New answers tagged

22

Vidarlo's answer is mostly right, but, incidentally, there was one fatal flaw in the protocol: the protocol was intentionally designed to allow replays to some degree. In particular, it was designed to allow retransmissions of message 3 in the handshake to succeed. But who's to say that it's the original client retransmitting the frame instead of an attacker?...


60

Because the protocol is built to protect against that. whereas when you wanna login to your wifi you would type in your password and the password would be encrypted then sent to the router which would decrypt it using a key This is not how it works, on many levels. The password is never sent over the air, and it's a more complicated protocol, with multiple ...


1

I will answer the following question: "You got ACCESS to AD Joined Domain Machine but the user you compromised is Local Administrator NOT Domain User/Administrator?" Before starting, I think that this is a very interesting question and not wide at all. Here is the deal, you started as a LA which basically means that you can perform almost anything ...


1

Great way is to use Burp Suite and Param Miner extension https://portswigger.net/bappstore/17d2949a985c4b7ca092728dba871943 It doesn't need Professional version of Burp Suite. The extension can guess GET/POST/JSON/XML parameters, headers, cookies, and it's very fast. It supports custom wordlists and much more.


0

The fact that you can run a schema query is a first red flag, especially if this is a production environment endpoint. Being able to run schema queries gives an attacker everything they need to explore the API, and if there are any API methods/queries/mutations that can be misused then the schema query will make it easier for them to find any potential ...


Top 50 recent answers are included