It's a question at computer security textbook

Assume that user A is about to use some website that requires login credentials. User A starts his web browser, types the website’s URL, and submits the URL request. The web server hosting the requested website responds and sends a page requesting login credentials. User A types then submits the required credentials. The Web browser sends the login credentials back to the web server as plain text (without encryption). why or why not it is possible for user B to obtain the login credentials submitted by user A if:

  • User A and User B on the same subnet (sub network).
  • User A and User B are not on the same subnet (sub network).
  • This security textbook is weird. The obvious answer to both questions would be: "YES, if B has hacked the server in question and can modify the source code of the website responsible for the page requesting login credentials and/or one that recieves it". – Mints97 May 2 '15 at 17:47
  • It is a classic question querying the techniques to be usually applied depending on your location compared to the target: same collision domain = sniffing, different collision domain but same network = arp spoofing, different network = trojan. If you already own the remote server, chances are that you do not even need to get user A password anymore... – WhiteWinterWolf May 2 '15 at 19:40

If user B is in same network, so he can use ARP poisoning for capturing the data that transfer from user A to the server. This type of attack called MITM ( man in the middle) attack. But if user B is not in the same network, the only way is that installs a backdoor or trojan on the computer of A.

Anothe way is that before that user A open web browser, user B change the dns setting of router that user A use it, and put malicious DNS in order to run DNS-based pharming attack.


Since user A types the URL himself, it means you cannot trick it to access a fake server of your own.

So, the main things that will matter here are:

  1. How can you spy on user A keyboard, system, or intercept the data exchanged between user A's browser and the server on the network,
  2. In the case of network data interception, will this data be in a readable form?
  • i think there are some applications and programs which analyse packets – Haredy May 2 '15 at 13:16
  • Would such programs have the same access to the packets in the two situations presented your question? – WhiteWinterWolf May 2 '15 at 13:22
  • 2
    And you're missing attacks on ARP and DNS, or just plain IP packet interception. – Steve Dodier-Lazaro May 2 '15 at 16:25
  • Maybe I'm wrong, but as far as school questions are concerned from a pedagogical point of view I find it more interesting to try to help the student to solve the issue by himself instead of just sending the raw answer he can forward it to his teacher, saving any searching and thinking effort. And you're missing the good ol' keylogger plugged in the back of the PC... – WhiteWinterWolf May 2 '15 at 17:17

User A and User B are not on the same subnet (sub network).

Attacks include DNS hijacking, DNS spoofing, or IP hijacking.

User A and User B on the same subnet (sub network).

As well as the previous attacks, possible attacks now include ARP poisoning, listening to the network on an adapter set to promiscuous mode or spoofing the IP address of the gateway.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.