Category: proxies

HTTP Request Smuggling Basics

I am currently trying to learn HTTP Request Smuggling vulnerability to furthermore enhance my pen testing skill. I have watched a couple of videos on Youtube and read articles online regarding it but still have a couple of questions in mind. Question:

  • What are the attack vectors of HTTP Req Smuggling (Where should I look)?
  • What is the main way to provide PoC to companies with high traffic? I know that HTTP Smuggling could possibly steal people’s cookie, can this be used for the PoC or is this illegal?
  • Can this or other vulnerability be chained together? (e.g. self-xss & csrf)

Thank you everyone!

Securing internet connection with hostile ISP

Please excuse the lack of details, you can understand why. I have a friend in a foreign country who is certain that he is a surveillance target of his local government. Other people he knows in his same category have already had their internet connections spied on, and seen contents of their emails leaked. He refuses to use his local ISP because the government runs it, so he uses another means of internet but which is very unreliable.

He really would like to use a landline ISP for it’s stability, but knows he can’t trust it. I thought of setting him up with a serious firewall (like pfSense) with a permanent VPN tunnel to a provider that is based outside of his country.

Given these considerations, would this be a safe solution? Or rather if the ISP is compromised, are all bets off?

Is it safe to extract file from potentially infected disk

I have a hard drive used for years, there are windows and many personal files on it. What I called "files" are images, musics, documents (pdf or docx), but not programs. All the "files" were not initially infected. As I said in the title, the hard drive may be infected by malware (I did not safely use it).

My question is : can I extract these personal files on a safe computer without risk of contamination ? In other words, may these files be infected and spread malware ?

Is there a legitimate reason for a USB-ethernet hardware device to have been connected to my laptop?

There was an unknown network adapter in my device manager. I found out it was for a USB-RJ45 ethernet device, which I have never even seen before. This device was not present when I bought the machine. As far as I have researched, it is not installed by any software or devices I use.

Iโ€™m concerned because there is a known vulnerability in Windows thatโ€™s exploited using these devices. A malicious person with access to the device could have stolen my credentials and logged in. (Google Usb-ethernet windows vulnerability if you donโ€™t believe me.)

I believe the police or another malicious party exploited that vulnerability, and they used it to install a keylogger and acquire my hardware info. Is the presence of this device suspicious enough, from an information security standpoint, to support my belief? What would you do if you discovered the same on an enterprise machine?

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let’s call them Client A, Client B, and Client X.
I use my own laptop for all 3 clients.
Throughout the day, I have to work on and respond to emails and instant messages about projects for all 3 clients.
In order to work on Client X’s project, I must be connected to their VPN.
Client X performs SSL deep inspection on the traffic on their network. (I get errors from sites/apps that enforce key pinning)

I’m worried that information about Client A and Client B, (not to mention my own sensitive information) might be exposed to Client X. How can I prevent this, but still maintain my ability to communicate with A and B while working on X’s network?

I’ve tried giving each client its own VM on my machine, but the hefty resource requirements of the software I have to use (IDE) makes this prohibitively slow, to say nothing of the licensing difficulties.

A regular language derived from another

This is similar to a previous question I asked, but doesn’t seem aminable to the same technique. Given a regular language $ A$ , show the following language is regular: $ $ \{x|\exists y \; |y| = 2^{|x|} and \; xy \in A\} $ $

I’m aware of the notion of regularity preserving functions, and that it would suffice to show that $ f(x) = 2^x$ satisfies the property that for an ultimately periodic set $ U$ , $ f^{-1}(U) = \{m|f(m) \in U\}$ is ultimately periodic. I’m struggling to $ f$ has this property, but the book from which this comes implies a solution not using this is possible. It appears to be looking for a construction.

I can see that by repeated application of the idea behind the Pumping Lemma, if $ A$ has DFL with $ k$ states, that for any $ x$ with $ |x| \geq k$ then $ $ \exists y \; |y| = 2^{|x|} and \; xy \in A\ \implies \exists y \; |y| \leq k \; and \; xy \in A\ $ $

But this doesn’t give anything going in the opposite direction, that shows that some suitably short $ y$ guarantees the existence of a $ y$ of the required length.

Any help in solving this, or hint at how to progress would be very helpful.

Find maximal subset with interesting weight function

You are given $ n$ rows of positive integers of length $ k$ . We define a weight function for every subset of given $ n$ rows as follows – for every $ i = 1, 2, \dots, k$ take the maximum value of $ i$ -th column (), then add up all the maximums.

For example, for $ n = 4$ , $ k = 2$ and rows $ (1, 4), (2, 3), (3, 2), (4, 1)$ the weight of subset $ (1, 4), (2, 3), (3, 2)$ is $ \max\{1, 2, 3\} + \max\{4, 3, 2\} = 3 + 4 = 7$ .

The question is, having $ m \leq n$ , find the subset of size $ m$ (from given $ n$ rows) with maximal weight.

The problem looks trivial when $ m \geq k$ , but how can one solve it for $ m < k$ ? Looks like dynamic programming on subsets could work for small $ k$ , isn’t it? Are there other ways to do it?

Given a row sum vector and a column sum vector, determine if they can form a boolean matrix

For example, for a boolean matrix of size $ 3×4$ , the row sum vector $ R = (3, 3, 0, 0)$ and the column sum vector $ C = (2, 2, 2)$ form a match because I can construct the boolean matrix:

$ $ \begin{matrix} & \begin{bmatrix} 1 & 1 & 0 & 0\ 1 & 1 & 0 & 0\ 1 & 1 & 0 & 0 \end{bmatrix} & \begin{pmatrix} 2\2\2 \end{pmatrix} = C \ R = &\begin{pmatrix} 2 & 2 & 0 & 0 \end{pmatrix} \end{matrix} $ $

However, the column vector $ C’ = (4, 1, 1)$ doesn’t form a match with $ R$ .

So given two vectors whose values are sorted in descending order $ R_{1, w}$ and $ C_{h, 1}$ , and whose accumulated sum is the same, $ T = \sum_jR[1, j] = \sum_iC[i, 1]$ , how can I polynomically check if $ R$ and $ C$ form a matching because I can form a matrix $ M_{h,w}$ having $ R$ and $ C$ as row and column sum vectors?

More specifically, in case it can help to make the check algorithm faster, in my specific case, R and C has the following properties:

  • $ h \leq w$
  • The number of positive values of $ R$ and $ C$ is $ > w$ . For example, $ R$ , in the example, has two positive values and $ C$ has three positive values, and it happens that $ 2 + 3 > w = 4$ .