I'm trying to analyze the outgoing requests of an application on my windows 10 computer, but I'm not aware of any way to capture the secret key needed to decrypt the traffic. I have used  previously, but switched because of lack of protocol support. I know the key can be captured on chrome/firefox by setting the &quot;SSLKEYLOGFILE&quot; enviroment variable, but this is not relevant in this case, as the application in question does not support that type of logging. Therefore my question becomes: Is there a general method of capturing the secret key needed to decrypt SSL/TSL traffic in Wireshark, that can be applied regardless of application? Answer There is no general way of capturing the secret key needed to decrypt SSL/TSL messages, but one can use a proxy such as  to achieve equivalent results in most cases, hence I found the &quot;general method&quot; I was looking for.
124211
I'm trying to decrypt SSL traffic in Wireshark, and it partially works because I'm able to view the decrypted headers. The problem is that I don't see any of the packet contents, only their headers. Is there an explanation for this behaviour?  A bit more detail: we used openssl to generate keys and certificates with the command:  openssl req -config *.cnf -new -x509 -extensions v3_ca -keyout *.key -out *.crt -days 1825  and then to decrypt the private key to a PKCS#8 format, which wireshark supposedly supports, we issued this command: openssl pkcs8 -nocrypt -in *.key -informat DER -out *.key -outformat PEM  In Wireshark we issued the following parameters in SSL decryption section: 10.10.10.10,443,http,*.key - where 10.10.10.10 is the client we're trying to MITM using sslsniff. We have also tried localhost and servers IP with no success. Any suggestions?
124016
I have built a basic data entry application allowing users to browse external content in iframe and enter data quickly from the same page. One of the data variables is the URL. Ideally I would like to be able to load the iframes current url into a textbox with javascript. I realize now that this is not going to happen due to security issues.  Has anyone done anything on the server side? or know of any .Net browser in browser controls. The ultimate goal is to just give the user an easy method of extracting the url of the page they are viewing in the iframe It doesn't necessarily HAVE to be an iframe, a browser in the browser would be ideal.  Thanks, Adam
67494
I'd like to capture the data sent by my ADSL modem (what's really sent on the RJ11 cable). I have no access to my modem (no ssh), so I'd like to build a mini-computer with 2 RJ11 plug, one connected to the modem, one to the telephone plug, and be able to capture/edit the data sent and recieved.  Somebody knows where I should start ?
16553
I have a snort.rule file, I need to extract cve numbers followed by reference key from the line and append them back in msg field of the same line inside flower brackets, below is the old log.     alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2"; content:"Intel SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference:arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)   Required output is below, bold ones are the new changes,     alert udp $HOME_NET 1900 -> any any (msg:"ET INFO UPnP Discovery Search Response vulnerable UPnP device 2 {cve,2012-5958 cve,2012-5959}"; content:"Intel SDK for UPnP devices"; pcre:"/^Server\x3a[^\r\n]*Intel SDK for UPnP devices/mi"; reference: /infosec/blog/2013/01/29; reference: arch/UPnP-arch-DeviceArchitecture-v1.1.pdf; reference:cve,2012-5958; reference:cve,2012-5959;sid:2016303; rev:4;)   I am able to extract the CVE numbers, but appending back I am not getting  cat /tmp/snort.rule | grep -o -E -e 'sid:[^;]+' -e 'reference:cve,[^;]+'
103443
Any site that I visit can see my local IP (e.g. 192.168.1.102). Is there any reliable way to block this behavior? (browser setting, OS setting, router setting, etc.) I am particularity interested in Google Chrome and Mozilla Firefox, but any modern open source browser will do. If it is a browser plugin, it should be open source with a solid user base.  By reliable I mean, that I do not need to check the leakage again after every software update.  More info / what I have read so far:   There was a Chrome plugin that is not working anymore Local IP is obtained using JavaScript / WebRTC   Live Demo here:  Source code:   Firefox developers is not going to fix the leak (bug is open from 2014):  In Private / Incognito mode does not prevent this leak. If you use static IPs, and have non typical local IP (e.g. 10.66.77.88 or 192.168.212.121), then there is no need for . Your external IP + internal IP is perfect fingerprint.   Update 1: It is not duplicate of  - I want to prevent private / local IP leak, not disable all WebRTC.  Update 2: No, it is not related to header X-Forwarded-For (HTTP_X_FORWARDED_FOR), that is added when user/administrator chooses to do so. In my provided demo it is not your choice... It is Google's and Mozilla's choice to leak your private IP even when using private browsing mode.  Update 3: Ability to determine my local IP allows malicious JavaScript to quickly identify my local subnet and print on my local network printers from any website in the world without me doing anything.  This  finds my LAN printers using JavaScript.  Update 4: It is not a good idea to reveal private IP to every website. By seeing your private IP, for example 192.168.88.101, I can guess with very high probability that you are using MikroTik router. Also, I can track particular user event if user uses different browsers because local and remote IP stays the same for some time (hours or even days).
113485
I want to capture a keyboard shortcut in my application and trigger a dialog to appear if the user presses a keyboard combo even outside of the app. Similar to Google Desktop Search's Ctrl, Ctrl to bring up the search dialog.  I have tried using some keyboard hook modules out there that basically use Win32 interop to get this effect but each implementation I've tried ties down the keyboard to some extent to where you start getting weird behaviors when the application is doing something intensive. Such as loading a large amount of data, this would cause the keyboard and mouse to lockup.  I'm looking for a lightweight solution that would allow this to be done without tying down the keyboard and mouse.
