« first day (3278 days earlier)      last day (1601 days later) » 

Vipul Nair
Vipul Nair
1:49 PM
-2
Q: Monitor mode for pentesting with Alfa wireless card

Tim Li THIS IS A REPOST OF MY ORIGINAL QUESTION THAT GOT PUT ON HOLD BECAUSE IT WAS NOT RELATED TO NETWORK SECURITY OR PENTESTING? LIES I have a wireless card (Alfa AWUS036H) that I use for pen-testing on my test network. Due to my recent interest in network hacking, I picked up this card and put it...

network penetration-test
LIESSSSSSSSS
 
AndrolGenhald
AndrolGenhald
2:18 PM
Anyone know the actual ramifications of CVE-2019-14899?
I see a lot of news calling it "VPN hijacking", but from what I've read so far it's just abusing automatic routing with multiple interfaces to figure out what IP's you're communicating with over the vpn interface by communicating with the non-vpn interface
I'd hardly call that "hijacking"
even "sniffing" is stretching a bit, but at least that's somewhat accurate
What I'm not clear on is the part about "inject data into the TCP stream"
So maybe I was wrong, it looks like they can actually spoof responses from TCP connections over the VPN?
But they can't inject data in the other direction (from the victim to the VPN)?
Interesting, glad I'm not affected at all.
 
 
4 hours later…
OakSecurity
OakSecurity
6:16 PM
@MechMK1 Me. The day I saw password managers I figured it was fundamentally flawed.
but in retrospect it's only because the one I saw would require master pass per timeframe/browsing session where it allowed for auto-fill everywhere
So basically if I have your computer for a mere couple of seconds/minutes with an authed session, it's direct access to all your passwords.

Compared to "aw shit, this website got hacked now I have to change that particular password"
agglomerating password is not a sound conception in my opinion.
unless it's very carefully done so
 

« first day (3278 days earlier)      last day (1601 days later) »