I have a web server running at
example.com. The web server performs a server-side request to
example.com which results in a loopback, so the request never passes over the network.
Is this request susceptible to a MITM attack? If so, how?
The problem is all in accessing the server and gaining a suitable privilege level.
update: and of course if you have such an access, you can probably take control directly of either the "server" or the "client", or both, or covertly access their same data unbeknownst to them. No need of a man in the middle if you're the man inside.
But say you have root there... then, yes, you can mount a MitM attack even if you can't use anything but the loopback interface for whatever reason, and cannot otherwise interfere with client's or server's operation.
All you need is lo
vecalhost duplicating its address to something useable, and telling the victim that example.com maps to that address.
Practical example using a service I have listening on localhost port 631 - cupsd. A webserver would listen on port 80, but everything else stays the same.
netstat -napo | grep LISTEN | grep -F 127.0.0.1 tcp 0 0 127.0.0.1:631 0.0.0.0:* LISTEN 1321/cupsd off (0.00/0/0) tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 1721/named off (0.00/0/0) tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 1721/named off (0.00/0/0)
Now I cannot listen straight away on the chosen port since there's a legitimate process already there:
# netcat -l 127.0.0.1 631 &  26264 netcat: Address already in use + Exit 1 netcat -l 127.0.0.1 631 #
But nothing stops me from creating another loopback interface (lo:0 instead of lo) using aliasing...
# ifconfig lo:0 127.0.0.42 # ifconfig lo:0 lo:0 Link encap:Local Loopback inet addr:127.0.0.42 Mask:255.0.0.0 UP LOOPBACK RUNNING MTU:65536 Metric:1
and telling the system that
example.com is indeed 127.0.0.42 by manipulating the hosts file (if the DNS had priority, I'd tweak its zone file)...
...and now I can listen (in this case to a single line)
# netcat -l 127.0.0.42 631 &  26442
and if I send that line, my listening netcat receives (and could reply):
# echo "Hello" | netcat 127.0.0.42 631 Hello + Done netcat -l 127.0.0.42 631 #
Nothing has traveled outside the loopback interface (except that of course how am I inside that box if it has only a loopback interface?), and if the connection goes to "example.com", the server has no way of knowing the connection is being hijacked.
I could try and do this even without aliasing, but the required procedure would heavily disrupt communications and might not work always, or even at all, since I cannot easily prevent client and server from hearing one another.
(The aliasing I did here is just a proof of concept, and would probably cause havoc down the line - just consider I have now 127.0.0.1 and 127.0.0.42 on the same "trunk" and they both have /8 masking)
example.com actually resolves back to the server, and not to a load-balancer, SSL terminator, or other piece of hardware, then no, there's no MITM as there's nothing to be in the middle of. If you can, using
localhost may be a better option to make sure the request always stays local, but that may not be possible if name-based vhosts are in use.