3
votes
Accepted
TLS Private Key Secured with Hardware Fingerprint
There are well established solutions for the problem of protecting the private key - use a hardware security module (HSM). Here the private key never leaves the hardware because any operations are ...
- 198k
2
votes
How to decrypt Emotet's TLS traffic by MITMProxy
If it's doing certificate pinning, it has to know what fingerprint (or some other property) of the certificate or public key it should expect. This value has to be stored somewhere on the system ...
- 15.4k
2
votes
Accepted
Is there is another ways to authenticate requests to remote server other than Client Certificates?
TLS server isn't limited to requesting client-auth/client-cert in the initial handshake, and some do so only after the HTTP request e.g. based on the URL. In 1.2 and below server requests a ...
- 10.6k
2
votes
How would you enforce user to only connect on a given network?
User PC automatically connects to a given VPN. All traffic is routed through that. Thus, the "physical" networks to which the PC is connected are only used for the VPN client connection (for ...
- 18.8k
1
vote
Securely access server via FTP through SSH tunnel
If you are interested on the connection between you computer and the FTP server, then yes, it's secure. Everything is running inside the SSH tunnel, it's encrypted and any regular or skilled attacker ...
- 53.5k
1
vote
Accepted
Can a browser-based HTTPS proxy secure browsing data while using a system-level proxy?
Can a HTTPS proxy extension secure browsing data while using an unsafe vpn?
In short: yes, for some meaning of "HTTPS proxy extension" and some meaning of "secure".
It is not ...
- 198k
1
vote
Does a docker socket proxy improve security?
Like so many things in security, this depends on your threat model. where something like this could be useful is, say you give users access to portainer/traefik/whatever else has Docker socket access.
...
- 62.1k
1
vote
Accepted
Does a docker socket proxy improve security?
A docker proxy is a layer of defense, which restricts the interaction between a potentially harmful system (running inside docker) with a critical environment (the docker host). By limiting the ...
- 198k
1
vote
Accepted
How to avoid breaking end-to-end encryption while employing cloud-based DDoS protection?
For a DNS protection you dont need to share your TLS keys with the providers, basically a DNS redirection is that the DNS will point to their servers and then they forward the traffic. This solution ...
- 2,257
1
vote
Accepted
Staying anonymous while using BurpSuite
What you're referring to as Proxying through BurpSuite is how Burp allows you to sniff and manipulate traffic, or perform what is called a Man-in-the-middle (MiTM) attack
.
Burp Proxy lets you ...
- 56
1
vote
Accepted
Not able to see server response when making request using python
Based on the information you've provided, it seems that the issue is not with your code, but rather with the way Burp is configured. It appears that Burp is not intercepting the response from the ...
- 40
1
vote
Accepted
Bandwidth limitation in the censorship systems
How do they detect that this stage is the “initial stage” of the uploading, since both kinds of connections (with and without VPN) are encrypted, and they reduce the bandwidth after that only for the ...
- 198k
1
vote
Accepted
Securing home hosted servers (opening ports vs tunnelling)
Tunnel to your home network from the VPS using a VPN like Wireguard
The suggestion should be slightly different: Tunnel FROM your home network TO the VPS using a VPN. Note the difference: the tunnel ...
- 198k
1
vote
Can an NGINX reverse proxy reveal the backend if serving non-static content?
It might be that nginx reveals the upstream in some corner case, you might want to review/audit it to ensure you are using the right configuration, although I think even in case of failure it's only ...
- 18.8k
1
vote
Can an NGINX reverse proxy reveal the backend if serving non-static content?
The Wireguard IP possibly. I would have to dig a bit deeper. I would think your public facing IP would be ok, depending on which services are being run of course. I have had a similar setup in a lab ...
- 11
Only top scored, non community-wiki answers of a minimum length are eligible