
votes
1
answer
197
views
Is this TCP socket encryption and password storage implementations secure enough?
I'd like to know if this communication technique is secure enough against attacks, both on the connection itself and the password-storing procedures.
Both the client and the server have access to 2 ...
0
votes
2
answers
634
views
How does my HTTPS POST get blocked based on XML content?
There's a web application on a server which I have full access to which accepts POST requests on a REST endpoint. The request payload is expected to be an XML document. For request routing and load ...
3
votes
1
answer
337
views
Same network steal data?
Say my home network has a wifi-password and my friends are connected to it (since I gave them my wifi-password).
Is it possible for me to read their data transfer?
If yes, then it would also be ...
4
votes
1
answer
788
views
Why does VPN forbid unrelated user logins on client machine?
Not looking for any solutions here, just explanation. I work remotely for a university in another state; they supply a proprietary VPN to connect to their network. I work on a Ubuntu machine and for ...
4
votes
1
answer
1k
views
What is the need for firewall to be in "stealth mode"?
There is a firewall deployment case called "transparent mode", when the firewall does its job without routing and having IPv4 addresses, i.e. it is invisible.
"Stealth mode" is ...
0
votes
0
answers
96
views
Blacklist of hostname/IP so user cannot access my server private network?
My Web API acts as a proxy for users to connect to another server: User ➡️ My Server ➡️ Any Internet Server. They do that by specify a hostname ftp.example.com or 111.111.111.111. I do not want them ...
0
votes
0
answers
289
views
How to isolate Windows10 Virtual machine from w10 host (virtualbox) for malware analysis [duplicate]
My goal is to find malware that performs network activities and captures the traffic with Wireshark. I have a Windows 10 laptop host machine and VirtualBox which has virtual Windows 10 machine.
I am ...
0
votes
1
answer
649
views
LAN Only Webserver
I am on a 192.x.x.x network and have a local server that hosts some webapps for the local users of the network. The server is running:
Ubuntu
VPN
Nginx Reverse Proxy with the site.conf including: ...
0
votes
1
answer
657
views
What happens after SSL/TLS certificate expires? [closed]
This is what I understand about SSL/TLS protocol:
Web server sends public key with cert.
Client checks cert validity locally using trusted CA list.
Client encrypts symmetric key using server's public ...
2
votes
1
answer
294
views
Blocking outbound connections to mitigate CVE-2021-44228 log4j?
As I understand it, a successful exploit requires a connection to an external server to download a payload. If a device can't be patched or otherwise mitigated, does restricting its outbound access ...
1
vote
1
answer
202
views
Securing home network when not controlling the router
I have just moved to a new place and the router is controlled by the managing company, what can I do to improve my security and my anonymity under this constraint?
-1
votes
1
answer
197
views
Is it safe to conduct DDoS attack on a live server?
I am new to cybersecurity industry. I want to try if the company server is vulnerable to DDoS attack. Is it possible to conduct DDoS attack without damaging the live server?
What I mean is, my main ...
4
votes
3
answers
845
views
Are TLS v1.3 connections over open Wi-Fi secure?
If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic.
But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
0
votes
3
answers
763
views
Why would a legitimate application run on a non-standard port?
Among the many "threats", I see on my SIEM, a non-standard port is a top one. It's always been a false positive, but I don't understand why this happens frequently?
1
vote
1
answer
340
views
setting up a lab in virtualbox for different tasks: local net testing & vulnerable virtual network
I have seen several tutorials about setting up Virtualbox networks for Kali & vulnerable machines together using the option Internal network, but I have several questions regarding other ...
0
votes
2
answers
148
views
Should login requests be padded to avoid revealing password length?
If an attacker who can watch network traffic knows a victim's username and can figure out which request is a login, then the size of the login request will reveal something about the password length.
...
0
votes
0
answers
147
views
Spoofing a server to intercept my IoT device's data
I'm trying to reverse engineer a power meter I've installed to integrate with HomeAssistant. It sends its data to a remote server, where I can log into a UI to view its data. Additionally, they have a ...
0
votes
2
answers
122
views
Does a switch protect network [closed]
I got a mesh router downstairs. Aoes a switch protect your network if connected to the mesh router?
3
votes
3
answers
317
views
What is the value of port knocking when I have strict firewall rules
I have specifically allowed three external machines to SSH into my server. All other traffic will be dropped. Using nmap from another machine, I am unable to see my server's SSH port and it shows ...
0
votes
0
answers
125
views
Can my college read SSL traffic if I don't validate CA certificate? [duplicate]
My college uses eduroam for WiFi. When setting it up, I am advised to install the college's own CA certificate. I am dubious about this as I have heard that it would allow them to perform a MITM ...
1
vote
0
answers
127
views
Is it possible to analyse network traffic to find out if spyware is uploading images, location or messages?
I was thinking about spyware and wondered if you could sniff for suspcious network traffic from spyware.
Mobile spyware usually uploads messages, location and images, is it possible to analyse network ...
0
votes
1
answer
175
views
Unknown WiFi Network
For background, I am being sued by unethical people who would do anything. I live in a rural area and in the network list on my phone and laptop, no neighboring networks appear. Only our own plus our ...
2
votes
1
answer
286
views
How to handle a router from an apparently security-indifferent ISP with no possibility to switch?
My ISP's security strikes me as... somewhat alarming to my admittedly non-expert eyes. They store wifi passwords in plaintext on their website and allow changing it there - this is apparently meant to ...
0
votes
1
answer
250
views
Can attacker who is previous visitor to my home network put factory reset resistant spyware on my pc and phone from the WAN side?
I am amateur/barely novice to home networking trying to narrow down, if at all possible, angles of intrusion.
Attacker connects to home network after I willingly give password. Before they connect I:
...
15
votes
3
answers
4k
views
Can an HTTPS request be sent twice?
When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data.
I am wondering what would happen if this packet is copied and then re-sent.
Is there a protocol at some layer ...
0
votes
0
answers
119
views
How to understand risk of a hosting ISP private network?
I am trying to understand the security concerns related to using the private network provided by my hosting ISPs.
The ISPs offer a private network feature that only my VPS instances are connected to. ...
-1
votes
2
answers
201
views
Can a device that connected to malicious network once be compromised even after disconnection from malicious WiFi?
I need to take my personal laptop to the workplace so I will be using their internet that only employees usually use. However, if the network I connected to was malicious, is my data only compromised ...
1
vote
2
answers
212
views
Will a compromised cable modem inherently compromise any router connected to it under any router config?
I’m planning on setting up a network with a custom-built router with pfsense. If I assume the cable modem connected to the router is compromised can a properly configured router ensure security or do ...
0
votes
1
answer
282
views
Ethernet wiretapping attack
I have some questions about the Ethernet wiretapping attack. I have already created a small lab using a cat5e (downgraded to 100mbit), a cat7 and this as a keystone: link. The lab looks like this:
...
22
votes
6
answers
5k
views
Do machines without any listening services need a firewall to block incoming connections?
Let's assume we have an example machine connected to the internet. This machine is typically a client one, and it has no services like ssh running on. Does this kind of machines need any firewall to ...
1
vote
1
answer
158
views
Could a bad actor get hold of your credential sent via https if you are connect to their fake network?
Imagine this typical Fake WiFi scenario:
A bad actor creates a fake coffee shop Wifi and therefore is in full control of the network. An unsuspecting victim would connect to the Wifi and log in to ...
1
vote
0
answers
380
views
My housemate is spying on my web traffic with their own "faster" router [closed]
I live in a student house with 2 guys and a girl and I'm not very tech-savvy. When we moved in we got Virgin Media broadband. I have set this up before and the admin panel is very basic with no ...
