0

Let's assume I have a strong enough antenna at exactly the same frequency as the victim. If it sends a request over unprotected http to the router, could I then listen to that request and respond to it before the router does? Would I need the MAC address of the victim too?

  • 2
    What kind of wireless connection, do you mean Wi-Fi? – Luc Jun 16 at 12:11
  • look at ettercap / bettercap, watch some youtube videos on that. if you are connected to the wifi its a simple way to ARP / DNS poison / etc etc this sounds like what you are trying to do. personally I would go the DNS poison route on a wifi network to redirect to a server a control. – TheHidden Jul 16 at 16:03
0

HTTP does not protect against this whatsoever. So that question is then pushed down to the type of wireless connection.

For example a private wifi uses a shared secret (password). If you don't know this password, you should not be able to neither read, nor change/respond. (Though vulnerabilities in wifi are not that uncommon).

If the wifi is enterprise, you would not be able to do this even if you had login credentials, unless you had the private key of the router.

If it is an open wifi, then yes, you should be able to do it quite easily.

And of course, there are meny other possible connections and other factors. For example a VPN would prevent this, IPsec or IPv6 encryption would prevent this etc. You need to be able to break or bypass all levels of security to intercept the connection. HTTPS is only the one that is always talked about, because it is the most encompassing, available and reliable of them.

  • 1
    But with open wifi, it's still not as easy as just intercepting the radio signal. You need to participate in the wifi network. That's trivial to do, but it's not at the signal level. That's not obvious in your answer. I think you might need a line explaining that you have to join the network. – schroeder Jun 16 at 15:18
  • @schroeder yes there are, but the question concerned HTTP, did not mention wifi, so I did not want to go into details. Especially if the details would not be enough to pull off the attack and did not help with preventing/risk asses it either. It just did not seem relevant. Do you think I should add it anyway? – Peter Harmann Jun 16 at 18:21
  • Let's say I have the password and am already connected. So it's possible? – MrSomeone Jun 16 at 21:29
  • 1
    @MrSomeone there are some hurdles. You may need to intercept the wifi handshake when a user connects. But in principle yes, it can be done with just little extra preparation. – Peter Harmann Jun 17 at 13:56
0

You can set up your own compromised AP that poses as the original AP, often called Evil Twin. If you can make the victim connect to yours instead of the real one, maybe by DoS'ing the legitimate access point (AP), then you will have control over any traffic the victim produces. You can see this in action in this video by hak5.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.