International Journal of Pure and Applied Mathematics Volume 119 No. 12 2018, 1187-1195 ISSN: 1314-3395 (on-line version) url: http://www.ijpam.eu Special Issue ijpam.eu Sniffing HTTPS Traffic in LAN by Address Resolution Protocol Poisoning Nagendran.K1, Adithyan.A1, Balaji.S1, S.Balakrishnan1 1Department of Information Technology, Sri Krishna College of Engineering and Technology, Coimbatore, India. Abstract Cyber Security has become an inevitable factor in today’s era. Hacking & cracking attempts lifted to an unimaginable levels and securing ourselves and our surroundings from them is our prime responsibility. Today’s cyber world is full of network and web application attacks. Lot of security researchers are working day and night to find zero days and to secure their network black hat Hackers. This paper in details describes about a type of attack performed on your local network and how to prevent from them. Keywords: ARP Poisoning, Network Security, Hacking, DNS Spoofing, Ettercap, Burpsuite. 1. Introduction 1187 International Journal of Pure and Applied Mathematics Special Issue Men In the Middle (MITM) is an attack carried out by the intruder who intercepts the Network Traffic for hacking credentials. But the intruder can only capture HTTP traffic since HTTPS traffic has SSL certificate as an extra pattern of security. Capturing HTTP traffic can be done easily with tools like Wireshark which displays all the inbound and outbound network traffic in form of packets. This Paper in detail describes about how an attacker can sniff the SSL traffic on his Local Network using Address Resolution Protocol (ARP) poisoning. 2. Literature Review MV Tripunitara and P Dutta (1999) made a middleware approach to asynchronous and backward compatible detection and prevention of ARP Cache Poisoning. Goyal and Rohit Tripathy (2005) presented an efficient cryptographic technique to secure against ARP Spoofing. It’s a well-known fact that ARP is a stateless protocol. That is, it can go on changing the Mac address in the ARP table based on the latest received ARP reply. Zouheir Trabelsi and Wassim El-Hajj (2007) changed this and implemented a prototype of Stateful and Secure ARP Cache. Wesam Lootah, William Enck, Patrick McDaniel (2007) introduced an Ticket based Address Resolution Protocol as an alternative for ARP. CL Abad and RI Bonilla (2007) made an analysis on the schemes for detection and preventing ARP Cache Poisoning attacks. SY Nam and D Kim (2010) proposed an enhanced ARP poisoning prevention method based on Man-In-Middle-Attacks. A Packet Based Technique has been proposed by P Pandey (2013) for the Prevention of ARP Spoofing. 3. Description All the servers mostly have an SSL certificate installed in them for security purposes. In general, these SSL certificates provide an additional layer of security by encrypting the communication between server and end user. But intruders can use some specialized attack vectors to perform attacks and steal data even on SSL enabled websites. Most common method to bypass SSL mechanism is SSL strip. An Attacker uses SSL strip on victim to downgrade him from HTTPS to HTTP which is insecure. In SSL strip attack, the attacker impersonates as a proxy server and receives all HTTPS (encrypted) request from the Victim’s browser and forwards them to the server. The server responds the proxy server (Attacker) with a HTTPS response. Now, the attacker changes the HTTPS to HTTP and forwards the response to the Victim. Thus, the victim receives a HTTP response and the information he enters through the HTTP website will get compromised by the attacker. This is how SSL strip works. But this attack was prohibited by the use of HSTS (HTTP Strict Transport Security) header in the HTTP request and response. This HSTS helps in confirming whether all the users are browsing via HTTPS or not and immediately aborts the connection in case if the user isn’t using HTTPS or any valid SSL certificate. 1188 International Journal of Pure and Applied Mathematics Special Issue Though all SSL enabled websites doesn’t use this header, most social networks comes with this HSTS header. It ceases the attackers from performing SSL strip.The following method can be used as an alternative for SSL strip where an attacker can capture the HTTPS traffic of his Victims in a local area network without downgrading them to HTTP as we do in SSL Strip. The authors are not responsible for any kind of hacktivities performed based on this paper. 