On-Path Attacks

On-path attacks (sometimes also called a man-in-the-middle (MitM) attack)

occurs when an attacker causes traffic that should be sent to its network to be relayed through a system or device the attacker controls. Once the attacker has traffic flowing through that system, they can eavesdrop or even alter the communications as they wish

A SSL stripping attack

uses an on-path attack when the HTTP request occurs, redirecting the rest of the communication through a system that an attacker controls, allowing the communication to be read or possibly modified

A browser-based-on-path attack

relies on a Trojan that is inserted into a user’s browser. The Trojan is then able to access and modify information sent and received by the browser. Since the browser receives and decrypts information, a browser-based on-path attack can successfully bypass TLS encryption and other browser security features, and it can also access sites with open sessions or that the browser is authenticated to, allowing a browser-based on-path attack to be a very powerful option for an attacker

On-path attack indicators

are typically changed network gateways or routes, although sophisticated attackers might also compromise network switches or routers to gain access to and redirect traffic