Questions tagged [spoofing]
A kind of attack in which one system, program, or user successfully masquerades as another.
290
questions
1
vote
1
answer
75
views
Windows 10 Update - Man In The Middle Attack - Tamper Update [duplicate]
I am connecting to a wi-fi network and blocked all IP addresses in this network with a regular Windows 10 firewall. The only available IP addresses are:
192.168.1.1 = gateway
192.168.1.102 = my own ...
0
votes
0
answers
96
views
What bluetooth dongle works with spooftooph?
I have been looking to do bluetooth hacking but my internal bluetooth adapters are not working on either of my laptops with spooftooph. I was seeing if I could get a used MultiBlue dongle but no one ...
- 1
1
vote
2
answers
82
views
How to block personal devices on corporate network
Currently we are working to secure our internal LAN and due to this we are planning to stop mobile devices (such as personal laptops and mobile phones) to connect on corporate network. Our key area of ...
- 11
8
votes
3
answers
4k
views
Can an SSH server in password mode be impersonated if I ignore the fingerprint warning?
Assume that I never check the server fingerprint when logging in to an SSH server. This means that certain configurations of SSH can be impersonated. For example, I can log into a server that only has ...
- 389
0
votes
0
answers
46
views
Retrieving Android phone's identifiers
I will be publishing a fingerprinting app that shows its user how much access to their Android phone's identifiers it has. I haven't started writing it because I need to understand how can any Android ...
- 23
0
votes
1
answer
51
views
Using another's text number to commit ongoing fraud [duplicate]
Some Vietnamese refugee families have been Bitcoin defrauded by someone using an 805 text number. Lookups say it belongs to a party in Tennessee. I want to know if it is possible that scammers in ...
0
votes
1
answer
61
views
what if I just simply rename of a file instead of using right to left override
I'm browsing the ATT&CK and I understand the meaning of right-to-left override that it is using non-printing unicode character, but what is the different if I just simply rename a file like this: ...
- 1
0
votes
0
answers
300
views
Spoofed iMessage? Apple account breach? What are the possible ways this happened?
See the screenshot below. A friend asked me about this. Person #1 had a group text thread with Person #2 and Person #3. At the top, Person #2 sent a photo and a message. Person #3 replied. Then there ...
- 119
1
vote
1
answer
301
views
Spoofing TCP/IP headers and uniqueness of the host name
I have some related questions:
Is it possible to spoof the source address in the TCP/IP header when using HTTPS?
If possible, is there any way to detect source address change? I think the checksum is ...
- 307
1
vote
1
answer
80
views
Authorizing 3rd Party Envelope Sender to Impersonate Header Sender
Rewriting for clarity:
This is regarding emails send from a 3rd party marketer spoofing one of our email addresses in the message header from field. In these emails the envelope sender would come ...
- 11
0
votes
1
answer
126
views
Is it possible to spoof a service running on a port in Ubuntu?
I was looking into the idea of port spoofing, and I came across this
GitHub repository. I'm mainly looking to disguise my computer as something else, whereas this program opens every TCP port and ...
- 61
1
vote
0
answers
52
views
How would a cellular phone call be connected if there are two phones with the same number? [closed]
In the 2004 movie "Primer", the a character goes back in time, and there are two copies of him, both with a cell phone. The character receives a phone call initially, and then receives the ...
- 119
0
votes
0
answers
193
views
Loopback source IP Spoofing
Assuming I have a service running with elevated privileges on a host, and another service is listening on a UDP port with access for everyone (0.0.0.0) is it possible to craft a spoofed UDP datagram ...
- 101
0
votes
0
answers
43
views
How do tracking services stop third party requests?
Facebook Pixel and Google Analytics for example give you an API key to identify tracking requests from your website. But what is to stop someone from grabbing the key, spoofing your domain and ...
- 1
0
votes
1
answer
131
views
Why do DDoS attacks spoof DNS source IPs?
Recently, a lot of my friends have been talking about botnets. They said they've created their own. Obviously, I know this is all illegal so I try not to take part in any of it.
But I've been ...
0
votes
2
answers
195
views
Malicious SMS and iMessage Interception
I have an interesting situation on my hands. There are people in my neighborhood that have been harassing me for some time now. It appears that these individuals can are receiving my text (sms) ...
0
votes
2
answers
68
views
Business Email Compromise emails sent to personal email accounts
I am using Google workspace to handle my domain emails. At a certain point, employees started to receive spoofing emails to their @mydomain.com addresses. I blocked these emails and it worked.
However,...
- 101
0
votes
1
answer
174
views
Can this logic with regard to checking Reverse DNS records be flawed?
For my web app, I hardcode a reverse DNS detection for common web crawlers. And for detecting them I use their Reverse DNS, which I always check whether it includes i.e. google.com. My questions would ...
- 234
0
votes
1
answer
82
views
"Mutuality" of public key authentication
I'm a newbie when it comes to cryptographic security, but there's something I'm not quite getting concerning the "mutual" aspect of public key authentication.
Say you have a client X, and ...
- 115
1
vote
1
answer
102
views
SPF records and spoofing
Lets say we have this SPF record
v=spf1 include:spf.protection.outlook.com include:spf.onprem.com -all`
And this record
v=spf1 include:spf.protection.outlook.com include:spf.onprem.com ?all
What ...
- 11
0
votes
0
answers
102
views
How can you spoof you caller id but not using a voip (your carrier instead)?
My research:
I found this security stackexchange post but it didn't answer my question.
I know that you can do similar things using astresik with voip provider.
I came up on o blog that explain that ...
0
votes
1
answer
111
views
When GPS is spoofed in a smartphone, does this affect whatever is being monitored?
When GPS is spoofed in a smartphone, does this affect whatever is being monitored? Suppose I spoof the GPS on my smartphone, such as lazy Pokemon GO players do to play from their couch. Will this ...
- 101
0
votes
1
answer
329
views
Securing a Websocket Connection in case of XSS Vulnerability
Goal
Authenticate the Client via HTTP Request.
Authenticate the Client's WebSocket connection.
Prevent exploitation of WebSocket connection(when a XSS Vulnerability is present on website).
How I'm ...
- 3
1
vote
2
answers
320
views
Do fowarded emails retain DMARC protection?
Assume I ask someone to create a filter in their Gmail account that automatically forwards certain emails to my inbox. If the original email was protected with DMARC, would the forwarded email also be ...
- 141
4
votes
2
answers
238
views
Fake AP for Staff Security Awareness
We are working on an activity to train staff about security. Is there any way to spoof the company's guest router and ask staff to provide login credentials (as public wifi does) and when they do that,...
user261327
0
votes
1
answer
116
views
Cell Phone texting [closed]
Is it possible for someone to redirect text messages to you from another’s phone? Something weird is going on…over the last few weeks I have received “wrong number”text messages from people with ...
0
votes
1
answer
148
views
DNS local cache spoofing with malware or RAT
I was learning networking and knew that browsers don't have algorithms to convert domain names to IPs. It queries a DNS server.
After that, the computer remembers the IP, so next time the domain is ...
- 119
5
votes
0
answers
529
views
How did ntpd get patched to prevent NTP time synchronization attacks?
I recently tested the NTP Time Synchronization Attack as described and demonstrated by Jose Selvi in 2015.
Basically, the attack was mostly used to send the victim's clock in the future, so the ...
- 751
0
votes
0
answers
817
views
How does the NSA "masquerade as any routable IPv4 or IPv6 host"?
I was reading the Wikipedia article about TAO and there is written that:
Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host. This enables ...
- 515
0
votes
1
answer
454
views
Spoof IP address after a TCP handshake established
Is it possible to spoof the IP once a TCP handshake was performed successfully?
For example:
Perform the handshake
Use the session with the same IP which performed handshake but on
different machine ...
1
vote
0
answers
327
views
SPF fail, DKIM pass, where did the emails originate from [closed]
I have been a victim of a fraud where my solicitor's email address was used to dupe me out of a house purchase deposit. How do I determine where the emails originated from - did the crooks use emails ...
- 11
1
vote
0
answers
227
views
Prevent IP session hijacking
I was thinking of the following scenario :
a network is behind a router (performing NAT) and firewall
this firewall denies all unsollicited incoming packet
a user on a computer of the network opens a ...
- 343
1
vote
1
answer
2k
views
SPF/DMARC for shared email provider (gmail) - how did this email pass SPF?
We recently received an email from a self described "white hat hacker" purporting to be from our own organization.
According to the mail headers, spf, dmarc, dkim and arc all passed okay and ...
