Questions tagged [tcp]

Transmission Control Protocol (TCP) is a transport layer protocol that provides a connection-oriented data stream service with guaranteed, in-order delivery.

Filter by
Sorted by
Tagged with
0
votes
1answer
29 views

Server sending data after sending RST, ACK? [closed]

In a packet capture I observed server is still sending data even after sending RST, ACK, How is that possible?
0
votes
1answer
91 views

Why is SNMP vulnerable to IP Spoofing?

I read on Wikipedia's Article on SNMP SNMPv1 and v2 are vulnerable to IP spoofing attacks, whether it runs over TCP or UDP, and is a subject to bypassing device access lists that might have ...
0
votes
2answers
84 views

Why do firewalls focus on tcp and udp?

From what I can see, most firewalls seem to focus on tcp and udp. Why is that? Is it impossible or at least very unlikely for malware to use other protocols/custom protocols?
0
votes
1answer
75 views

Is it possible to intercept and modify a wireless TCP transmission?

Given three parties (all in the same LAN): A client, a server, and a MITM. The client and server communicate wirelessly, and don't encrypt their messages. The MITM can see the messages, but question ...
2
votes
0answers
193 views

TCP reset attack / forged TCP reset prevention

How do you prevent someone from doing an TCP reset attack between client and host without having acess to host? I am trying to solve a CTF for fun and learning purposes. In one of the challenges I ...
2
votes
1answer
90 views

What are the security concerns about using unencrypted TCP keepalive with TLS?

In my software both the server and the client sends unencrypted TCP keepalive messages to be able to detect the broken pipe within a reasonable time. It also uses TLS 1.3 encryption with OpenSSL 1.1.1....
0
votes
0answers
42 views

How does the Great Firewall of China handle TLS encryption? [duplicate]

My understanding is that when a client and server are connected through TLS, only they have the key needed to encrypt and decrypt messages. My question is, given that the Great Firewall of China does ...
1
vote
0answers
14 views

Capture Packets of other devices in network [duplicate]

I'm challenged to capture packets sent from a client to the gateway in a network. is it even possible to see the packets between client and gateway for me?
-3
votes
1answer
91 views

Is there any service/application which would detect the encryption type? [duplicate]

I am debugging a TCP connection, which returned multiple values such as: +†Ä˜Õõıû and 'G1÷ù]TB*ø5£"ñB—£s∏f '1÷ù] What I am trying to find out, is how is this encrypted, and find a way to ...
2
votes
0answers
56 views

Reverse TCP - Bind to a specific port

So, I'm trying to solve a CTF challenge that involves exploiting a remote service. The service doesn't check for the size of the input and there is a buffer overflow vulnerability. However, before I ...
1
vote
0answers
106 views

Http Content-Length too long - Time Out

I was recently going through the HTTP Desync attack presented here: https://portswigger.net/research/http-desync-attacks-request-smuggling-reborn This raised one question concerning the way the HTTP ...
1
vote
1answer
64 views

Logging new network connections without TCP Wrappers

My current job involves auditing systems for compliance with various policies. One of these policies is that all network connections must be logged, so that the origin of the connection (IP address ...
0
votes
0answers
54 views

Setting the CWR TCP Flag in a Hping Command

I am trying to set the CWR flag when doing a hping command to another machine. I can set all the other flags, (Eg -S, -F etc) but I can't find any example of the CWR flag. I've checked Man Pages and ...
0
votes
2answers
70 views

firewall behaviour

If a client connects to a server he will start listening for the response on some random high port number. The client then expects any packet destined for that port to be a valid answer. Or does he ...
0
votes
0answers
215 views

Whether the `resets received for embryonic SYN_RECV sockets` and `invalid SYN cookies received` shows attacks there?

In my CentOS, I use netstat -s to check my CDN node server network summary. [root@hkk10 ~]# netstat -s Ip: 26529370 total packets received 6121 with invalid addresses 0 forwarded 0 ...
0
votes
0answers
350 views

Intercept TCP traffic using Python

Situation: I am trying to intercept TCP (not HTTP) traffic on a Windows machine using Python. I am posting this question as most answers I was able to find teaches how to sniff traffic. Normal ...
3
votes
2answers
301 views

Can I blindly trust 127.0.0.1?

On my system (Ubuntu Server 18.04, if that matters) I have two servers. They are behind a Nginx reverse proxy (i.e. accessing service.mywebsite.com internaly proxies the request to 127.0.0.1:...
-1
votes
1answer
178 views

Tor relay on port 9001 TCP

I executed netstat -t on my linux terminal and noticied a tor relay running on port 9001. I've search about the IP address of relay on shodan and got a result that address is from Russia, after that i ...
7
votes
1answer
1k views

TCP Sack panic proof of concept?

For the vulnerability called TCP SACK panic([1], [2], [3], and many more): is there a proof of concept code out there that can be used to test vulnerability status and effectiveness of remedies? [1] ...
0
votes
1answer
41 views

Connection changes after waking from sleep

On Debian, Linux, I am using netstat to monitor connections. After waking my system from sleep, I noticed a change in one of the connections, using port 6667 for irssi (identified by PID). I like to ...
33
votes
1answer
8k views

I have found ports on my Samsung smart tv running a display service. What can I do with it? [closed]

I have a Samsung Smart TV running Tizen OS, and out of curiosity I scanned it with Nmap. I found multiple open ports. One of those ports is running a "display" service. Does this mean it can cast its ...
2
votes
0answers
127 views

Sniffing TCP packets using Wireshark

I am trying to reverse engineer a decoder. To do so I need to sniff the packets that the decoder receives from an Android application installed on my phone, this application is what controls the ...
0
votes
1answer
43 views

TCP Hijacking and conflicting data handling on the OS level

Assuming I perform a TCP hijacking attack, by having access to the wire on which packets are being transmitted. In practice, the party to which I'm sending the hijack packet is going to receive the ...
1
vote
1answer
96 views

Question about hping3, TCP and ngrok

I have set up a experimental setup which consists of: Windows PC with ethernet cable; Arduino shield (connected to Windows machine with USB) with LTE connectivity sending data using TCP/IP to ngrok; ...
2
votes
1answer
2k views

What are the risks of exposing the Docker for Windows daemon on localhost?

A developer running Docker for Windows needs to enable the option "Expose daemon on tcp://localhost:2375 without TLS" in Docker setting > General tab. There is a warning: Exposing daemon on TCP ...
-2
votes
2answers
236 views

Honeypot detection: How is TCP/IP implemented on honeypots?

I'm currently studying how to do honeypot detection and was wondering if a possible lead is to analyse how honeypots implement their TCP/IP protocol. I've been looking through the source code for a ...
0
votes
2answers
323 views

Websocket connection spoofing

I have a websocket server, where client credentials get validated upon connecting and are never bothered again, since connections are stored in memory. I was wondering, a TCP connection is basically ...
1
vote
1answer
151 views

Determine victim of port scan's OS

I am taking part in a practice sandbox, and have a pcap file in Wireshark: with the traffic depicting a Vertical Port Scan. Is there anyway to find out the "victim"'s Operating System? The packets are ...
1
vote
2answers
350 views

What ports are okay to be open on a macbook pro?

When I do a network scan for open ports on my MacBook Pro, I can see the following open TCP ports below. Are these 'standard' open port for a personal computer of this type? Should I be concerned? ...
0
votes
1answer
330 views

XMAS Scan vs Inverse TCP

Whats the difference between a XMAS Tree scan and an Inverse TCP scan using the FIN, URG, and PSH flags? Are they the same thing? XMAS Tree scans are designed to manipulate the PSH, URG and FIN flags ...
1
vote
1answer
28 views

Why do processes on servers have socket types associated to the port number? [closed]

Why do some servers have TCP/UDP alongside the port they're listening to. To my understanding TCP and UDP are socket layers, they're methods of determining how the traffic is being sent over the ...
3
votes
2answers
932 views

Nmap not following redirect when using “http-title” script

I am trying to scan a bunch of IPs for their http-title. Now the problem I have is that nmap pretty much never follows any redirects. Usually the title I want is behind that redirect though. For ...
0
votes
1answer
125 views

IOT secure data transfer

I have a question about a monitoring software architecture. Think about 50 different locations in different cities. Assume that these locations are small plants. In every location there are ...
1
vote
1answer
869 views

How to pass a localhost check for an incoming request?

