MITM - Revision history

Unknown user: /* What Are MITM Attacks */

2022-03-25T04:48:03Z

What Are MITM Attacks

← Older revision		Revision as of 04:48, 25 March 2022
Line 13:		Line 13:
	==What Are MITM Attacks==		==What Are MITM Attacks==

	A ~~man~~-in-the-middle attack is a general concept from encryption. It consists of two parties, Alice and Bob, trying to have an encrypted conversation. However, it is foiled by an attacker, Eve, who gets in the middle. This means that Alice and Eve communicate with one encryption key, while Bob and Eve communicate with another key.		A monkey-in-the-middle attack is a general concept from encryption. It consists of two parties, Alice and Bob, trying to have an encrypted conversation. However, it is foiled by an attacker, Eve, who gets in the middle. This means that Alice and Eve communicate with one encryption key, while Bob and Eve communicate with another key.

	==Important Parts==		==Important Parts==

Unknown user at 04:47, 25 March 2022

2022-03-25T04:47:50Z

← Older revision		Revision as of 04:47, 25 March 2022
Line 17:		Line 17:
	==Important Parts==		==Important Parts==

	Any ~~man~~ in the middle attack on a computer network must have the following four important pieces:		Any monkey in the middle attack on a computer network must have the following four important pieces:

	1. Recon		1. Recon

Unknown user at 20:36, 5 March 2022

2022-03-05T20:36:19Z

← Older revision		Revision as of 20:36, 5 March 2022
Line 31:		Line 31:
	==Layer 1 and Layer 2: Physical/Data Layer MITM Attacks==		==Layer 1 and Layer 2: Physical/Data Layer MITM Attacks==

	{{Main\|~~Monkey in the Middle~~/Layer 1 and 2}}		{{Main\|MITM/Layer 1 and 2}}

	MITM attacks at the physical level involve interference with a normal physical channel of communication. On a wireless network, this might be a wireless radio that an attacker uses to transmit radio signals at high power at a victim, thus swamping out another radio signal. It may be physical tampering with a connection - security professionals always prefer physical network taps when possible as a way to obtain a reliable ear on a network.		MITM attacks at the physical level involve interference with a normal physical channel of communication. On a wireless network, this might be a wireless radio that an attacker uses to transmit radio signals at high power at a victim, thus swamping out another radio signal. It may be physical tampering with a connection - security professionals always prefer physical network taps when possible as a way to obtain a reliable ear on a network.
Line 37:		Line 37:
	These types of attacks involve not just the first layer, but also several layers up - for example, the attacker must be able to establish a connection to the sheep, which involves implementing more than just Layer 1 of the network stack. However, the main MITM mechanism occurs at Layer 1.		These types of attacks involve not just the first layer, but also several layers up - for example, the attacker must be able to establish a connection to the sheep, which involves implementing more than just Layer 1 of the network stack. However, the main MITM mechanism occurs at Layer 1.

	Main page: [[~~Monkey in the Middle~~/Layer 1 and 2]]		Main page: [[MITM/Layer 1 and 2]]

	Evil twin attack: [[Evil Twin]]		Evil twin attack: [[Evil Twin]]
Line 43:		Line 43:
	==Layer 3 and Layer 4: Network and Transport MITM Attacks==		==Layer 3 and Layer 4: Network and Transport MITM Attacks==

	{{Main\|~~Monkey in the Middle~~/Layer 3 and 4}}		{{Main\|MITM/Layer 3 and 4}}

	This is Wall of Sheep territory - Layer 3 and 4 are the layers where the protocols governing network highways are implemented. Most MITM attacks at this layer consist of maliciously rerouting network traffic so that instead of the sheep talking directly to the gateway, all of the traffic first passes through an attacker.		This is Wall of Sheep territory - Layer 3 and 4 are the layers where the protocols governing network highways are implemented. Most MITM attacks at this layer consist of maliciously rerouting network traffic so that instead of the sheep talking directly to the gateway, all of the traffic first passes through an attacker.

Unknown user at 20:33, 5 March 2022

2022-03-05T20:33:06Z

← Older revision		Revision as of 20:33, 5 March 2022
Line 121:		Line 121:
	{{MITMFlag}}		{{MITMFlag}}

	~~[[Category:Monkey in the Middle]]~~
	[[Category:Wireless]]		[[Category:Wireless]]
	[[Category:Security]]		[[Category:Security]]

	[[Category:August 2016]]		[[Category:August 2016]]

Unknown user at 20:32, 5 March 2022

2022-03-05T20:32:25Z

← Older revision		Revision as of 20:32, 5 March 2022
Line 1:		Line 1:
	=~~Man~~ in the Middle Attacks=		=Monkey in the Middle Attacks=

	Welcome to the ~~Man~~ in the Middle (MITM) attacks page. This page will describe the many, many forms that a MITM attack may occur and the tools that are used to carry them out. It will also cover several laboratories, which cover specific, applied MITM scenarios.		Welcome to the Monkey in the Middle (MITM) attacks page. This page will describe the many, many forms that a MITM attack may occur and the tools that are used to carry them out. It will also cover several laboratories, which cover specific, applied MITM scenarios.

	The overarching way to think about these types of attacks is to use the 7-layer OSI model of networking:		The overarching way to think about these types of attacks is to use the 7-layer OSI model of networking:
Line 7:		Line 7:
	{{NetworkStack}}		{{NetworkStack}}

	~~Man~~ in the middle attacks can occur on Level 1 on up through Level 7, and at every level in between.		Monkey in the middle attacks can occur on Level 1 on up through Level 7, and at every level in between.

	Let's run through a few specifics about MITM attacks first, then talk about what attacks at different layers look like.		Let's run through a few specifics about MITM attacks first, then talk about what attacks at different layers look like.
Line 31:		Line 31:
	==Layer 1 and Layer 2: Physical/Data Layer MITM Attacks==		==Layer 1 and Layer 2: Physical/Data Layer MITM Attacks==

	{{Main\|~~Man~~ in the Middle/Layer 1 and 2}}		{{Main\|Monkey in the Middle/Layer 1 and 2}}

	MITM attacks at the physical level involve interference with a normal physical channel of communication. On a wireless network, this might be a wireless radio that an attacker uses to transmit radio signals at high power at a victim, thus swamping out another radio signal. It may be physical tampering with a connection - security professionals always prefer physical network taps when possible as a way to obtain a reliable ear on a network.		MITM attacks at the physical level involve interference with a normal physical channel of communication. On a wireless network, this might be a wireless radio that an attacker uses to transmit radio signals at high power at a victim, thus swamping out another radio signal. It may be physical tampering with a connection - security professionals always prefer physical network taps when possible as a way to obtain a reliable ear on a network.
Line 37:		Line 37:
	These types of attacks involve not just the first layer, but also several layers up - for example, the attacker must be able to establish a connection to the sheep, which involves implementing more than just Layer 1 of the network stack. However, the main MITM mechanism occurs at Layer 1.		These types of attacks involve not just the first layer, but also several layers up - for example, the attacker must be able to establish a connection to the sheep, which involves implementing more than just Layer 1 of the network stack. However, the main MITM mechanism occurs at Layer 1.

	Main page: [[~~Man~~ in the Middle/Layer 1 and 2]]		Main page: [[Monkey in the Middle/Layer 1 and 2]]

	Evil twin attack: [[Evil Twin]]		Evil twin attack: [[Evil Twin]]
Line 43:		Line 43:
	==Layer 3 and Layer 4: Network and Transport MITM Attacks==		==Layer 3 and Layer 4: Network and Transport MITM Attacks==

	{{Main\|~~Man~~ in the Middle/Layer 3 and 4}}		{{Main\|Monkey in the Middle/Layer 3 and 4}}

	This is Wall of Sheep territory - Layer 3 and 4 are the layers where the protocols governing network highways are implemented. Most MITM attacks at this layer consist of maliciously rerouting network traffic so that instead of the sheep talking directly to the gateway, all of the traffic first passes through an attacker.		This is Wall of Sheep territory - Layer 3 and 4 are the layers where the protocols governing network highways are implemented. Most MITM attacks at this layer consist of maliciously rerouting network traffic so that instead of the sheep talking directly to the gateway, all of the traffic first passes through an attacker.
Line 121:		Line 121:
	{{MITMFlag}}		{{MITMFlag}}

	[[Category:~~Man~~ in the Middle]]		[[Category:Monkey in the Middle]]
	[[Category:Wireless]]		[[Category:Wireless]]
	[[Category:Security]]		[[Category:Security]]

	[[Category:August 2016]]		[[Category:August 2016]]

