1
  1. Client A is connected to the public internet.
  2. Client B gateway address is connected to the Client A's network interface.
  3. Client B is running a Web browser which is sending requests to 127.0.0.1:1234 HTTP Proxy, which encrypts and sends the packets ahead to Client A's machine then to -> ISP -> Public Internet.

By what means could it be possible for Client A's machine to sniff or intercept the unencrypted<>decrypted packets between Client B's web browser and the HTTP proxy on 0.0.0.0:1234? Means such as firewall turned off on B, open ports on B, attaching a listener, promiscuous mode, DHCP, or any kind of poisoning, or any other way?

How can this be done?

2 Answers 2

1

Client B is running a Web browser which is sending requests to 127.0.0.1:1234 HTTP Proxy,

127.0.0.1 is the loopback address. In this case client and server are on the same machine - no ARP lookups needed. The IP of the proxy is given, so no DNS lookups needed too. Everything is self-contained on the local machine. This means no other machine on the network can do some network level stuff (ARP poisoning, DNS spoofing ...) in order to sniff, modify or redirect the traffic between the web browser and the proxy on loopback.

0

In this scenario, there is no way (which is probably the reason behind this choice of infrastructure).

The simplest way to proceed would be to replace Client B's proxy with a normal (non-encrypting) HTTP proxy listening on port 1234 and forwarding it to Client B's encrypting proxy mounted on Client A and listening on port 1234. The remote endpoint will see a properly encrypted connection as before, the browser on Client B will see a proxy as before, and no one is the wiser - except that now Client A can intercept the cleartext traffic on its own port 1234.

The above, of course, absolutely requires access to Client B in order to replace the proxy. Several other things might change on Client B that would warn them of the replacement (the proxy application icon changing on some OSes, signature integrity being broken, application activation sequence changed, and so on).

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .