0

Assume a Mam in the Middle that wants to redirect a client's HTTPS (Secure HTTPS) request from a.com to b.com. The MitM can not impersonate neither a.com nor b.com. The MitM does not have to use a TLS certificate to let the client encrypts the traffic for him/her, i.e. the MitM can not access the HTTPS encrypted traffic and does not have valid nor forged certificates.

For example, DNS spoofing is something related, where the attacks can trick the user into requesting/opening b.com while the client actually want a.com

My Question: Can the MitM changes the client's HTTP request headers at leasure to order b.com instead of a.com without having to use faked TLS certificate with the client?

Improve this question

1 Answer 1

Reset to default
2

There are a few options:

  1. DNS record

    If the attacker changes the DNS record (which is still often completely insecure) than they can convince the client a.com is at the IP address of b.com. However, because the client is expecting to be connected to a.com and the certificate will likely be for b.com, the client will get invalid certificate error. However, if lets say we redirect from a.google.com to b.google.com and the certificate is for *.google.com, then this attack may work.

  2. MITM Redirect

    You can just intercept the traffic and send it to the IP of b.com without changing the DNS records. The result is the same as in 1.

  3. HTML Redirect

    You can try to redirect a person from a.com to b.com using for example javascript or 303 redirect, but if HTTPS is being used to connect to a.com, you won't be able to do this without compromising a.com. This however does not necessarily require their certificate. Being able to do XSS attack may be enough.

In conclusion, HTTPS protects HTTP headers as well and the client knows what website it is trying to connect to, so it is not possible to do the redirect just with pure MITM.

Improve this answer
8
  • HTTPS is only in the server. The client request does not use a certificate. Doesn't this mean that the MitM can alter the client's request from a.com to b.com? It only remain for the faked server to prove that it is b.com. But let's assume this is doable. Can a MitM alter the clinet's headers to request b.com instead of a.com?
    – user9371654
    Commented Apr 29, 2019 at 17:56
  • @user9371654 No. Before any HTTP request is sent a TLS tunnel is established. This means that any HTTP request sent is already secure. Also note that as part of this TLS tunnel creation, the server sends a certificate. If the certificate does not match the site the client was trying to connect to, it will abort immediately.
    – Peter Harmann
    Commented Apr 29, 2019 at 17:59
  • Thanks. In my case the user is assumed to request the a.com using https. But the attacker can direct him to http or https b.com. The attacker does not need to be able to decrypt. The only goal is redirect the client from a.com to http://b.com or https://b.com. You can ignore the certificate validation and assume the client will accept b.com certificate. My Question: does the DNS spoofing work if the client's request is HTTPS??
    – user9371654
    Commented Apr 29, 2019 at 19:16
  • Does MITM redirect and DNS record (1 amd 2) in your answer work even if the client's request is over HTTPS?
    – user9371654
    Commented Apr 29, 2019 at 19:17
  • @user9371654 as I wrote. You can redirect the request. However the site you redirect to (b.com) will need to have a certificate valid for a.com, otherwise the client will notice he is on the wrong site and get an error. Also if b.com is not your site, it may notice the request was not meant for it and just drop it/display a 404 error or it may not. Depends on the server settings.
    – Peter Harmann
    Commented Apr 29, 2019 at 22:10

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .