5

Suppose the client software is trustworthy (after all, if it isn't, how do you know it doesn't send a copy of all your messages somewhere). Everyone installs the client, it generates a new key pair each time, sends the public key to a directory service with the user's identifier (phone number, FB uid, whatever). You want to send an encrypted message to me. ...


3

It sounds like the site you were testing doesn't use HTTP Strict Transport Security (HSTS), or at least doesn't pre-load it. However, it's entirely plausible that the CAPTCHA service is hosted on a site that does use HSTS (for example, Google does for most of its sensitive sites); if your SSL-stripping proxy blocked all HTTPS traffic, then that would simply ...


3

Depends on what you consider a vulnerability. If the images you load via HTTP are confidential, then sending them via plain HTTP violates their confidentiality. If the images you load via HTTP must preserve their integrity, then sending them via plain HTTP allows an attacker to modify them. This of course all depends on your use-case. There are some ...


2

How is it possible to change all the certificates? MITM (Man-in-the-middle). Your company is using some kind of proxy device that is intercepting all your requests and generates a certificate on the fly for the address you try to connect. The proxy basically acts like a CA, signing all the "fake" certificates performing MITM. Some vendors tend to call it ...


2

How is it possible to change all the certificates? The company is performing SSL inspection on the HTTPS traffic with a transparent proxy. This requires terminating the connection e.g. at the firewall and creating a new TLS connection for the client. This requires creating new (fake) certificates and signing it with an own CA. Why does my browser not ...


2

Another possible scenario is that a MITM replaces an image with one that exploits an RCE (remote code execution) vulnerability in the user's browser. Here's an example of such vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2017-2416 --basically you can serve a crafted image containing executable code and have that code executed on older versions of ...


2

A possible scenario is that a MITM replaces an image with one that exploits an RCE (remote code execution) vulnerability in the user's browser. Here's an example of such vulnerability: https://nvd.nist.gov/vuln/detail/CVE-2017-2416 --basically you can serve a crafted image containing executable code and have that code executed on older versions of macOS and ...


1

If Wireshark reports that the device is making DNS requests, set up a MitM DNS server (or just modify the WiFi settings on the device to point to a custom DNS server) that points the target domain(s) to your Burp host. Alternatively, if you can, edit the HOSTS file on the device to bypass DNS and treat your IP as the target domain. If the requests are being ...


Only top voted, non community-wiki answers of a minimum length are eligible