NatJack: Docker Network Bridge TCP Hijacking (Downstream Spoofing)

Summary

Key Points

• The video demonstrates the Napjack attack, a container-to-container attack, targeting a Docker network bridge environment. 0:02
• A critical prerequisite for the attack is the ability of the attack client to spoof its IP address to match the victim client, which is shown to be possible within a Docker network bridge. 0:40
• Proof of Concept 4 illustrates TCP/IP hijacking, where an attacker successfully intercepts and takes control of an established TCP connection between a victim client and a target server. 0:51
• This attack allows an adversary to inject arbitrary, malicious content into a victim's communication stream, whether it's raw TCP data or web content, by hijacking responses from legitimate servers. 1:13
• Once the TCP connection is hijacked, the attack client can seamlessly send and receive data, effectively impersonating the legitimate communication partner. 1:34
• Proof of Concept 5 extends the attack to HTTP response hijacking, utilizing a technique called "timeweight assassination," which operates on similar principles to TCP/IP hijacking. 2:18
• The demonstration includes hijacking HTTP requests to a simple demo server and, more significantly, to a real-world Google server, showcasing the attack's practical implications. 2:37
• In HTTP response hijacking, the attack client intercepts a valid HTTP response from a target server intended for the victim client. 3:33
• The attacker then spoofs their IP address and sends a fabricated HTTP response, containing attacker-controlled content, directly to the victim client. 4:36