1

We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?

  • and are you also wondering about MITM via traffic/packets? Is your question about whether using 127.0.0.1 will leak traffic to the network? – schroeder Nov 26 '15 at 17:29
  • I need to capture a packet and modify it. And then the one who gets the message must reject it because of the HMAC. Its an assignment on security. I have seen some tutorials but I cant find something about MITM on loopback – elenaa Nov 26 '15 at 17:31
  • I'd suggest not searching for MITM on loopback, but rather accessing packets on loopback. From there you will see what is possible in your situation. – schroeder Nov 26 '15 at 17:36
  • Thank you. After accessing packet (eg with Wireshark), I have to modify it. Is it ettercap good for this? And if yes is there a website I can see an example of it? And one last thing...is this considered mitm attack? – elenaa Nov 27 '15 at 13:49
4

Depending on how the programs know each other it might be possible.

Assuming you are running a server that only listens on 127.0.0.1 and a client that tries to connect to it. What port does the server listen on? What happens when the port is ocuppied? How does a client know it's a correct port?

Assuming that the port is not hardcoded in both server and client, but is somehow configured, one could setup a MITM on a different port and trick a client to connect to that modified port.

Poor man's example - assuming you have SSH server on your local box

socat TCP-LISTEN:1234 TCP:127.0.0.1:22

In the other console do

ssh 127.0.0.1 -p 1234

You'll see that you connect to your own SSH. Kill the socat in the first console and you see connection breaks. The socat is your MITM.

Edit: After you've specified your target (modifying a packet en-route and watching HMAC break it), I'd guess you'll need a second server, that normally only forwards packets from one socket to other, but after somehow notifying it (10% of the time, a specific file exists, a signal is received, 10s after startup...) it modifies the received packet before forwarding.

  • Actually there are two clients who have used the server only to exchange their digital certificates. After that they created a symmetrical key and now the clients communicate without the server. We no longer use the server. Can I capture a packet while these 2 communicate and modify it with MITM attack? Sorry i am new to security stuff. – elenaa Nov 26 '15 at 17:40
  • @elenaa For each of the client's it's the '1client to 1 server' scenario at time. So you could insert your MITM probe between any client and a server, or both clients and a server. Or you could follow schroeder's comment to your original post and look for a packet capture software. It might be easier than fully custom MITM proxy. – Torinthiel Nov 26 '15 at 17:44
  • actually, at first, i isolated one packet with wireshark and edit the timestamp with editcap. Is this "accepted" as attack of violation or anything? – elenaa Nov 26 '15 at 17:47
  • @elenaa Not really, unless the timestamp was part of the original packet (wireshark records the timestamp of packet when it captures it) and somehow reinjected the packet into the stream. AFAIK it's not possible with wireshark alone. – Torinthiel Nov 26 '15 at 18:06
  • After accessing packet (eg with Wireshark), I have to modify it. Is it ettercap good for this? And if yes is there a website I can see an example of it? And one last thing...is this considered mitm attack? – elenaa Nov 27 '15 at 13:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.