Collaborate Disseminate
I have a question about Emotet’s TLS traffic:
Using MITMProxy, I have successfully decrypted TLS traffic with Emotet’s C2 server and can read the contents of the traffic.
https://mitmproxy.org
However, although we were able to see the co… Continue reading How to decrypt Emotet’s TLS traffic by MITMProxy
I host my website by my own using droplet/VPS service and node.js server. My wesbite uses SSL Cert/HTTPS from LetsEncrypt, VPS service from DigitalOcean, domain registered from local vendor (RumahWeb) managed by CloudFlare.
My VPS server i… Continue reading Some ISP inject malware/ads into my website in the middle of transit
When SSL pinning is not available, for example when using a free TLS certificate from a CDN provider (Cloudflare – does not support HTTP public key pinning, what can be used to encrypt sensitive information?
I am solely trying to prevent M… Continue reading methods to encrypt data on top of HTTPS (can’t do ssl pinning, prevent MITM attacks)
I have Kali inside the internal network, and I’m local admin on another computer (windows 10) on the same network as the Kali.
What other attack options do I have, besides those in the title?
We have a project at university about MITM attacks and our focus is to show how one can get into the communication between two endpoints, given different circumstances and security measures (that we decide).
Since I don’t have much knowled… Continue reading how to use a self signed certificate to intercept traffic in MITM attack [closed]
Let’s imagine that I leave a Mac with wireless peripherals in a public space like a co-working space that might end up with other wireless devices nearby or physical access (say, at nighttime). My working assumption is that it would be rea… Continue reading Apple Magic Keyboards in Public Spaces Man-in-the-middle
I have done arp spoofing to my phone using scapy and detected duplicate ips in the arp protocol with wireshark.
However, access to websites using chrome app was blocked, but youtube and onedrive apps can be accessed normally.
Can you think… Continue reading ARP Spoofing succeeded only partially
I have quite minimal understanding in cryptography. I was very much hoping to understand whether a self signed certificate’s fingerprint be copied/reverse engineered on another certificate. Many VoIP platforms use certificate fingerprints … Continue reading Can a self signed TLS/DTLS digital certificate be forged?
Im trying to understand SSL/TLS better but cannot work out if such an attack is prevented.
Lets say you have a file security scanner (S). An application server (A) which consumes (S) accepting a file input.
Assuming the API (S) is using HT… Continue reading Replay a response to client despite SSL/TLS [duplicate]
We have chrome extension that is for internal use by our clients. It is force-installed via enterprise policy. So far, we have it published on the Chrome WebStore but we need to move off of it due to Manifest V3 restriction and host it on … Continue reading Security concern with hosting a chrome extension on a public server