On-Path Attacks

An on-path attack, also known as an adversary-in-the-middle (AitM) attack, involves a threat actor positioning themselves between two hosts to capture, monitor, and relay communications. This attack can also modify traffic covertly.

Positioning

Threat actor intercepts communication between two hosts.

Relaying

Captures and relays communication, making detection difficult.

Modification

Can present spoofed forms to capture credentials.

Layer 2 Example

ARP poisoning attack.

ARP (Address Resolution Protocol)

Identifies MAC addresses for IPv4 addresses.

ARP Poisoning

Uses unsolicited ARP replies to update MAC:IP address cache with spoofed addresses.

Gratuitous ARP Replies

Attacker sends unsolicited ARP replies to hosts.

Spoofed Addresses

Hosts update their cache with the attacker's MAC address.

Frames 6-8

Attacker sends ARP replies claiming to have certain IP addresses.

Frame 9

Host tries to send a packet, received by the attacker.

Frame 10

Attacker retransmits the packet to the actual host.

Frames 11-12

Reply from the actual host is received and retransmitted by the attacker.

Default Gateway

Common target for ARP poisoning to intercept all traffic destined for remote networks.