I have a web server running at example.com
. The web server performs a server-side request to example.com
which results in a loopback, so the request never passes over the network.
Is this request susceptible to a MITM attack? If so, how?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityThe problem is all in accessing the server and gaining a suitable privilege level.
update: and of course if you have such an access, you can probably take control directly of either the "server" or the "client", or both, or covertly access their same data unbeknownst to them. No need of a man in the middle if you're the man inside.
But say you have root there... then, yes, you can mount a MitM attack even if you can't use anything but the loopback interface for whatever reason, and cannot otherwise interfere with client's or server's operation.
All you need is lovecalhost duplicating its address to something useable, and telling the victim that example.com maps to that address.
Practical example using a service I have listening on localhost port 631 - cupsd. A webserver would listen on port 80, but everything else stays the same.
netstat -napo | grep LISTEN | grep -F 127.0.0.1
tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1321/cupsd off (0.00/0/0)
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 1721/named off (0.00/0/0)
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1721/named off (0.00/0/0)
Now I cannot listen straight away on the chosen port since there's a legitimate process already there:
# netcat -l 127.0.0.1 631 &
[1] 26264
netcat: Address already in use
[1]+ Exit 1 netcat -l 127.0.0.1 631
#
But nothing stops me from creating another loopback interface (lo:0 instead of lo) using aliasing...
# ifconfig lo:0 127.0.0.42
# ifconfig lo:0
lo:0 Link encap:Local Loopback
inet addr:127.0.0.42 Mask:255.0.0.0
UP LOOPBACK RUNNING MTU:65536 Metric:1
and telling the system that example.com
is indeed 127.0.0.42 by manipulating the hosts file (if the DNS had priority, I'd tweak its zone file)...
...and now I can listen (in this case to a single line)
# netcat -l 127.0.0.42 631 &
[1] 26442
and if I send that line, my listening netcat receives (and could reply):
# echo "Hello" | netcat 127.0.0.42 631
Hello
[1]+ Done netcat -l 127.0.0.42 631
#
Nothing has traveled outside the loopback interface (except that of course how am I inside that box if it has only a loopback interface?), and if the connection goes to "example.com", the server has no way of knowing the connection is being hijacked.
I could try and do this even without aliasing, but the required procedure would heavily disrupt communications and might not work always, or even at all, since I cannot easily prevent client and server from hearing one another.
(The aliasing I did here is just a proof of concept, and would probably cause havoc down the line - just consider I have now 127.0.0.1 and 127.0.0.42 on the same "trunk" and they both have /8 masking)
Assuming example.com
actually resolves back to the server, and not to a load-balancer, SSL terminator, or other piece of hardware, then no, there's no MITM as there's nothing to be in the middle of. If you can, using localhost
may be a better option to make sure the request always stays local, but that may not be possible if name-based vhosts are in use.
example.com
as either a hosts file entry or on an authoritative DNS server that is always queried directly (across a trusted network). Otherwise it may be possible for theexample.com
DNS record to be changed outside of your infrastructure.