Collaborate Disseminate
I am working on an e-commerce SPA (Single Page App) hosted in server A, I don’t understand the security (Auth) that good, I’m consuming a PHP RestAPI hosted in server B only to show products, as it is only for showing products I thought th… Continue reading "Not secure" after RestAPI request
I’m trying to intercept a SSLv3 connection between a PlayStation 3 client and an authentication server of and outdated game to reverse engineer its protocol.
I already tried to set up a simple MITM attack and copied every value from the or… Continue reading Force public key collision to break certificate pinning
manipulation of hardware is what active troubleshooting is all about
simply put
you must know something well enough to manipulate it to a fine degree if you want to be a technician
this means having the books, schematics, secrets or whatev… Continue reading manipulation of hardware or software is what active troubleshooting is all about [closed]
In my company they have MITM/SSL in following way.
There is a proxy to whom all PCs connect.
Now the company installed some trusted certificate authority (e.g. ISSUER-COMPANY-NAME) on our computers.
When I go to facebook it shows me that i… Continue reading Tor and MITM SSL [duplicate]
When I try to arp spoof my own PC using my laptop with bettercap it doesn’t work and can’t be MITM
but when i try it from my laptop against virtualbox os on the same network it works perfectly
I use bettercap V2.23
hostOS is kali linux on … Continue reading arp spoof real devices by bettercap doesn’t work
I am wanting to set up a single logging point on my home network that logs URLs and search terms to monitor teenagers… um… activity.
I was thinking of setting up a computer between the cable modem and the router, which would capture al… Continue reading Hard Wired Man in the Middle Logging
Do browsers have a list with sites that are supposed to be encrypted?
Could a man in the middle attack be performed by presenting a user a http site instead of an https site? That way the server would not need to provide a certificate.
It … Continue reading Do browsers know domains that are supposed to be encrypted?
I am a currently analyzing the available Cloud services allowing End-To-End Encryption for file sharing.
It looks like, for each solution I found, if Alice wants to send an encrypted file to Bob, she will have to trust the server when she … Continue reading End-To-End Encryption in Cloud file sharing
I came across an infosec presentation from a conference which discussed how ICMP packets can be used to compromise a connection between two machines. More specifically, they described the process as:
The attacker can forge a spoofed ICMP … Continue reading MITM attack using ICMP packet injection
When I try to access some web site on firefox I get this:
The cut out rectangle is COMPANY-NAME-ROOT-CA and that issuer (COMPANY-NAME-ROOT-CA) was also added as trusted on some peoples PC.
But when I visit same site using chrome I don’t g… Continue reading Different certificate issuers on same site based on browser