In this lesson,
we're going to very briefly cover the concept
of an on-path attack.
Now, an on-path attack is an attack
where the penetration tester is able
to put their workstation logically between two hosts
during the communication in order to transparently capture,
monitor, and relay the communications between those hosts.
By placing themselves in the path between the client
and the server, the attacker can intercept
the authorization packets being sent and received
and then use those to take over the authorized session
between the client and the server.
Now, there are many different ways of conducting an on-path
or interception attack, including ARP poisoning,
DNS poisoning, introducing a rogue Wireless Access Point,
or introducing a rogue hub or switch.
Once an on-path or interception attack has begun,
you can then decide to replay or relay the attack.
Replay of the data occurs when valid data is captured
by the attacker and is then repeated immediately
or is delayed and then repeated.
Replay is a common technique in wireless network attacks,
but it can also be used in wired networks, too.
For example, if we can capture an authentication handshake
between two hosts, we can then replay it
to the authentication server so that it will think
we are an authenticated client, too,
and give us access to the network or its resources.
Relay, on the other hand, occurs when an attacker
is able to become a part of the conversation
by inserting themself in between the two hosts.
In this case, the attacker essentially becomes a proxy
between two hosts, and they can read
or modify any communications between them.
When this occurs, anytime the client tries to get
to the server, it is instead going from the client
to the attacker and from the attacker to the server.
From this position, we can capture everything
that's being sent between them, including the usernames,
passwords, and even bank balances.
We can even change the data if we so desire.
Remember, relay involves getting the information
and then passing it on, or you can intercept it, change it,
and then pass it on.
The big challenge though, with replay and relay occurs
when encryption is enforced by the host.
If the server, for example,
is using a strong encryption scheme like TLS 1.3,
it's going to be very difficult
or even impossible for us to intercept
and craft the communication between these two hosts.
To try and overcome this encryption,
a technique known as SSL stripping was created.
Since a lot of websites use SSL
and TLS as a way to encrypt data
between the client and the server,
we can attempt to attack this
by tricking the encryption application into presenting
the user with an HTTP connection instead
of an HTTPS connection.
For instance, let's say you go to facebook.com using HTTPS,
but an attacker is able to redirect
or downgrade the request
to use the regular HTTP connection instead.
This would be considered SSL stripping,
because now there is no encryption being used
in that connection, and we can then capture
all the data and read it.
Now, if SSL stripping isn't possible, then we can attempt
to perform a downgrade attack instead.
In a downgrade attack, the attacker attempts
to have a client or server abandon its higher security mode
in favor of a lower security mode.
For example, if the client tries to connect to a server
and negotiate a higher level of encryption, like TLS 1.2
or 1.3, but they're connected
through an intermediary attacker
who's in an on-path position,
that attacker may allow encryption to occur
so they'll see that little lock in their web browser,
but only at a lower level, such as using SSL 2.0,
which is much easier for the attacker to crack.
So, that way the attacker can remain in the middle
of the communications between the client and server
and see everything that's going on.
Now, it's important to mention
that downgrade attacks don't only affect SSL and TLS though.
It can actually be used with any kind
of encryption or protection such as Wi-Fi, VPNs, and others.
Anytime we have a client negotiate to a lower level
of security, that is still technically backwards compatible
with that higher level,
this is considered a downgrade attack.