Examkin

Question

Difficulty: MediumCommon Network Attack Types and Vectors

During a security assessment on an enterprise network segment, a SOC analyst observes that users attempting to establish encrypted HTTPS connections to an external server are transparently modified in transit by an adversary on the local network segment. The adversary intercepts initial connection requests and converts HTTPS links into unencrypted HTTP links, forcing client browsers to transmit credentials in plaintext over port 80 while maintaining a separate secure session with the target server. Which of the following network attack types is being executed?

  1. SSL strippingAnswer
  2. B
    DNS cache poisoning
  3. C
    Port protocol mismatch exploitation
  4. D
    Rogue DNS CNAME injection

Answer

The attack being executed is SSL stripping, where an inline adversary downgrades secure HTTPS communication to unencrypted HTTP traffic.
SSL stripping is an on-path attack where an adversary downgrades HTTPS traffic to unencrypted HTTP. By modifying HTTP response headers and location redirects, the adversary forces the client to send sensitive data over plaintext port 80 while maintaining a separate TLS session with the authentic remote destination.

Step-by-Step Solution

1
Analyze the observed attack mechanics from the scenario.
The attacker intercepts live connection attempts, modifies secure HTTPS links to standard HTTP links, and forces plaintext transmission on port 80.
Identifying the target protocol layer and header modification vector narrows down the specific attack mechanism.
2
Differentiate transport encryption stripping from domain resolution and protocol misconfigurations.
DNS-based attacks alter name-to-IP resolution before packets leave the host, whereas inline session manipulation downgrades protocol negotiation.
SSL stripping operates on active HTTP/HTTPS session negotiation rather than DNS record lookup infrastructure.

Key Concept

SSL Stripping and Man-in-the-Middle TLS Downgrade Vectors
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic