Scribd Logo
Upload

Welcome to Scribd!

  • 46 views

    Man IN The Middle Attack 4

    Uploaded by

    Tushar Bhatia
    A man-in-the-middle (MITM) attack is when an attacker intercepts communications between two parties to eavesdrop or impersonate one of the parties without their knowledge. The attacker uses techniques like ARP spoofing to intercept traffic at the network layer and DNS spoofing to redirect traffic to themselves. They can then decrypt traffic, inject packets, or redirect traffic to fake sites to steal sensitive information like passwords or financial details from victims. Prevention methods include using password protected WiFi, paying attention to browser security warnings, logging out of accounts when not in use, and avoiding public networks for sensitive transactions.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd

    Man IN The Middle Attack 4

    Uploaded by

    Tushar Bhatia
    46 views11 pages
    A man-in-the-middle (MITM) attack is when an attacker intercepts communications between two parties to eavesdrop or impersonate one of the parties without their knowledge. The attacker uses techniques like ARP spoofing to intercept traffic at the network layer and DNS spoofing to redirect traffic to themselves. They can then decrypt traffic, inject packets, or redirect traffic to fake sites to steal sensitive information like passwords or financial details from victims. Prevention methods include using password protected WiFi, paying attention to browser security warnings, logging out of accounts when not in use, and avoiding public networks for sensitive transactions.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PPTX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    A man-in-the-middle (MITM) attack is when an attacker intercepts communications between two parties to eavesdrop or impersonate one of the parties without their knowledge. The attacker uses techniques like ARP spoofing to intercept traffic at the network layer and DNS spoofing to redirect traffic to themselves. They can then decrypt traffic, inject packets, or redirect traffic to fake sites to steal sensitive information like passwords or financial details from victims. Prevention methods include using password protected WiFi, paying attention to browser security warnings, logging out of accounts when not in use, and avoiding public networks for sensitive transactions.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    46 views11 pages

    Man IN The Middle Attack 4

    Uploaded by

    Tushar Bhatia
    A man-in-the-middle (MITM) attack is when an attacker intercepts communications between two parties to eavesdrop or impersonate one of the parties without their knowledge. The attacker uses techniques like ARP spoofing to intercept traffic at the network layer and DNS spoofing to redirect traffic to themselves. They can then decrypt traffic, inject packets, or redirect traffic to fake sites to steal sensitive information like passwords or financial details from victims. Prevention methods include using password protected WiFi, paying attention to browser security warnings, logging out of accounts when not in use, and avoiding public networks for sensitive transactions.

    Copyright:

    © All Rights Reserved
    Download as PPTX, PDF, TXT or read online from Scribd
    Download as pptx, pdf, or txt
    of 11

    Man IN The Middle

    Attack
    (MITM)
    What is MITM attack ?
    • A man in the middle (MITM) attack is a general term for
    when a perpetrator positions himself in a conversation
    between a user and an application—either to eavesdrop
    or to impersonate one of the parties, making it appear as
    if a normal exchange of information is underway.
    How Does It Work ?
    • Hackers are primarily
    targeting specific data
    about the transaction on
    computer this can be
    anything from an email to
    a bank transaction that
    said the hacker start their
    investigation of the party of
    interest
    INTERCEPTION DECRYPTION
    • IP spoofing HTTPS spoofing
    • ARP spoofing SSL BEAST
    • DNS spoofing SSL hijacking
    Once IN The Middle
    • INJECTING
    • Possibility to add packets to an already established
    connection (only possible in full duplex connection)
    • the attacker can modify the sequqnce no. and keep
    connection synchronized while injecting packets
    • if mitm attack is (proxy attack) it is even easier to inject
    Advance MITM Attack
    • Traffic Tunneling
    • Filters
    • DNS Poisoning
    • Route Mangling
    ATTACK 1 - DNS Spoofing
    • The following example illustrates a DNS cache poisoning
    attack, in which an attacker (IP 192.168.1.5) intercepts a
    communication channel between a client 1
    (IP 192.168.1.6) and a sever computer belonging to the
    website www.estores.com (IP 192.168.1.7).

    • In this scenario, a tool (e.g., arpspoof) is used to dupe the


    client 1 into thinking that the server IP is 192.168.1.5. At
    the same time, the server is made to think that the client’s
    I is also 192.168.1.5.
    Such a scenario would proceed as follows:

    1 The attacker uses arpspoof to issue the command: arpspoof 192.168.1.6 192.168.1.7. This modifies the
    MAC addresses in the server’s ARP table, causing it to think that the attacker’s computer belongs to the
    client.
    2 The attacker once again uses arpspoof to issue the command: arpspoof 192.168.1.7 192.168.1.6, which
    tells the client that the perpetrator’s computer is the server.
    3 The attacker issues the Linux command: echo 1> /proc/sys/net/ipv4/ip_forward. As a result, IP packets
    sent between the client and server are forwarded to the perpetrator’s computer.
    4 The host file, 192.168.1.5 estores.com is created on the attacker’s local computer, which maps the
    website www.estores.com to their local IP.
    5 The perpetrator sets up a web server on the local computer’s IP and creates a fake website made to
    resemble www.estores.com.
    6 Finally, a tool (e.g., dnsspoof) is used to direct all DNS requests to the perpetrator’s local host file. The
    fake website is displayed to users as a result and, only by interacting with the site, malware is installed on
    their computers.
    Attack 2 - ROUTE MANGLING
    The attacker can
    forge packets for the
    gateway (GW)
    pretending to be a
    router with a good
    metric for a specified
    host on the internet
    The netmask should
    be big enough to win
    against other routes
    Now the problem for the attacker is to send
    packets to the real destination. He/she
    cannot send it to the real destination
    through GW since it is convinced that the
    best route is AT
    Prevention
    • Avoiding WiFi connections that aren’t password protected.
    • Paying attention to browser notifications reporting a
    website as being unsecured.
    • Immediately logging out of a secure application when it’s
    not in use.
    • Not using public networks (e.g., coffee shops, hotels)
    when conducting sensitive transactions.

    You might also like