Intercept and modify simple TCP session?

Question

Say there's a simple socket-based server/client chat app like these. How is it possible for me to intercept whatever they are chatting and modify it? I've been looking around for MitM which requires ARP poisoning, which is not applicable for my exercise.

Another thing is TCP session hijacking but I don't understand how it works. Can anyone give me small idea, or maybe good links where I could learn some, or maybe some python code (preferably on GitHub)?

I don't have trouble learning, Or maybe some open source tool that can do this, I just don't want to be a script-kiddie.

Answer 1

TCP Session Hijacking

Let's imagine a client communicating with a server over a network connection. The client has authenticated with the server and has been granted access. So far, so good.

An attacker is on the network between the client and server, and has been keeping an eye on their session. This has given him time to learn the port and sequence numbers needed for the conversation to take place. Because he knows the sequence numbers, he can anticipate the numbers in subsequent packets (see: TCP sequence prediction attack). This is when the attacker decides to intervene.

He paralyzes the client by launching an ICMP flood, ensuring that the client cannot respond to the traffic sent by the server. This allows the attacker freedom to communicate with the server as though he were the client. Because the client is paralyzed and the server has sent out a response, the attacker gets to it first, forges a packet that appears native to the established stream, and the server is none-the-wiser.

Here is a figure to help you understand the role sequence numbers play in the protocol and how an attacker can take advantage of it:

Source: https://www.cs.umd.edu/~shankar/417-F01/Slides/chapter3b/sld003.htm

This is the best I can do, for now. I haven't been able to locate any Python code or open source tools that can do this sort of thing.

Answer 2

I think the best example for TCP session hijacking is the attack from Kevin Mitnick, which is explained very well on this page. The idea is that you guess the sequence number of a packet. However, nowadays this attack is not practical because most operating systems randomize this number, making it hard to predict.

For Man-in-the-Middle attacks on the other hand, you have a wide range of options. First you need to get in between the two nodes. This can be really simple when you own one of the nodes that route their traffic, like a wireless access point. But you can also use attacks like ARP spoofing you mentioned. Other routing protocols also allow such behaviour, like BGP. Then there are more indirect attacks like DNS cache poisoning.

Once you are in control of the data traffic, you can passively sniff the traffic. I think you'll find scapy a nice Python module for things like this. It's quite powerful and can be used for all kinds of networking attacks.

Other passive sniffing can be done with libpcap. pcapy is a Python module that interfaces with this library. You can also just use Wireshark if you want a quick peek at the traffic.

Modifying traffic between nodes is harder. One way to do this is to route all traffic to a certain port. For the chat app example, let's say you route incoming traffic from port 12221 to localhost:1337 using iptables. Now you run a server on port 1337 that captures all this traffic, sniffs the packets, modifies them and sends them through to port 12221 to the correct host.

If you want to practice looking at traffic from another device, you can install a tool like Burp and set a proxy on a device like your phone. You'll see your HTTP traffic and you'll be able to modify it. But with TLS (HTTPS) websites you'll get a certificate warning, because these tools generate a fake TLS-certificate on-the-fly. If you want to get deeper into this, I recommend mitmproxy, because it's open source and has a nice Python API. Also, you can check out bettercap.