3 ms·

Since I am not familiar with this, I'm very curious to know if something like that is possible and ever been done before? As in counter-hacking a vulnerability

Since I am not familiar with this, I'm very curious to know if something like that is possible and ever been done before? As in counter-hacking a vulnerability scanner by sending a malformed packet back, or something like that. In this case, this is a bug in the web interface, so you'd have to be on the same network as this person, or have access to their interface for exploiting this to be practical. I'm more curious to know if anyone has ever been able to 'counter-hack' a scanner by sending an unexpected response back. Anyone ever heard of anything like this?

rasz_pl 10y ago
sure, defcon comes to mind http://www.networkworld.com/article/2462478/microsoft-subnet/hacker-hunts-and-pwns-wifi-pineapples-with-0-day-at-def-con.html http://www.networkworld.com/article/2462478/microsoft-subnet...
Retr0spectrum 10y ago
Try this: http://www.osdfcon.org/presentations/2014/Schmidt-OSDFCon2014.pdf http://www.osdfcon.org/presentations/2014/Schmidt-OSDFCon201...
dogma1138 10y ago
I had a POC honeypot for the acunetix rce bug running never went beyond crashing the scanner but it can work. You can fuz scanners and the setup honeypots that would exploit any vulnerability you found nothing in here is specifically complicated, you can also tailor your honeypot to specific subset of tools you want to target.
jburgess777 10y ago
At the LAN level it is possible to detect hosts whose NIC is operating in promiscuous mode, which is likely for someone sniffing network traffic: http://security.stackexchange.com/questions/3630/how-to-find-out-that-a-nic-is-in-promiscuous-mode-on-a-lan http://security.stackexchange.com/questions/3630/how-to-find...
- dogma1138 10y ago
  That only works on "switch" level mostly, on a modern network you also are likely to trigger on your own switches since they run in a pseudo-promiscious (usually marketed as IP Helper, Broadcast Helper, Broadcast Redirect, DNS Helper etc.) mode to facilitate DNS and other protocols that rely on broadcasts to pass through the switch (or VLAN) boundary. This is however more in relation to intrusion detection not active countermeasures.
- deleted 10y ago
  [deleted]

rasz_pl 10y ago

sure, defcon comes to mind http://www.networkworld.com/article/2462478/microsoft-subnet/hacker-hunts-and-pwns-wifi-pineapples-with-0-day-at-def-con.html http://www.networkworld.com/article/2462478/microsoft-subnet...

Retr0spectrum 10y ago

Try this: http://www.osdfcon.org/presentations/2014/Schmidt-OSDFCon2014.pdf http://www.osdfcon.org/presentations/2014/Schmidt-OSDFCon201...

dogma1138 10y ago

I had a POC honeypot for the acunetix rce bug running never went beyond crashing the scanner but it can work. You can fuz scanners and the setup honeypots that would exploit any vulnerability you found nothing in here is specifically complicated, you can also tailor your honeypot to specific subset of tools you want to target.

jburgess777 10y ago

At the LAN level it is possible to detect hosts whose NIC is operating in promiscuous mode, which is likely for someone sniffing network traffic: http://security.stackexchange.com/questions/3630/how-to-find-out-that-a-nic-is-in-promiscuous-mode-on-a-lan http://security.stackexchange.com/questions/3630/how-to-find...

dogma1138 10y ago
That only works on "switch" level mostly, on a modern network you also are likely to trigger on your own switches since they run in a pseudo-promiscious (usually marketed as IP Helper, Broadcast Helper, Broadcast Redirect, DNS Helper etc.) mode to facilitate DNS and other protocols that rely on broadcasts to pass through the switch (or VLAN) boundary. This is however more in relation to intrusion detection not active countermeasures.
deleted 10y ago
[deleted]