69573
I'm trying to do something like   URL clientks = com.messaging.SubscriptionManager.class.getResource( "client.ks" ); String path = clientks.toURI().getPath(); System.setProperty( "javax.net.ssl.keyStore", path);   Where client.ks is a file stored in com/messaging in the jar file that I'm running.  The thing that reads the javax.net.ssl.keyStore is expecting a path to the client.ks file which is in the jar. I'd rather not extract the file and put in on the client's machine if possible. So is it possible to reference a file in a jar?  This doesn't work as getPath() returns null. Is there another way to do this?
6572
On my home Windows 10 machine, I have port forwarded Microsoft's RDP port (3389) via my router to port (20202). Thus, I can remotely access the Windows 10 machine via the Microsoft Remote Desktop application on my Mac by simply typing in &lt;my public IP address&gt;:&lt;port&gt; (e.g. 134.111.23.443:20202).  I'm wondering if there is a way to make this more secure, such as tunneling over SSH, without requiring any other computers (I only have the Windows 10 Machine connected to the Internet by landline at home, and my MacBook, which I take with me).
93573
Given the key for some registry value (e.g. HKEY_LOCAL_MACHINE\blah\blah\blah\foo) how can I:   Safely determine that such a key exists. Programmatically (i.e. with code) get its value.   I have absolutely no intention of writing anything back to the registry (for the duration of my career if I can help it). So we can skip the lecture about every molecule in my body exploding at the speed of light if I write to the registry incorrectly.   Prefer answers in C++, but mostly just need to know what the special Windows API incantation to get at the value is.
18172
I'm writing a program that needs to download GPG keys for various distributions to do unattended net installs. To do this securely and in an automated way, I need to download the key via HTTPS, which means "gpg --recv-keys" isn't an option. Other distributions (e.g., Fedora) make their keys available on their websites via HTTPS (e.g., ), but I can't find the Ubuntu key file anywhere on ubuntu.com. Does anyone know where I can get it via HTTPS?
7860
I want to monitor HTTPS network traffic on the Internet and not Intranet.  I would use a tool like Charles or Fiddler and setup a proxy but I could only host through Intranet. Plus, I have the issue of decrypting https traffic.  Ideally, I would like to monitor all http requests on the ios device, log to a file and then I can monitor the full data in that file.  Also, I am working Cordova/Xcode ObjectiveC code to create webviews, so the application I want to monitor is not a full browser like Safari.  I would be monitoring webrequests through that webview.  Is there a way to do this?  What applications in iTunes/Store are available to print out decrypted https requests.  ...
75060
Whenever I'm using the internet from an insecure location (such as public wifi) I like to use an ssh tunnel (ssh -D port host) to ensure my traffic can't be sniffed. Unfortunately, there seem to be many applications which do not provide a way to specify a proxy (Flash is one major example).  It feels like there should be some way to use a tunnel for all network traffic from my computer, but I'm complete ignorant of how to do this. Any help would be greatly appreciated.
93627
I'm looking for a technique or tool which we can use to obfuscate or somehow secure our compiled c# code. The goal is not for user/data security but to hinder reverse engineering of some of the technology in our software.   This is not for use on the web, but for a desktop application.  So, do you know of any tools available to do this type of thing? (They need not be free)  What kind of performance implications do they have if any?  Does this have any negative side effects when using a debugger during development?  We log stack traces of problems in the field. How would obfuscation affect this?
58456
takes a plaintext message + password input and encrypts the plaintext. I want to do this locally on Linux. Is there a one-line command that will compute an encrypted version of my message that I can then email?  My goal is for the receiver to be able to decode the message with nothing but the password.  To be clear, I have no idea what various encryption schemes are (AES, openSSL, RSA, GPG, salt, base64, DES, CBC, reentrant) and not really interested in a research project. I just want a one-line command like  encrypt message.txt -password=secret.txt  which would be decoded like  decrypt message.txt -password=secret.txt    (Yes, I did use google first.  is not showing me anything I understand / think I can use.)
31014
I have a requirement that an application I am working on prevent the user from being able to easily capture the contents of the screen.  I have communicated that there is no feasible way to completely prevent this from happening, but I'm looking for methods to introduce some hurdles to the process.  I'm using C#/.NET 2.0 and WinForms
31968
I have reviewed both related posts on this site:      The issue I am having is that I have implemented the registry change, rescanned my websites, and I am still being told that IIS 6 is allowing SSL 2.0 connections.  Here's the verbage from the scanning site:     Synopsis : The remote service encrypts traffic using a protocol with known weaknesses. Description : The remote service accepts connections encrypted using SSL 2.0, which reportedly suffers from several cryptographic flaws and has been deprecated for several years. An attacker may be able to exploit these issues to conduct man-in-the-middle attacks or decrypt communications between the affected service and clients.   QUESTIONS:   How do I test this myself so I can continue to troubleshoot the issue? Is there a tool out there that I can use to test? Would I need to disable other connection methods? [PCT 1.0 / TLS 1.0]   Thanks
45515
I need to use another computer to access my ssh server. This is because a recently implemented vpn at my university doesn't work on my current computer and I have lost access to the server.   I ssh via encrypted ssh keys. Can I copy these keys to the new computer (on which the vpn works). I tried copying the id_rsa and id_rsa.pub files in the ~/.ssh folder but it doesn't recognize the keys and there is no prompt to input a password to decrypt the keys.   EDIT: I can't access the server to generate a new key pair for the new computer and am out of the country so can't physically access it.   Thanks.