- 113
1
vote
1
answer
117
views
Spoof texting a regiatered number to yourself and relying....having a conversation [closed]
I feel like I am going crazy. A friend was at my house and received text messages from a number from a person i know. She had a conversation with this number for basically a week. She is now saying ...
- 11
0
votes
1
answer
303
views
Spoof publisher info on Windows applications
Let me start by acknowledging that I have absolutely no experience with Windows development and this is purely for academic purposes. I apologize for incorrect terminology and welcome corrections or ...
- 1
1
vote
1
answer
139
views
Would it be possible to create an external mac address spoofer?
I was wondering if it would be possible to create some sort of ethernet passthrough device, but this device also functions as a layer 2 mac address spoofer, which can be used with any device without ...
- 11
1
vote
1
answer
114
views
Why can't mail clients verify an email was sent from the user and server it claims to be from?
Background
When I explain to my clients the security issues around email spoofing, I often explain that emails are like regular mail. Anyone can write Jon Doe on the return address, but that doesn't ...
- 2,311
1
vote
1
answer
127
views
Best way to learn every way I am tracked online? [closed]
Is there a course or resource for a person with basic networking skills to see all ways a website like FB or Google can track and identify users + how to spoof them and look natural? Not for malicious ...
1
vote
0
answers
112
views
Retrieving a No Caller ID phone number? [closed]
I got a call from an unknown number, more specifically, a no caller ID number. I’m not the guy who gets a lot of calls from a no caller ID phone number, and usually, when I got one is typically the ...
2
votes
1
answer
841
views
Man in the middle using HTTPs downgrade to HTTP
In general browsers attempt to establish a HTTPs-Connection if possible. How would you force a browser to fallback to HTTP when somebody enters asdf.xyz in the search bar of his/her browser without ...
- 123
1
vote
1
answer
200
views
Is it possible for a domain to be faked?
I was talking to PayPal customer service and they were trying to tell me PayPal does not have any third parties, so when I shown them https://www.paypal.com/uk/webapps/mpp/ua/third-parties-list they ...
- 560
0
votes
1
answer
306
views
Redirection - Different Website from Different Computer
There are URLs which its only purpose is to redirect the HTTP requestor to a correct website. Say, if I tried to access example.com/0wa/RaNd0m from my computer, it would redirect me to wikipedia.com. ...
- 11
1
vote
2
answers
3k
views
How to spoof IMEI/SIM location?
Once you plug it into a phone and power it on, the IMEI number of the
phone and the SIM's serial number will be transmitted to the nearest
cell tower(s).
source
Is there a way to spoof the location ...
- 155
0
votes
2
answers
279
views
Does an attacker need to guess or brute-force a password for TCP spoofing?
From my understanding, TCP spoofing can be carried out if the attacker can correctly guess the sequence numbers from the response packets (to mimic the real client). The attacker may even obtain this ...
0
votes
1
answer
131
views
Internal HTTPS recommended security practices
So I'm by no means a security expert. I'm just a recently graduated software developer who is working on a contract project and I want to ensure I'm taking appropriate security measures for my client.
...
- 101
0
votes
2
answers
169
views
How Can I Prevent Hackers From Spoofing TCP messages onto my server?
I have a Python client and server communicating over a TCP socket - they send and receive a certain set of standardized string commands to each other.
How can I prevent a hacker from creating their ...
1
vote
2
answers
670
views
What prevents someone from spoofing their public key when trying to establish an SSH connection? [duplicate]
Recently I've been trying to learn the mechanisms behind SSH keys but I came across this question that I haven't been able to find an answer to (I haven't figured out how to word my question such that ...
- 13
0
votes
2
answers
272
views
How do I access a website on my phone without it being able to determine that it was accessed from the same phone and location?
How is it possible to create an account in a website with completely different credentials without the website being able to link the user of the first account and this new one?
Tor is not a viable ...
- 101
4
votes
2
answers
458
views
Are there security reasons for prohibiting universal mac address modification?
Background
In a standard 48-bit MAC address, the 7th (most significant) bit specifies whether it is a universally-administered address (UAA) or a locally-administered address (LAA).
If it is 0, then ...
- 411
1
vote
1
answer
147
views
DDoS using websites instead of bots?
What if a ddos attacker hits public websites (google, amazon etc) with some requests but spoofed the souce ip to the victim's ip. Now the responses will be sent to the victim's ip.
Attacker can rotate ...
