Collaborate Disseminate
I have a server with a number of Linux bridge devices for use with groups of virtual machines – some internet-routed, some intentionally unrouted. I have stateful firewalling in place for traffic traversing across and between those bridges… Continue reading Is it safe to use conntrack on Linux bridge devices?
I’ve been dealing with a hack on a site. I ended up wiping it and starting again – this was no loss as it was a small site and all content was backed up – took a couple of hours to get going again.
I notice that the attackers were using ma… Continue reading Spoofed IP addresses basics
If I send IP packets in my home network with a residential router (e.g. Netgear, D-Link), and I use the wrong IP in the destination field, will the router drop such packet or will it route it?
Continue reading Do modern routers drop malformed IP packets
I have a service that runs as Windows Service on a device and developed using C#, and uses the gRPC protocol for communication as shown in the below diagram.
The service is running on port 5000 as http://localhost:5000
I am doing a cybers… Continue reading What are possible spoofing attacks on internal services in devices?
I’ve recently tried out the following nmap command on my Kali Linux virtual machine with Nmap 7.91,
nmap -sS -e eth0 -S 12.12.12.12 192.168.0.102
I was trying to perform a SYN scan with a spoofed IP of 12.12.12.12 on to my host computer w… Continue reading Nmap Spoofing NSOCK ERROR [migrated]
Imagine a user has an ip of 1.2.3.4
The server the user intends to connect to has an ip of 2.3.4.5
An attacker has a machine with a promiscuous network card on the user’s local network.
The attacker also has a server on a seperate network … Continue reading What prevents this specific type of attack from being viable?
Say we have the source IP always authenticated. So the source IP is guaranteed to be the sender of the packet.
Would it be able to counter attacks like
SQL Injections
MITM
TCP SYN Flooding
Cross-Site request forgery
or even XSS (cross-site… Continue reading In what scenarios is relying on source IP address as a security control acceptable?
My question is reciprocal to How to find the actual address of spoofed IPs?
On a coturn server I have a repeat offender who is able to initiate requests, and is invariably closed. That address is within a range designated denied-peer-ip, … Continue reading How to find a presumably spoofed IP
I was reading the Wikipedia article about TAO and there is written that:
Details on a program titled QUANTUMSQUIRREL indicate NSA ability to masquerade as any routable IPv4 or IPv6 host. This enables an NSA computer to generate false geog… Continue reading How does the NSA "masquerade as any routable IPv4 or IPv6 host"?
Is it possible to spoof the IP once a TCP handshake was performed successfully?
For example:
Perform the handshake
Use the session with the same IP which performed handshake but on
different machine and network then send a request e.g PO… Continue reading Spoof IP address after a TCP handshake established