Oct
9
awarded  Popular Question
Oct
9
awarded  Nice Question
Jul
9
awarded  Notable Question
Jul
6
revised Unable to inject cookies
deleted 106 characters in body
May
30
revised The difference between Subject Key Identifier and sha1Fingerprint in X509 Certificates
deleted 45 characters in body
Apr
30
accepted Client HTTPS request redirection attack
Apr
30
comment Client HTTPS request redirection attack
Is ARP spoofing capable of achieving option (2) in your answer? Can you please clarify? Sorry for the long comments.
Apr
30
comment Client HTTPS request redirection attack
This is what I need exactly. I understand that b.com will presents its certificate and it may notice that the connection is not meant for him. But technically: How the MitM can redirect the traffic in option no. (2) in your answer? That's what I want.
Apr
29
comment Client HTTPS request redirection attack
Does MITM redirect and DNS record (1 amd 2) in your answer work even if the client's request is over HTTPS?
Apr
29
comment Client HTTPS request redirection attack
Thanks. In my case the user is assumed to request the a.com using https. But the attacker can direct him to http or https b.com. The attacker does not need to be able to decrypt. The only goal is redirect the client from a.com to http://b.com or https://b.com. You can ignore the certificate validation and assume the client will accept b.com certificate. My Question: does the DNS spoofing work if the client's request is HTTPS??
Apr
29
comment Client HTTPS request redirection attack
HTTPS is only in the server. The client request does not use a certificate. Doesn't this mean that the MitM can alter the client's request from a.com to b.com? It only remain for the faked server to prove that it is b.com. But let's assume this is doable. Can a MitM alter the clinet's headers to request b.com instead of a.com?
Apr
29
asked Client HTTPS request redirection attack
Apr
29
comment Unable to inject cookies
Please have a look at the request send to the server where the specific cookie you've added should be send. Can you please clarify how can I identify this request in particular? I am in tab "Console" and there many lines when click "refresh" after I added the script to set the cookies.
Apr
29
comment Unable to inject cookies
The first line says: Request to access cookie or storage on “http://cdn.gigya.com/JS/socialize.js?apikey=3_xxx” was blocked because it came from a tracker and content blocking is enabled.. Is there any workaround?
Apr
29
asked Unable to inject cookies
Apr
29
comment How can I inject cookie from Wireshark into a browser sesson
Thanks. What is name I should I enter? given the line I provided in the question, what is the cookie name I should enter? How many cookies entries I should enter?
Apr
29
comment How can I inject cookie from Wireshark into a browser sesson
Can you clarify what's wrong? how to overcome the problem?
Apr
29
comment How can I inject cookie from Wireshark into a browser sesson
The console shows this message after I type my line and hit enter: request to access cookie or storage on “https://xx.xx.xx.com/gscounters.sendReport?reports=xxx” was blocked because it came from a tracker and content blocking is enabled.
Apr
29
comment How can I inject cookie from Wireshark into a browser sesson
My cookie looks different. Can you say how to set three cookies? I wrote this syntax in the browser console: document.cookie ="FN_cookie_accept-20180525=true; PHPSESSID=xx; glt_3_xxx=yy" But I did not log in?
Apr
29
revised How can I inject cookie from Wireshark into a browser sesson
added 9 characters in body