Collaborate Disseminate
Say, an attacker wants to perform a MitM but all he has available is the network traffic between a client and a server. He has no further information about the data or certificates than what’s being exchanged over the network… Continue reading MitM to intercept SSL/TLS based on network traffic alone?
Say, the goal is to facilitate secure communication between two parties. The definition of secure is that
both parties can be sure that they are actually talking to a trusted party, not somebody else
they can be sure that n… Continue reading Need for additional verification in mutual TLS authentication with own CA
HPKP was used to ensure that a browser accepts to connect to a site only if the public key he has on file is the one presented by the target site. I saw it as a way to make deep content inspection more complicated (some sites… Continue reading How effective is Expect-CT against content inspection in an enterprise context?
I’m trying to set up an invisible proxy (using this guide). At some point in the guide it is said that I have to listen to the following interface:
127.0.0.1:443
Once set up, I’m not able to select the interface (tick the… Continue reading How to listen to port 443 on BurpSuite
If we establish the connections between two peers using two way SSL with strict configuration(TLS1.3 ,strict cipher etc..) and disabling client initiated re-negotiation.
And if we establish the ssh connection then which conn… Continue reading Is connection established with two way SSL is as secure as SSH?
I’m using BurpSuite to intercept the HTTP/HTTPS requests sent when logging in on https://www.nike.com/. I’m trying to achieve this with the following step:
Opening BurpSuite and Firefox
Turning on the proxy intercept
Turni… Continue reading Not able to intercept traffic from nike.com login request
Hi guys can anyone help me out please? This openvpn app https://play.google.com/store/apps/details?id=de.blinkt.openvpn&hl=de
I do not understand following 11 options in the settings menu. What is their meaning/impact? I… Continue reading OpenVPN Android App – Please help understand the security functions [on hold]
I’m trying to intercept a mobile traffic of an android app I built using burp suite. I connect the mobile device to burp proxy, and install the CA. But I get a protocol error message, and couldn’t see the traffic at the Proxy… Continue reading Intercept mobile traffic using burp
I just installed mitmproxy tool. I want to run it. Once I type: sudo mitmproxy I get this error:
Error starting proxy server: OSError(98, ‘Address already in use’)
I searched and found some suggestion for changing the p… Continue reading mitmproxy: Error starting proxy server: OSError(98, ‘Address already in use’)
A number of popular mobile apps utilize certificate pinning, such as Facebook. Does this mean that these applications cease to function completely on corporate and academic networks that utilize SSL inspection, unless the adm… Continue reading Does SSL inspection break applications utilizing certificate pinning?