4. Methodology For this attack to take place, the attacker and the victim must remain on the same network. The attack scenario is strictly LAN based. Since the aim is to intercept the network traffic of others, the attacker converts his machine into a router or a gateway through which the IP packets are going to pass. By default, the non-addressed IP packets are discarded by Linux. So IP forwarding must be enabled to make the IP packets pass through our machine. To IP forward in linux, echo 1 >/proc/sys/net/ipv4/ip_forward Linux has special firewall rules for managing the in & outbound traffic and this rules are managed using an inbuilt Linux framework called IP tables. Hence, the attacker must add a firewall rule to accept all incoming traffic via port 443 (HTTPS) and port 80 (HTTP). Let’s assume that the attacker’s IP address is 192.168.43.146. Adding firewall rules can be done by the following commands Fig.1. Configuring Firewall Rules using IPtables iptables -t nat -A PREROUTING -p tcp --dport 443 -j DNAT --to-destination 192.168.43.146 iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 192.168.43.146 After adding the firewall rules, the attacker finds the IP address of the victim on his network. Using Ettercap, the attacker can find all the hosts connected in a network. The attacker may even use Arp Scan where the attacker sends the ARP request to all the clients of the network and find the list of the devices connected to it. Sometimes, ping may even fail if firewall isn’t configured to allow ping, but ARP can bypass the firewall and scans for live hosts. The Attacker must find the Victim’s IP to carry out ARP poisoning. Let’s consider that the victim has an IP of 192.168.43.244. 1189 International Journal of Pure and Applied Mathematics Special Issue Fig.2. Identifying Hosts using Ettercap 5. ARP Cache Poisoning Now, ARP poisoning is carried out by the attacker to intercept the HTTPS requests. The Address Resolution Protocol (ARP) is used to link Network Address to the hardware address using data link protocol.The ether type field of Ethernet frame header working at layer 2 of OSI modelidentifies whether the encapsulated data of Layer 3 is IPv4 or IPv6 or ARP. ARP has an Ether type of 0x0806. ARP header(28bytes) contains the target and source’s Mac & IP addresses. The ARP header contains Operational Code. If the operational code is 1, it denotes the ARP Request and if the Operational code is 2, it denotes to ARP Reply. The attacker sends spoofed ARP messages in the local area network and links his physical address (MAC address) with the victim’s IP address. By this, the traffic meant for the victim will be received by the attacker. This process is termed as ARP spoofing. Typically, all the routers by default over write the Mac addresses and this leaves them vulnerability for ARP Spoofing. When the attacker creates a large number of ARP Requests impersonating his MAC Address as victim’s, the router over writes the Attacker’s MAC with Victim’s MAC, poisoning the ARP table of the Router. When a switch is subjected to ARP DOS attack, Switch turns the “Forwarding Mode” On and the ARP Table is flooded with spoofed ARP request enabling the attacker to capture the network traffic. Hence, ARP Spoofing can also be called as ARP Cache Poisoning. It enables the attacker to interpret the data, manipulate the traffic and even stop all the traffic flowing through his network. There are robust collections of tools available for performing this ARP poisoning attack. Some common tools used for carrying out this attack are Ettercap and ARPspoof. After a 1190 International Journal of Pure and Applied Mathematics Special Issue successful ARP cache poisoning, the attacker can view the images in the websites which the victim visits using Driftnet and he can sniff the emails which are meant for vicitm’s mail address using MailSnarf. Instant messages sent on social messaging platforms and the files transferred on the network can be intercepted using msgsnarf and filesnarf respectivlely. The ARP cache poisoning attack can be carried out by the attacker using the command arpspoof -i wlan0 -t 192.168.43.244 192.168.43.1 where 192.168.43.244 is the victim’s IP address which the Attacker is going to link with his Mac Address.192.168.43.1is the router IP address. Fig.3. ARP Poisoning using ARP Spoof After successfully poisoning the ARP messages in the local network, the attacker intercepts the HTTPS requests using a HTTP interceptor tool. Burp suite and ZED Attack proxy are most used for this kind of interception in Web Application Penetration Testing. 1191 International Journal of Pure and Applied Mathematics Special Issue Fig.4. Configuring Burp to Capture SSL Request This is a sample configuration done in Burp suite for capturing the HTTPS traffic. Here, the attacker has made the Burp Suite’s Proxy Listener to bind with port 443 (HTTPS). After sticking with the port, the attacker turns on “Intercept” to capture the HTTPS Request.