Let's say that an attacker is behind a proxy that's using NAT or PAT.
Is it possible for him to redirect victims to his machine to achieve some attacks like web phishing or opening reverse TCP connections?
-
Yes it's possible, if you use DNS spoofing and infect Hosts' files :D– user83026Commented Sep 20, 2015 at 9:54
-
do you mean DNS of attacker's proxy ? or the DNS of the victim ?– EiboCommented Sep 20, 2015 at 9:57
-
If you infect the victim's hosts' file, the victim will be redirected on your phishing website.– user83026Commented Sep 20, 2015 at 10:02
-
and assuming that "phishing website" is behind a proxy with a private IP, what do the attacker has to do ?– EiboCommented Sep 20, 2015 at 10:04
-
2If the "phishing website" is behind a proxy with a private IP, then the attacker would have to create a port-forwarding rule on his router to forward incoming traffic of port 80 or port 443 to the private IP that the web server is running on.– mti2935Commented Sep 20, 2015 at 10:47
|
Show 2 more comments
1 Answer
If the attacker is behind a NAT of some sort, then no it will not be possible to redirect the victim to a service hosted on the attacker host or establish a TCP connection from the victim directly to the attacker host.
Indeed, by default, NAT router only allow outgoing traffic and will block any incoming traffic. The external victim will not be able to contact your machine directly, but you will be able to contact the victim unless it is itself also behind a NAT router (which is the case for most end-user systems).
As the attacker, doing such thing will therefore require to change the NAT router setting to associate a listening port on the router to your own host (this would obviously require to have administration privilege on the NAT router). You could also use an external host as relay to bypass the NAT limitation, but then it would by far be easier to just host the phishing site directly on this external server.
answered Sep 22, 2015 at 9:27