1
vote
1
answer
1k
views
How can someone on the same GPON splitter network sniff my internet traffic?
I currently have a fiber optic internet connection at home. My ISP uses GPON where the ONU acts as a gateway device which has a direct fiber optic connection to it. ONU is a Huawei HG8145V5.
I ...
0
votes
1
answer
3k
views
Using Github's Public IP Address as Remote URL
My company distributes software that runs on locally installed Ubuntu Virtual Machines. To update the software, we pull our latest code down from Github.
Some IT departments have github blocked on ...
1
vote
0
answers
431
views
Is it safe to use conntrack on Linux bridge devices?
I have a server with a number of Linux bridge devices for use with groups of virtual machines - some internet-routed, some intentionally unrouted. I have stateful firewalling in place for traffic ...
0
votes
1
answer
242
views
If I dedicate one computer to answering emails, and turn network discovery off, will that help protect the rest of my network from malware?
My boss is very concerned about malware. He has heard that malware usually comes in via email attachments, and so he wants me to set up a computer specifically for that task and isolate it somehow.
Is ...
0
votes
3
answers
300
views
Can a powerline network adapter be more easily used to listen to traffic on another router?
A roommate of mine asked me to connect a powerline adapter to the network. The ethernet cable of the adapter is connected to an Apple Airport Express router which is connected to a Frontier Internet ...
0
votes
1
answer
146
views
Possible to limit an SSL certificate holder to issuing redirects?
Is it possible to issue an SSL certificate that limits the certificate holder to issuing https redirects? Or more generally, limiting the holder to issuing specified data through the secure pipe, ...
1
vote
1
answer
2k
views
Could someone the real IP address when using tunnel protocols like ngrok, localtunnel or serveo?
Could someone get the real IP address that is hidden behind the URL generated by tools like ngrok, localtunnel or serveo?
0
votes
1
answer
182
views
File transfer service through server that is not P2P, encrypt files without letting the server know its contents
A file transfer tool, that works through a middle man server, as the following diagram:
Client A uploads a file to the server, Client B has websocket events that a file is transferring and starts ...
0
votes
1
answer
425
views
Misuse vs anomaly detection alerts
Adam always reads his e-mails on Sundays around 5 pm. This Saturday,
at 11 am, he accessed his inbox. Which will generate a false positive?
Source slide 10/41
Misuse-based IDS or anomaly-based IDS? ...
0
votes
2
answers
2k
views
Will my administrator see what I did when I deleted my history after my computer became blocked?
I was on my work computer and clicked on one website, then it shows it's blocked. I've deleted history; will my employer/network admin see what I did?
0
votes
1
answer
149
views
How to encrypt http traffic in an offline enterprise network?
I am building a golang offline application for a company that will operate in their office internal Wireless / Wired Network.
There will be one server computer and many client computers communicating ...
0
votes
2
answers
179
views
Importance of OS security patches for devices only used in home network
(This question bugs me because I am not willing to upgrade for Windows 10)
If we are talking about a device (i.e. a PC) in the following scenario:
The device is located behind a router that is up-to-...
1
vote
0
answers
182
views
What prevents attackers from posing as legitimate smb server?
Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens:
The computer is booted up in another network
...
1
vote
1
answer
554
views
Getting reverse shell from firewalled target
Suppose this scenario:
You are already inside a corporate network. Suppose to find out a RCE in a X service. The machine that hosts that service is behind a network-based firewall, ingress rules and ...
1
vote
2
answers
364
views
Is there way to know what headers can be accepted by HTTP server?
Imagine that there is server required authentication for getting an access to some endpoint.
And developer added some logic to bypass the authentication: if server recieve HTTP header give_me_access=...
0
votes
1
answer
167
views
What threats are mitigated by encrypted VPC connections?
We are running a virtual private cloud, in other words a vendor-hosted intranet. (In this case the vendor is AWS, but it could be Azure, Digital Ocean...) The intranet does not have public-facing ...