adric
  • Member for 9 years, 9 months
  • Last seen more than 7 years ago
Extract cookies from pcap
6 votes

It looks like you should be able to easily pull the cookies from your pcaps with Wireshark or tshark using filters based around HTTP Cookies. You should be able to match against http.cookie as a ...

View answer
What does key signing mean?
3 votes

Key signing in public key systems is a mathematical assertion that there is a relationship between the key (a bunch of numbers in a certain sequence) and the subject (a person or principal identity). ...

View answer
Javascript Malware: How does it work, and how can it be mitigated?
3 votes

JavaScript gives web pages authors, good and bad, the ability to run any code they want when your browser visits or is steered to their page. Although the various JavaScript implementations have some ...

View answer
Confusion: Why isn't a passhrase encrypted SSH key two factor auth?
3 votes

There's some terminological confusion here I think and it's common. Most strong multi-factor systems are considered strong because they require more than one kind of proof of identity (factor) ...

View answer
When do Ps Tools send cleartext passwords, and how can I demonstrate this?
3 votes

I believe most of the answers you seek are in the analysis by Mike Pilkington presented at SANS Forensics and IR Summit – June, 2011: Blog posts: http://www.dshield.org/diary.html?storyid=11173 and ...

View answer
Any safety with private IP addresses?
Accepted answer
2 votes

No. Though reducing your direct exposure to the Internet with NAT does reduce some risks as long as you are on an Internet connected network there are many ways for attackers to reach you. Examples ...

View answer
What are the supported versions of RHEL 5 by the NSA?
2 votes

This page at RedHat's site seem to have the most current information available on public sites and suggests a RHEL6 standard may be available in November 2012: http://www.redhat.com/solutions/...

View answer
will all instrusion dectection will become host-based?
2 votes

No. Even if your network layer is fully encrypted and that's all working fine you still want sensors in both positions for defense in depth and alert correlation. You can and should deploy various ...

View answer
Can I spoof IP addresses when attempting to brute force a login?
1 votes

Yes, as long as you can figure out when you are successful without hearing directly from the host whose login you are brute forcing. As noted elsewhere, simple TCP sequencing will thwart you from ...

View answer
How can I decode a message that was encrypted with a one-time pad?
-2 votes

If you don't have the key ... Brute force the ciphertext (permute it) and analyze the output for potential cleartext in the expected language. Statistical analysis can assist in the detection of ...

View answer