We made a client/server program that runs at localhost. Is it possible to execute a man in the middle attack on the loopback between the client and server?
-
and are you also wondering about MITM via traffic/packets? Is your question about whether using 127.0.0.1 will leak traffic to the network?– schroeder ♦Commented Nov 26, 2015 at 17:29
-
I need to capture a packet and modify it. And then the one who gets the message must reject it because of the HMAC. Its an assignment on security. I have seen some tutorials but I cant find something about MITM on loopback– elliCommented Nov 26, 2015 at 17:31
-
I'd suggest not searching for MITM on loopback, but rather accessing packets on loopback. From there you will see what is possible in your situation.– schroeder ♦Commented Nov 26, 2015 at 17:36
-
Thank you. After accessing packet (eg with Wireshark), I have to modify it. Is it ettercap good for this? And if yes is there a website I can see an example of it? And one last thing...is this considered mitm attack?– elliCommented Nov 27, 2015 at 13:49
Add a comment
|
1 Answer
Depending on how the programs know each other it might be possible.
Assuming you are running a server that only listens on 127.0.0.1 and a client that tries to connect to it. What port does the server listen on? What happens when the port is ocuppied? How does a client know it's a correct port?
Assuming that the port is not hardcoded in both server and client, but is somehow configured, one could setup a MITM on a different port and trick a client to connect to that modified port.
Poor man's example - assuming you have SSH server on your local box
socat TCP-LISTEN:1234 TCP:127.0.0.1:22
In the other console do
ssh 127.0.0.1 -p 1234
You'll see that you connect to your own SSH. Kill the socat in the first console and you see connection breaks. The socat is your MITM.
Edit: After you've specified your target (modifying a packet en-route and watching HMAC break it), I'd guess you'll need a second server, that normally only forwards packets from one socket to other, but after somehow notifying it (10% of the time, a specific file exists, a signal is received, 10s after startup...) it modifies the received packet before forwarding.
-
Actually there are two clients who have used the server only to exchange their digital certificates. After that they created a symmetrical key and now the clients communicate without the server. We no longer use the server. Can I capture a packet while these 2 communicate and modify it with MITM attack? Sorry i am new to security stuff.– elliCommented Nov 26, 2015 at 17:40
-
@elenaa For each of the client's it's the '1client to 1 server' scenario at time. So you could insert your MITM probe between any client and a server, or both clients and a server. Or you could follow schroeder's comment to your original post and look for a packet capture software. It might be easier than fully custom MITM proxy. Commented Nov 26, 2015 at 17:44
-
actually, at first, i isolated one packet with wireshark and edit the timestamp with editcap. Is this "accepted" as attack of violation or anything?– elliCommented Nov 26, 2015 at 17:47
-
@elenaa Not really, unless the timestamp was part of the original packet (wireshark records the timestamp of packet when it captures it) and somehow reinjected the packet into the stream. AFAIK it's not possible with wireshark alone. Commented Nov 26, 2015 at 18:06
-
After accessing packet (eg with Wireshark), I have to modify it. Is it ettercap good for this? And if yes is there a website I can see an example of it? And one last thing...is this considered mitm attack?– elliCommented Nov 27, 2015 at 13:54