Unknown user: Admin moved page Man in the Middle to MITM

2022-03-05T20:29:57Z

Admin moved page Man in the Middle to MITM

← Older revision	Revision as of 20:29, 5 March 2022
(No difference)

Unknown user: /* Analysis Tools */

2022-03-05T20:24:27Z

Analysis Tools

← Older revision		Revision as of 20:24, 5 March 2022
Line 109:		Line 109:
	[[Wireshark]]		[[Wireshark]]

	[[~~MITMf~~]] ~~- Python framework for MITM attacks~~		[[Tcpdump]]

	=Labs=		=Labs=

Unknown user: /* Software Tools */

2022-03-05T20:24:02Z

Software Tools

← Older revision		Revision as of 20:24, 5 March 2022
Line 83:		Line 83:
	=Software Tools=		=Software Tools=

	~~<s>[[Ettercap]]</s> nope! Use [[Bettercap]] instead~~		==Attack Tools==

	[[~~Dsniff]] {{,}} [[Arpspoof]] {{,}} [[Dnsspoof~~]]		[[Bettercap]] - very nice GUI tool for conducting MITM attacks

	[[~~Wireshark~~]]		[[Dsniff]] - password sniffer, but comes with a suite of many useful MITM tools:

			* [[Arpspoof]] - sending spoofed ARP responses to carry out MITM on local network
			* [[Dnsspoof]] - spoofing arbitrary DNS queries on local network
			* [[Macof]] - tool to flood a router with random MACs, polluting its CAM table

			For stripping the SSL layer from encrypted traffic:

			* [[SSLStrip]]
			* [[SSLSniff]]

			==Wireless Tools==

			Tools useful for wireless MITM attacks:

	[[Aircrack]]		* [[Aircrack]]
			* [[Karma]]

	~~[[SSLStrip]] {{,}} [[SSLSniff]]~~		==Analysis Tools==

	[[~~Karma~~]]		[[Wireshark]]

	[[MITMf]] - ~~Man in the Middle~~ framework ~~(Python)~~		[[MITMf]] - Python framework for MITM attacks

	=Labs=		=Labs=

Unknown user: /* Layer 6 and Layer 7: Presentation and Application MITM Attacks */

2022-03-05T19:08:52Z

Layer 6 and Layer 7: Presentation and Application MITM Attacks

← Older revision		Revision as of 19:08, 5 March 2022
Line 49:		Line 49:
	==Layer 6 and Layer 7: Presentation and Application MITM Attacks==		==Layer 6 and Layer 7: Presentation and Application MITM Attacks==

	You can use the [[Nishang]] tool to deliver malicious payloads (executables) onto a machine. One such payload is a MITM tool for eavesdropping on HTTPS sessions: [[Nishang/MITM Interceptor]]. ~~This executable, which~~ requires administrator permissions, generates its own ~~certificate~~ for each site, and installs ~~it onto~~ the ~~sheep's system~~. ~~The~~ HTTPS session ~~is thus MITMed~~, ~~but~~ the attack ~~is not~~ detected ~~by the sheep~~ because the ~~tool installs whatever certificate is required to verify the other site's identity~~.		You can use the [[Nishang]] tool to deliver malicious payloads (executables) onto a machine. One such payload is a MITM tool for eavesdropping on HTTPS sessions: [[Nishang/MITM Interceptor]].

			The Nishang MITM interceptor requires administrator permissions to install. It generates its own malicious certificates for each site, and installs the malicious certificates on the victim machine. This allows the interceptor to MITM each HTTPS session, and keeps the attack from being detected because the malicious certificates are trusted.

	This is an example of a presentation and application layer attack, as it occurs at the level of a system application's HTTPS certificate check. This tool manipulates the trust chain for that information.		This is an example of a presentation and application layer attack, as it occurs at the level of a system application's HTTPS certificate check. This tool manipulates the trust chain for that information.

Admin: /* Laboratories */

2017-09-06T02:13:31Z

Laboratories

← Older revision		Revision as of 02:13, 6 September 2017
Line 95:		Line 95:
	[[MITMf]] - Man in the Middle framework (Python)		[[MITMf]] - Man in the Middle framework (Python)

	=~~Laboratories~~=		=Labs=

	Wherein we run experiments applying MITM techniques to a sandbox network and observe the results.		Wherein we run experiments applying MITM techniques to a sandbox network and observe the results.