|
From the Wikipedia article on anti-replay:
Is this commonly exploitable? How can I edit a packet and before sending it again over the web? |
|||||
|
As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.
|
Yes, it is fairly commonly exploitable. The class of applications that can do it are called packet sniffers. They work because of the way a network works. While things have improved a lot as switches have gotten cheaper and become more standard, things like wireless networking make it harder. The most common (non-governmental at least) attack of this type occurs on the user's end where information is sent in a way that other computers other than the intended recipient can see it, either by going through a non-switched hub (where the information is sent to all connected computers) or by sniffing a wifi network. The information can also be gathered at some degree of randomness by compromising a router used for internet routing or inserting a rogue router. Real world examples of this include situations like one that happened a few years ago where a number of routers in China mysteriously started advertising they had fast routes available for major US traffic which resulted in a large amount of US traffic routing through China for a short period of time. This may have just been misconfigured hardware, or it could have been a MITM (man in the middle) attack. The limitation of some of these techniques, particularly ones that are pure sniffing, is that they can not prevent the original message from getting to the intended recipient, so they are easily defeated (at least for hijacking purposes) by using an encrypted incrementing value to prevent reuse of a previous command. In other cases, such as a compromised router, it could be possible, within a short period of time, to replace the message on the line as long as the timeout isn't exceeded for the packet. The idea for protecting against that kind of an attack is that it would be difficult to break the encryption on the connection sufficiently quickly to compromise the connection before the information contained in the packets being sniffed are irrelevant. As far as unprotected traffic however, it is relatively simple, particularly on the client end, to sniff traffic and make modifications if the protocol being used is not resistant to tampering (such as SSL). |
|||
|
|
The classic tool for creating custom packets and sending them out is Nemesis. There are others, mostly designed for use on wireless networks - they're easier to sniff than most modern wired networks, so a more popular attack vector. I like Ostinato, myself, as it is a bit more user friendly. |
|||
|
|
