1

I have noticed a large amount of server-side HTTP client libraries accept untrusted TLS communication by default.

What are obvious attack vectors for MITMing a server-to-server HTTPS communication that accepts untrusted SSL certs?

Eg, DNS cache poisoning could be used to replace the real endpoint with an attacker's replacement that uses a self-signed cert.

As @steffen-ullrich mentioned, someone could rent a server in the same datacenter and try ARP spoofing.

Are there others?

  • You can also try HTTPS stripping... some sites do not force a https connection, though some do try to "suggest it", by arp injecting someones machine (as you would need to on most MitM attacks) you can route their traffic via your self and redirect all 443 traffic to port 80, thus not encrypting the traffic and it being readable, this is perhaps the easiest of the lot. if this keeps within the scope of your question. if you are interested in keeping genuine certificates for the website without needed to spoof you can also create a proxy server. – TheHidden Feb 24 '16 at 11:11
1

Some vectors would include:

  • IP hijacking
  • ARP spoofing at the ISP where the requesting server is located
  • DNS poisoning
  • Any attack at the remote endpoint where the server is substituted, from ARP spoofing and private routing attacks all the way to physical replacement of the server

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.