Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

If a site uses https and transfers the customers credit card and ID in the url. Will an attacker be able to intercept those through a MITM attack? And through Sniffing.?

Can the packets be sniffed somehow to see the links?

share|improve this question

2 Answers 2

up vote 3 down vote accepted

If the Man-in-the-Middle attack succeeds, then, by definition, the attacker sees everything: success here being that the attacker impersonates both the client and the server, so the client talks to the attacker, the server talks to the attacker, the attacker decrypts on one side and reencrypts on the other. With a successful MitM, the attacker can see the links, the page contents, the passwords...

But, of course, SSL has been designed to defeat MitM attacks. The main protection is the server's certificate. To succeed at MitM, the attacker must create a fake certificate with the server's name, but containing a public key that the attacker controls. The whole point of trusted root CA and certificate validation is so that the client does not get fooled by a fake server certificate.

(If the human users sees the scary warning from his browser "this server uses an untrusted certificate" and still clicks on the "I don't care, connect anyway !" button, then the MitM succeeds. Security against MitM in SSL relies on the idea that the human user does not do anything stupid such as disregarding that kind of warning.)

Edit: as for what can be inferred from passive sniffing, then this does not include the requested URL per se; however, a few things can be inferred:

  • The intended server name (the "host name" part of the URL) will be known to the attacker. Modern browsers show it in cleartext as part of the Server Name Indication extension. The name also appears in the server's certificate, which is sent as cleartext as well.

  • Encryption hides data contents, but not data length. The attacker can then infer the length of the URL, especially if he gets to observe several encrypted requests.

  • Since lengths leak, the attacker can more or less see how many elements are downloaded by the client and their respective lengths, e.g. linked pictures. Depending on the site structure and whether the attacker can also browse the same site (as, e.g., another user), then he may figure out with great precision what the target user is actually browsing.

share|improve this answer
    
Tom, I meant sniffing too. In successful MITM, of course, he will be able to see all the traffic passing through.. But I thought also if you can sniff the traffic you could see the Urls... But this is a false statement, by what Lucas's answer says –  Kratos Oct 31 '13 at 13:09
    
In 2009, it was shown that a fake certificate can be given, which prevents the browser from showing any error. The CA certificate lookup, is vulnerable to this symbol \00. You could register subdomains and then use the null byte in the right place to by pass the browsers warning message from appearing –  Kratos Oct 31 '13 at 13:11
    
Well, when there is a bug in certificate validation, this can be turned into an exploit... which does not contradict the idea that certificate validation, properly implemented, prevents a MitM. –  Tom Leek Oct 31 '13 at 13:12
    
As for what can be obtained through sniffing, see my edit. –  Tom Leek Oct 31 '13 at 13:17
    
Passive sniffing can also be used to see the contents of the encrypted traffic if the key is weak enough and the motivation/capability to brute-force is high enough. –  Ladadadada Oct 31 '13 at 14:03

No because an encrypted tunnel is setup before any messages (including GET/POST requests) are sent across the link.

share|improve this answer
    
Thanks. So it is not possible from sniffing..? But are the links stored in the routing table..or are there only addresses cached –  Kratos Oct 31 '13 at 13:11
    
Links are never cached in a routing table, HTTP happens at layer 7 whereas routing tables occur at layer 3 of the OSI model. –  Lucas Kauffman Oct 31 '13 at 13:13
    
Very true.......... –  Kratos Oct 31 '13 at 13:20

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.