Collaborate Disseminate
While not particularly knowledgeable on public key infrastructure, I’ve noticed strange issues with SSL and TLS lately that I’m unable to diagnose. As these issues have currently left me dumbfounded I’m hoping someone more knowledgeable ma… Continue reading Extremely strange and concerning SSL issues. MITM attack?
So I read something about SSL/TLS and I always don’t understand two things.
First, why so many of the comments are still saying that just because the attacker doesn’t have the private key, a MiM attack after taking the public key wouldn’t … Continue reading Man in the middle Attack, possible even with CA certificate and assymetric encryption
In the node.js express.js framework there is middleware support. Let’s assume I have two middleware – the first one, which verifies whether the JWT token is legit and not tampered with and the second middleware which doesn’t verify anymore… Continue reading Can the data between Express.js middleware be manipulated/tampered in any way?
I was doing some security checks in some devices in my local network and I noticed that I obtain two different certificate chains for the same domain (www.google.com) from two different devices (smartphone and desktop pc, again both connec… Continue reading Same domain, same local network, different certificate chain
Client A is connected to the public internet.
Client B gateway address is connected to the Client A’s network interface.
Client B is running a Web browser which is sending requests to 127.0.0.1:1234 HTTP Proxy, which encrypts and sends th… Continue reading How to sniff connection between web browser and 127.0.0.1:1234 running HTTP proxy on Client B’s machine while taking internet from client A’s machine?
I’m a pentester and this is my first question here. I’ve managed to circumvent the ssl certificate pinning implementation on a few mobile apps.
Frankly, the applications I test are critical bank applications and I can listen to the traffic… Continue reading Is SSL pinning bypass considered a vulnerability? If yes, what are the tightening/solution suggestions?
I tried sniffing TLS web traffic on my own network and I always run against the following complications:
I need to install an additional root cert on my devices
I need to root my phone to do certificate pinning bypass
For a government th… Continue reading How can authoritarian governments sniff TLS encrypted traffic on mass scale?
Encryption schemes typically are built on the idea that even if a man in the middle attacker knows exactly what kind of encryption you’re using, they cannot decrypt your messages without the key.
As far as I’m aware, the only mechanism whi… Continue reading Can a man in the middle tell what kind of encryption you’re using from a key exchange? [migrated]
Today I was visiting a website, using HTTPS obviously, that firefox gave me a certificate error and said that the certificate did not match the website’s information.
After a bit of investigation, it seems to me that my DNS provider is pro… Continue reading Can your ISP pull off a man-in-the-middle attack over unencrypted DNS?
Let’s say you did arp poisoning on another person’s computer and then they did arp poisoning on your computer while you were doing arp poisoning on their computer. What would you be seeing in Wireshark (or some other network traffic viewer… Continue reading What would you see in Wireshark if you did arp poisoning on a device that is arp poisoning your device? [closed]