Collaborate Disseminate
Analyzing an android app’s traffic POST request, it sends some important pieces of data in the form of URL encoding. This is pretty easy to decode and get the data. The data is sent over HTTPS. But is it safe to perform URL encoding of the… Continue reading Burp suite: URL encoding of request body – Is this safe?
As I understand the original master key, which is used to encrypt the application data is never transmitted over the wire and it is calculated on both client and server individually using a hashing-alike function which takes the following … Continue reading How is man-in-the-middle attack prevented in TLS?
I’m pen testing a setup where I have an AP that I control (using wifipumkin3) and DNS spoofing to redirect the known endpoint for a firmware update. When the device requests for an update, I’m redirecting the request to an opened port that… Continue reading Redirect client to no SSL as MITM
I am getting the notification ‘Cannot verify server identity’ for every single website I try to open on an iPhone. This, however, only happens when connected to a certain WLAN.
On mobile internet this does not show up.
I already have reaso… Continue reading Getting ‘cannot verify server identity’ only on wireless LAN. Is this a MITM attack?
Could someone DNS spoof REST API communication between a client device POST to a server URL running a XML-based API on HTTPS?
If a man-in-the-middle for client device(s) POSTing to the server on a scheduled frequency where all REST API com… Continue reading DNS spoofing an API? [duplicate]
Hey so am new to pentesting and I learnt that using https makes the traffic encrypted so hackers cannot decipher credentials passed in a body for example in a login page or read the traffic properly. So I was practicing with both GET and P… Continue reading Credentials in a POST body over https are visible
Since I moved from one part of Mexico to another I’ve had sporadic issues with the ISP (delivered over 4G)
It’s not that I don’t have connectivity, but that none of the encrypted protocols are working. Also, how do I get more information … Continue reading What game is my ISP (or other MITM) playing with me? [migrated]
I’ve recently set up a mitmproxy on my phone and it seems to work fine. It intercepts that request for https websites and I can view their content.
But I’m trying to intercept data from a banking app I have on my phone. The connection work… Continue reading Is it possible that data is still encrypted even when you intercept TLS? [duplicate]
How does network segmentation affect network packet sniffing, man-in-the-middle attacks and interconnectivity of devices? I am mainly interested in understanding the possibilities of network malware or a "packet sniffing" hacker…. Continue reading How network segmentation affects network monitoring/MITM and interconnectivity of devices
Diagram: Server -> Exit Node -> Middle Node -> Entry Node -> Client
In Entry Node -> Client, how does the entry node authenticate that the receiver is a real client but not a MITM?
Continue reading MITM in Tor: Authentication when an Entry node is sending data back to the Client