Admin: Create Layer 6 (Presentation) Attacks page (via create-page on MediaWiki MCP Server)

2026-06-19T05:53:53Z

Create Layer 6 (Presentation) Attacks page (via create-page on MediaWiki MCP Server)

New page

=Presentation (Layer 6) Attacks=

This page covers the use of Kali to carry out attacks on layer 6, the presentation layer. Also see [[Kali/Workflow]].

==Review==

Let's review the network stack before we launch into network layer attacks.

{{NetworkStack}}

Layer 6 is the Presentation layer. It handles data representation and formatting, including character encoding, data compression, and encryption/decryption.

==Scenario==

The presentation layer is where data is transformed into a format that the application layer can understand. This includes SSL/TLS encryption and decryption, character encoding conversions, and data compression. Attacks at this layer typically focus on manipulating how data is represented, encrypted, or encoded.

Unlike lower-layer attacks that require physical proximity or network access, presentation-layer attacks can often be carried out remotely, since they target the way data is formatted before it reaches the application.

==SSL/TLS Downgrade Attacks==

{{Main|SSLStrip}}

While SSL/TLS straddles multiple layers, the encryption/decryption function is squarely a presentation-layer concern. [[SSLStrip]] is a tool that performs an SSL downgrade attack, forcing HTTPS connections to fall back to HTTP. This allows an attacker to read traffic in cleartext that would otherwise be encrypted.

==SSL/TLS Cipher Attacks==

{{Main|MITM/HTTPS}}

Tools like [[Sslscan]] and [[Testssl.sh]] can probe a server's supported ciphers, identifying weak or deprecated ciphers that can be exploited. The attacker may force the server to negotiate a weaker cipher suite (a downgrade attack at the cipher level), making encrypted traffic easier to crack. This is a presentation-layer attack because it targets the encryption algorithm negotiation that occurs during the TLS handshake.

==Certificate Attacks==

{{Main|Certificates}}
{{Main|SSLSniff}}

The X.509 certificate system, part of the presentation layer's encryption framework, can be attacked in several ways. [[SSLSniff]] allows an attacker to serve up fake certificates to sheep during a man-in-the-middle attack. Self-signed certificates or certificates from compromised certificate authorities can be presented to a sheep, who may not verify them properly.

See [[Certificates]] for more detail on forging and manipulating certificates.

==Encoding Attacks==

Because the presentation layer handles character encoding, attacks can target encoding conversions. Double-encoding attacks, Unicode normalization attacks, and overlong UTF-8 sequences can be used to bypass security filters at higher layers. These attacks exploit the fact that the presentation layer may interpret encoded data differently than the application layer expects.

For example, a web application firewall might reject <code>../</code> in a URL, but the presentation layer might first decode <code>%2e%2e%2f</code> into <code>../</code> — and if the WAF checks before decoding occurs, the traversal passes through.

==Format String Attacks==

Format string vulnerabilities occur when a program uses user-controlled input as a format string in functions like <code>printf()</code>. This is a presentation-layer concern because format strings control how data is represented when displayed or processed. Tools like [[GDB]] and the [[MSF|Metasploit Framework]] can be used to develop format string exploits.

==Compression Side-Channel Attacks==

Attacks like CRIME (Compression Ratio Info-leak Made Easy) and BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) exploit data compression in HTTPS to leak encrypted session cookies. These attacks work at the presentation layer because compression and decompression are presentation-layer functions. By injecting controlled plaintext into a compressed HTTPS stream and measuring the resulting size, an attacker can infer the value of secret tokens like session cookies.

=Flags=

{{KaliAttackLayersFlag}}

Kali/Layer 6 Attacks - Revision history

Admin: Create Layer 6 (Presentation) Attacks page (via create-page on MediaWiki MCP Server)