I'm trying to send a request to an http server hosted on a machine. The http server is in C# and drops any packets that are not from localhost: public void Request(HttpListenerContext context) { ...
-4
votes
1answer
135 views

TCP protocol Denial-of-service attack [closed]

There are different types of DDoS attacks. As defined by TechTarget, Network-centric or volumetric attacks overload a targeted resource by consuming available bandwidth with packet floods. Protocol ...
0
votes
1answer
129 views

MQTT without TLS - prevent publish messages from unauthenticated devices

I have an use case where I'm not able to use MQTTS/TLS due to constraint on devices. Our plan is to perform authentication during MQTT CONNECT, passing a JWT token as a password. If I understand ...
0
votes
1answer
192 views

SegmentSmack exploit

I am studying about SegmentSmack vulnerability. As far as I understood, the vulnerability is due to the fact the reordering the packets in the out-of-order buffer is a very CPU intensive operation. So ...
3
votes
1answer
816 views

Injecting a TCP packet into existing connection

let's see a scheme: and I would like to consider two cases: All IP addresses are public, a cloud is symbol for the Inernet. The first one The H has an established TCP connection: C = (210.10.10....
0
votes
1answer
608 views

How can Insertion attack ever work and fool an IDS on a TCP connection?

An IDS can accept a packet that an end-system rejects. An IDS that does this makes the mistake of believing that the end-system has accepted and processed the packet when it actually hasn't. An ...
4
votes
1answer
232 views

Weird attack making my server CPU super high

I noticed that my server CPU is super high and the reason is grep "A" command After a deep look, that what I've found in my active internet connections list (netstat -tupn) tcp 0 0 ...
1
vote
1answer
593 views

Could an attacker spoof a whitelisted IP to access the network?

There is a network that is protected with a firewall and only one IP is whitelisted. Assuming the attacker knows the whitelisted IP, what would prevent an attacker from sending traffic via a spoofed ...
2
votes
2answers
14k views

Can a hacker hack into port 80?

We normally say port 80 is firewall friendly. But can a hacker just hack into port 80 via TCP or UDP? Or is Port 80 by default not always open? It waits for the host to initiate a connection via ...
0
votes
1answer
120 views

What cipher mode is usually used for network traffic encryption?

I'm currently teaching myself about cryptography with the intentions of learning more about cryptanalysis. As of now I'm learning about cipher modes! I understand that I should be looking into CBC, ...
0
votes
1answer
2k views

Vulnerabilities of DNS when utilized on a TCP port

There was some specific cyber security challenge (Cyber Cube 2018, GE). In one of the tasks, objective was to gain the access to some specific file that server included. After successfully solving ...
-2
votes
3answers
4k views

Hping3 doesn't work?

I was trying to perform a SYN flood attack, and I was using hping3. This is how the command looks like : sudo hping3 -S -a 192.168.100.88 --flood -p 80 192.168.100.15 Where 192.168.100.88 is a non-...
-2
votes
2answers
390 views

SYN-flood to the localhost Apache server

I've set up the apache server on localhost (127.0.0.1). I've downloaded PackETH to perform a DoS attack. So PackETH wants MAC-HEADER of the destination and source. And I don't know, where to find ...
3
votes
1answer
122 views

TCP timestamps: available to whom?

I was told that an adversary can figure out system uptime by looking at TCP timestamps. But I'm not sure who exactly can see this information. For example, if I set up a hardware Tor gateway so that ...
-1
votes
2answers
413 views

What do DoS/ DDoS TCP SYN Floods and Layer 7/HTTP floods look like on a firewall log?

I am looking for some examples of log files for DoS or DDoS attacks that show a SYN Flood or a HTTP/Layer 7 Flood. I have had a google, but can't seem to find anything. Would the incoming packet ...
2
votes
3answers
730 views

Router Security Log Shows Many Blocked TCP Connections

When checking my router tonight I looked at its security log. I saw thousands of blocked tcp traffic. Why are these considered security events? The log shows many blocked tcp incoming request from ...
1
vote
0answers
71 views

What additional protection required for authentication and messages sending in addition to TLS? [closed]

I use TLS for securing my client-server TCP communications. I have a Qt server and Android and iOS clients. For TLS connection I use only server side certificates, so only clients sure that they are ...

1 2 3 4 5