Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

From the Wikipedia article on anti-replay:

The main goal of anti-replay is to avoid hackers injecting or making changes in packets that travel from a source to a destination.

Is this commonly exploitable? How can I edit a packet and before sending it again over the web?

share|improve this question

closed as not constructive by Iszi, Gilles, AviD Nov 6 '12 at 17:23

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance.If this question can be reworded to fit the rules in the help center, please edit the question.

Welcome, anonymous. You probably want to read the FAQ as this question doesn't really fit. The answer is, unsurprisingly, "you use some software for editing packets" and that doesn't add much to the sum total of the site! Try rewriting it with a more specific and focussed question. – Graham Hill Nov 6 '12 at 10:35
up vote 0 down vote accepted

Yes, it is fairly commonly exploitable. The class of applications that can do it are called packet sniffers. They work because of the way a network works. While things have improved a lot as switches have gotten cheaper and become more standard, things like wireless networking make it harder.

The most common (non-governmental at least) attack of this type occurs on the user's end where information is sent in a way that other computers other than the intended recipient can see it, either by going through a non-switched hub (where the information is sent to all connected computers) or by sniffing a wifi network. The information can also be gathered at some degree of randomness by compromising a router used for internet routing or inserting a rogue router.

Real world examples of this include situations like one that happened a few years ago where a number of routers in China mysteriously started advertising they had fast routes available for major US traffic which resulted in a large amount of US traffic routing through China for a short period of time. This may have just been misconfigured hardware, or it could have been a MITM (man in the middle) attack.

The limitation of some of these techniques, particularly ones that are pure sniffing, is that they can not prevent the original message from getting to the intended recipient, so they are easily defeated (at least for hijacking purposes) by using an encrypted incrementing value to prevent reuse of a previous command. In other cases, such as a compromised router, it could be possible, within a short period of time, to replace the message on the line as long as the timeout isn't exceeded for the packet.

The idea for protecting against that kind of an attack is that it would be difficult to break the encryption on the connection sufficiently quickly to compromise the connection before the information contained in the packets being sniffed are irrelevant.

As far as unprotected traffic however, it is relatively simple, particularly on the client end, to sniff traffic and make modifications if the protocol being used is not resistant to tampering (such as SSL).

share|improve this answer
If you want to easily see what would be available if a packet sniffer was able to get at your traffic. Fiddler2 uses a similar technique by making a local proxy on your computer to let you see what your web browser traffic actually contains and includes a tool for altering your packets on the fly. Note that it isn't strictly a packet sniffer and will only relay information about your own connections. It can also demonstrate one of the possible attacks against SSL if the user can be socially engineered in to accepting an invalid certificate. – AJ Henderson Nov 6 '12 at 16:15

The classic tool for creating custom packets and sending them out is Nemesis. There are others, mostly designed for use on wireless networks - they're easier to sniff than most modern wired networks, so a more popular attack vector.

I like Ostinato, myself, as it is a bit more user friendly.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.