In this lesson, we're going to very briefly
cover the concept of an on-path attack.
Now, an on-path attack is an attack
where the penetration tester
is able to put their workstation logically
between two hosts during the communication
in order to transparently capture, monitor,
and relay the communications between those hosts.
By placing themselves in the path
between the client and the server,
the attacker can intercept the authorization packets
being sent and received
and then use those to take over the authorized session
between the client and the server.
Now, there are many different ways of conducting
an on-path or interception attack,
including ARP poisoning, DNS poisoning,
introducing a rogue wireless access point,
or introducing a rogue hover switch.
Once an on-path or interception attack has begun,
you can then decide to replay or relay the attack.
Replay of the data occurs when valid data
is captured by the attacker
and is then repeated immediately
or is delayed and then repeated.
Replay is a common technique in wireless network attacks,
but it can also be used in wired networks too.
For example, if we can capture
an authentication handshake between two hosts,
we can then replay it to the authentication server
so that it will think we are an authenticated client too
and give us access to the network or its resources.
Relay, on the other hand occurs when an attacker
is able to become a part of the conversation
by inserting themself in between the two hosts.
In this case, the attacker essentially becomes
a proxy between two hosts,
and they can read or modify any communications between them.
When this occurs,
anytime the client tries to get to the server,
it is instead going from the client to the attacker,
and from the attacker to the server.
From this position, we can capture everything
that's being sent between them
including the usernames, passwords, and even bank balances.
We can even change the data if we so desire.
Remember, relay involves getting the information
and then passing it on,
or you can intercept it, change it, and then pass it on.
The big challenge though with replay and relay
occurs when encryption is enforced by the host.
If the server, for example
is using a strong encryption scheme like TLS 1.3,
it's going to be very difficult
or even impossible for us to intercept
and craft the communication between these two hosts.
To try and overcome this encryption,
a technique known as SSL stripping was created.
Since a lot of websites use SSL and TLS
as a way to encrypt data between the client and the server,
we can attempt to attack this
by tricking the encryption application
into presenting the user with an HTTP connection
instead of an HTTPS connection.
For instance, let's say you go to facebook.com using HTTPS,
but an attacker was able
to redirect or downgrade the request
to use the regular HTTP connection instead.
This would be considered SSL stripping,
because now there is no encryption
being used in that connection,
and we can then capture all the data and read it.
Now, if SSL stripping is impossible,
then we can attempt to perform a downgrade attack instead.
In a downgrade attack, the attacker attempts
to have a client or server abandon its higher security mode
in favor of a lower security mode.
For example, if the client tries to connect to a server
and negotiate a higher level of encryption
like TLS 1.2 or 1.3,
but they're connected through an intermediary attacker
who's in an on-path position,
that attacker may allow encryption to occur,
so they'll see that little lock in their web browser
but only at a lower level, such as using SSL 2.0,
which is much easier for the attacker to crack.
So that way the attacker can remain
in the middle of the communications
between the client and server
and see everything that's going on.
Now, it's important to mention
that downgrade attacks don't only affect SSL and TLS though,
it can actually be used with any kind of encryption
or protection such as wifi, VPNs, and others.
Anytime we have a client negotiate
to a lower level of security
that is still technically backwards compatible
with that higher level,
this is considered a downgrade attack