In this lesson,
we're going to cover the concept of an on-path attack.
Now, an on-path attack
is an attack where the penetration tester
is able to put their workstation logically
between two hosts during the communication
in order to transparently capture, mod,
and relay the communications between those hosts.
By placing themselves in the path
between the server and the client,
the attacker can intercept the authorization packets
being sent and received,
and then use those to take over the authorized session
between that client and the server.
Now, there are many different ways of conducting an on-path
or interception type of attack,
including ARP poisoning, DNS poisoning,
introducing a rogue wireless access point,
or introducing a rogue hub or switch.
From the attacker's perspective,
once an on-path or interception attack has begun,
they can really decide to either use a replay
or relay type of attack.
Now, a replay of the data
occurs when valid data is captured by the attacker
and then is repeated immediately
or is delayed and then repeated.
A replay is a common technique in wireless network attacks,
but it can also be used in wired networks, too.
For example, if we capture an authentication handshake
between two hosts,
we can then replay it to the authentication server,
so it thinks that we are the authenticated client too,
and it'll give us access to the network or its resources.
A relay attack, on the other hand,
will occur when the attacker able
to become part of the conversation
by inserting themselves in between two hosts
that are communicating.
In this case, the attacker essentially becomes a proxy
between the two hosts,
and they can read or modify any communications
going between them.
When this occurs,
anytime the client tries to get to the server,
it's first going to go over to the attacker,
and then, from the attacker to the server.
From this position in the middle, we can capture everything
that's being sent between the two hosts,
including things like usernames, passwords,
and even bank balances.
We can even change the data if we desire to, as well.
For example, if there's a client device
trying to log into an online bank's website
to conduct a transaction,
you may be able to put yourself between the client device
and the server using a relay attack
if you're a penetration tester or a malicious hacker.
Then, you could modify the transaction
that's being requested.
Let's pretend the client logs into the website
and they initiate a transaction to transfer $50
to their account numbered 12345.
Now, if the attacker is able
to get in between that communication session,
they could modify the data being sent in those packets,
so it now says to transfer $5,000
to the account number 67890,
which may be an account that they own themselves.
Now, when the bank receives the request,
they believe it came from the authorized client,
and so the money's going to be moved
into that attacker's account,
and not going into your own account.
By conducting this kind of a relay attack,
the attacker will be able to breach both the confidentiality
and the integrity of this transaction
because they can now see the transaction being requested
that violated the confidentiality,
and they're able to change
or modify the requested amounts and account numbers,
which is a violation of the transaction's integrity.
Remember, an on-path attack
can involve getting the information
and then either passing it on directly
using a replay attack,
or the attack can intercept it, change it,
and then pass it on using a relay attack.
The big challenge though, with replay and relay,
occurs when encryption is being enforced by your hosts.
For example,
if the server is running strong encryption schemes
like TLS 1.3, it's going to be pretty difficult
or even impossible for us to intercept
and crack the communication between the two hosts.
So to try and overcome this encryption,
a technique known as SSL stripping was created by attackers.
Because a lot of websites used SSL,
and its replacement, TLS,
as a way to encrypt data between the client and the server,
the attackers might attempt
to trick the encryption application
into presenting the user with an HTTP connection
instead of an HTTPS connection,
essentially stripping out the encryption layer.
For example, let's say you try to go to facebook.com
using HTTPS, but with SSL stripping,
the attacker will try to redirect or downgrade that request
to use the regular HTTP version of the website instead.
This would be considered SSL stripping,
because now there is no encryption
being used in that connection,
and we can then capture all the data and read it.
Now, if an attacker finds that SSL stripping
is not possible on a given system,
they may instead perform what's known
as a downgrade attack instead.
Now, in a downgrade attack,
the attacker attempts to have a client or server
abandon its higher security mode
in favor of a lower security mode.
For example, if the client tries to connect to a server
and negotiate a higher level of encryption,
like TLS 1.3 or TLS 1.2,
but they're connected through an intermediary attacker
who's in an on-path position,
that attacker may allow the encryption to occur
so that you'll see that little lock in your web browser,
but they'll only allow it at a lower level,
such as using something like SSL 2.0,
which is much easier for the attacker to crack in real time.
This way, the attacker can remain
in the middle of the communication stream
between that client and the server,
and they'll still be able to see everything that's going on,
but the client thinks it's an encrypted session
because it is, but it's encrypted at a lower level
that can be cracked by the attacker.
Now, it's important to mention
that when I talk about a downgrade attack,
it's not only focused on SSL and TLS,
but it can actually be used with any kind of encryption
or protection, such as Wi-Fi, VPNs, and many others.
Anytime we have a client
that tries to negotiate to a lower level of security
that is technically backwards compatible
at that higher level,
this would be considered a downgrade attack.
So remember, an on-path attack occurs
when an attacker is able to put their workstation
logically between two hosts during the communication
in order to transparently capture, monitor,
and relay the communications between those hosts.
By placing themself in the path
between the client and the server,
the attacker can intercept the authorization packets
being sent and received,
and then use those to take over the authorized session
between that client and the server.