This module tests your ability to analyze intercepted network communications. You will examine network packet captures to identify protocols vulnerable to data exposure during a Man-in-the-Middle (MitM) attack.
Investigation Scenario
During a forensic investigation at AlphaCore Financial, employees reported erratic session behavior while accessing an internal HR management portal. The network team identified anomalous ARP broadcasting on the local subnet.
As the digital forensics investigator, you have acquired a raw PCAP (Packet Capture) file from the span port of the local switch spanning the last 24 hours. Your goal is to analyze the traffic to confirm if a Man-in-the-Middle (MitM) attack occurred and to determine if sensitive data was successfully intercepted by the attacker.
Evidence Collected
A subset of the `network_capture_span_0410.pcap` file has been processed using Wireshark and TShark. Below is the relevant output surrounding the suspicious activity:
[+] TShark Output Analysis
Timestamp: 2026-04-10 14:22:05 UTC
Frame 1450: 42 bytes on wire
Ethernet II, Src: aa:bb:cc:dd:ee:11 (Attacker_MAC), Dst: ff:ff:ff:ff:ff:ff (Broadcast)
Address Resolution Protocol (reply)
Sender MAC address: aa:bb:cc:dd:ee:11
Sender IP address: 192.168.1.1 (Gateway_Spoofed)
Target MAC address: 00:00:00:00:00:00
Target IP address: 192.168.1.45 (Victim_Machine)
[!] Note: Duplicate IP address configured on MAC aa:bb:cc:dd:ee:11
Frame 1512: 546 bytes on wire
Transmission Control Protocol, Src Port: 52314, Dst Port: 80
[Follow TCP Stream - Stream 42]
POST /login.php
Host: hr-internal.alphacore.local
User-Agent: Mozilla/5.0
Content-Type: application/x-www-form-urlencoded
username=admin&password=P%40ssw0rd2026!&login_submit=1
The forensic extraction confirms that the attacker successfully forced the victim's traffic to route through their MAC address before reaching the gateway.
Question
In a network-forensics investigation, an analyst is analyzing traffic to identify a potential "Man-in-the-Middle" (MitM) attack. Which protocol is often targeted in MitM attacks to intercept unencrypted traffic?
Investigator's Hint: Look closely at the TCP stream data in the evidence box. The destination port is 80, and the payload (username and password) is readable in plain text. Which protocol operates this way?
Expert Analysis
1. What the Evidence Shows
The PCAP evidence clearly demonstrates ARP Cache Poisoning (Frame 1450), where the attacker's MAC address asserts ownership of the Gateway's IP address. Frame 1512 shows a subsequent TCP stream directed to destination port 80. The packet payload reveals HTTP POST parameters (`username=admin&password=P%40ssw0rd2026!`) transmitted entirely in cleartext.
2. Identify Forensic Stage
This falls under the Examination and Analysis phase of the digital forensics lifecycle. The investigator is analyzing preserved network traffic (PCAP) to extract artifacts (credentials in transit) and reconstruct the attack timeline.
3. Why the Correct Answer is Correct
A. HTTP is correct because Hypertext Transfer Protocol (HTTP) transmits data without encryption. In a MitM scenario, if an attacker successfully intercepts the traffic flow (via ARP spoofing, DNS spoofing, etc.), they can view, extract, and even modify the HTTP packet payloads directly, exactly as shown in the evidence.
4. Why Others Are Wrong
B. HTTPS: Encrypts the payload using TLS/SSL. While an attacker can still intercept the packets in a MitM attack, the data will appear as encrypted cipher-text. Without executing a successful downgrade attack (e.g., SSL Stripping) or obtaining the private key, the investigator would not see plaintext credentials in the PCAP.
C. SSH: Secure Shell encrypts the entire session payload. Passive interception yields only encrypted traffic.
D. SFTP: SSH File Transfer Protocol utilizes the SSH protocol to securely encrypt file transfers, making it immune to simple cleartext interception.
5. Real-World Forensic Action
As an investigator, upon discovering cleartext credential exposure in a PCAP, the immediate next steps are to:
Document the compromised accounts (e.g., the `admin` account for `hr-internal`).
Analyze subsequent logs (Active Directory, Web Server logs) to determine if the attacker utilized these stolen credentials to perform lateral movement or data exfiltration.
Extract the full timeline of the attacker's MAC address activity on the network to identify the physical port or wireless access point used for the attack.
MINI LESSON: Network Evidence Interpretation
In network forensics, interception does not automatically equal compromise. An attacker can intercept heavily encrypted traffic (like HTTPS or SSH) via routing manipulations, but gain no actionable intelligence. The forensic investigator must look for the intersection of vulnerable routing (ARP spoofing) AND vulnerable protocols (HTTP, FTP, Telnet). Identifying cleartext data in transit is the definitive proof of a successful data breach via MitM.
Ready for the next investigation?
Master network forensics, log analysis, and evidence handling.