New answers tagged network
0
AppArmor profile for this case is:
profile nonetwork /path/to/exec {
# Allow all rules...
capability,
network,
mount,
remount,
umount,
pivot_root,
ptrace,
signal,
dbus,
unix,
file,
# ...but no network
deny network,
deny capability net_admin,
deny capability net_bind_service,
deny capability net_broadcast,
deny capability ...
1
As a general rule, every security application that performs monitoring or blocking will have a place for you to review any alerts. If it doesn't have that, then it's either useless or a complete fraud.
In your case, there is a detailed view.
Thie picture below was taken from McAfee Knowledge Center article TS102852. You can find the same article by ...
0
You can look at all current network connections using the windows cli/shell/cmd. This will additional show the process opening the connections.
netstat -nao
Another way would be using a gui application from the windows sysinternal suite.
This will show you all tcp connections and the opened ports of you system.
tcpview.exe and portmon.exe
You can ...
1
My question is how I can build one, what are the parts of a TIG in terms of hardware,
Welcome to the world of "market speak" where vendors try to make improvements sound like something entirely new.
Threat intelligence isn't about hardware, it's more of a service. It is about "threat intelligence" and the ability to deliver this intelligence quickly and ...
2
If you want to replay the exact request you have in the file as plain HTTP you can simply use netcat:
cat request.txt | nc host 80
If you want to replay it as HTTPS instead of HTTP you can use openssl s_client:
cat request.txt | openssl s_client -connect host:443 -servername host
1
curl is the tool for the job. You can view the documentation here as to how to pass all of the headers in the POST request that you have listed in your question. You'll want to use the -H option to pass the header parameters that you show.
If the request is initiated from Firefox or Chrome, you can follow these instructions to capture a curl command ...
1
You could use a vpn to encrypt your connection. Please make sure to keep updating the vpn version. Set up your network as being a public and not a home network to minimize the file sharing risk with other devices on the network.
5
It sounds like some (or all) of what you are seeing may be related to the fact that Comcast/XFinity uses it's customers' routers to provide public wifi access. See the following links for more information, including how to disable this on your router:
https://money.cnn.com/2014/06/16/technology/security/comcast-wifi-hotspot/
http://wifi.xfinity.com/
...
6
The higher education institution that I attend uses Eduroam
If you are using eduroam, then you are connecting to your wireless network with some form of 802.1X authentication and the wireless infrastructure must support WPA2/AES per eduroam requirements (they may additionally support WPA or TKIP).
802.1X uses a supplicant on the client device that ...
1
does he additionally check if the ip-address matches or any checksums etc?
Yes, it checks if the source address on the IP packet matches the remote site, and if source port matches too. It checks the TCP sequence number too, to see if the packet falls within the expected receiving window. If any of those checks fails, it will usually drop the packet.
...
2
The client then expects any packet destined for that port to be a valid answer.
No. The client accepts as answer only packets from the ip and port it connected to and which have the correct sequence number. This is both the behavior of a client without firewall and also the behavior of a stateful firewall.
This means an attacker who cannot sniff the ...
0
Read the doc man ...
Based on the manpage:
It has two main sniffing options:
UNIFIED, this method sniffs all the packets that pass on the cable.
You can choose to put or not the interface in promisc mode (-p
option). The packet not directed to the host running ettercap will be
forwarded automatically using layer 3 routing. So you can use a ...
1
SSL is handled inside the applications (like browsers) themselves by using libraries like SChannel, Secure Transport, OpenSSL, NSS etc. This means only encrypted traffic enters or leaves the applications. Anybody wanting to get access to the plain traffic without being an active man in the middle would need to inject itself into the process of the running ...
Top 50 recent answers are included
