During a security assessment on an enterprise network segment, a SOC analyst observes that users attempting to establish encrypted HTTPS connections to an external server are transparently modified in transit by an adversary on the local network segment. The adversary intercepts initial connection requests and converts HTTPS links into unencrypted HTTP links, forcing client browsers to transmit credentials in plaintext over port 80 while maintaining a separate secure session with the target server. Which of the following network attack types is being executed?
- SSL strippingCevap
- BDNS cache poisoning
- CPort protocol mismatch exploitation
- DRogue DNS CNAME injection
Cevap
The attack being executed is SSL stripping, where an inline adversary downgrades secure HTTPS communication to unencrypted HTTP traffic.
SSL stripping is an on-path attack where an adversary downgrades HTTPS traffic to unencrypted HTTP. By modifying HTTP response headers and location redirects, the adversary forces the client to send sensitive data over plaintext port 80 while maintaining a separate TLS session with the authentic remote destination.
Adım Adım Çözüm
Anahtar Kavram
SSL Stripping and Man-in-the-Middle TLS Downgrade Vectors