Arp Spoofing in Aspnet with Basic Auth

Arp spoofing is a link-layer attack where an adversary sends falsified Address Resolution Protocol messages to associate their MAC address with the IP address of another host, typically the default gateway. In an ASP.NET application that uses HTTP Basic Authentication over unencrypted HTTP, this combination creates a critical exposure: credentials are transmitted in an easily recoverable format, and the trust relationship between client and server can be intercepted.

Basic Authentication encodes the username and password in Base64 but does not encrypt them. If an attacker performs arp spoofing on the network path between the client and the ASP.NET server, they can capture the HTTP requests containing the Authorization header. Because the header is only encoded and not cryptographically protected, the attacker can decode the credentials and authenticate as the legitimate user. The risk is compounded when the application does not enforce HTTPS, as unencrypted traffic traverses the network where arp spoofing is feasible, such as on local or shared networks.

ASP.NET applications that rely on Basic Authentication must assume that link-layer attacks like arp spoofing can occur in environments where physical or network access is not tightly controlled. Without transport-layer encryption, the credentials are recoverable from intercepted packets, enabling session hijacking or unauthorized access to protected endpoints. Even if the application uses forms or token-based mechanisms elsewhere, any route that accepts Basic Authentication over non-TLS channels remains vulnerable to interception via arp spoofing.

An attacker positioned on the same broadcast domain can use tools to continuously send spoofed responses, maintaining the false mapping and redirecting traffic. In this scenario, the ASP.NET server may see requests that appear to originate from the legitimate client but actually pass through the attacker’s machine. Since Basic Auth does not provide integrity or confidentiality at the transport layer, the intercepted credentials and session can be reused unless additional protections, such as TLS, are in place.

middleBrick detects this risk category during scans that include unauthenticated endpoints using Basic Authentication without enforced encryption. The scanner evaluates whether credentials are transmitted in a recoverable form and highlights the absence of strict transport-layer protections. Remediation focuses on ensuring credentials are never exposed in cleartext and that mechanisms are in place to prevent unauthorized interception.

To mitigate arp spoofing risks when using Basic Authentication in ASP.NET, the primary remediation is to enforce HTTPS for all traffic, preventing credentials from traversing the network in recoverable form. Additionally, avoid using Basic Authentication over insecure channels and prefer token-based or cookie-based mechanisms with secure, HttpOnly flags. When Basic Authentication must be used, it should only be applied over TLS-encrypted connections, and the server should reject cleartext HTTP requests.

Example of an ASP.NET Core endpoint that rejects non-HTTPS requests and uses Basic Authentication securely:

// Program.cs or Startup configuration
var builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthorization();
builder.Services.AddAuthentication("Basic")
    .AddScheme("Basic", null);
builder.Services.AddHttpsRedirection(options =>
{
    options.HttpsPort = 5001;
    options.RedirectStatusCode = StatusCodes.Status307TemporaryRedirect;
});
var app = builder.Build();
app.UseHttpsRedirection();
app.UseAuthentication();
app.UseAuthorization();
app.MapGet("/secure", () => Results.Ok("Authenticated over HTTPS"))
    .RequireAuthorization();
app.Run();

Example of a Basic Authentication handler that requires TLS and rejects cleartext HTTP:

using System.Net;
using System.Security.Claims;
using System.Text;
using System.Text.Encodings.Web;
using Microsoft.AspNetCore.Authentication;
using Microsoft.Extensions.Logging;
using Microsoft.Extensions.Options;

public class BasicAuthenticationHandler : AuthenticationHandler
{
    public BasicAuthenticationHandler(
        IOptionsMonitor<AuthenticationSchemeOptions> options,
        ILoggerFactory logger,
        UrlEncoder encoder,
        ISystemClock clock) : base(options, logger, encoder, clock) { }

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        // Enforce HTTPS
        if (!Context.Request.IsHttps)
        {
            return AuthenticateResult.Fail("Basic Authentication requires HTTPS.");
        }

        if (!Request.Headers.ContainsKey("Authorization"))
        {
            return AuthenticateResult.Fail("Missing Authorization header.");
        }

        var authHeader = Request.Headers["Authorization"].ToString();
        if (!authHeader.StartsWith("Basic ", StringComparison.OrdinalIgnoreCase))
        {
            return AuthenticateResult.Fail("Invalid Authorization header.");
        }

        var token = authHeader.Substring("Basic ".Length).Trim();
        var credentialBytes = Convert.FromBase64String(token);
        var credentials = Encoding.UTF8.GetString(credentialBytes).Split(':', 2);
        var username = credentials[0];
        var password = credentials[1];

        // Validate credentials against your user store
        if (username == "admin" && password == "securePassword123")
        {
            var claims = new[] { new Claim(ClaimTypes.Name, username) };
            var identity = new ClaimsIdentity(claims, Scheme.Name);
            var principal = new ClaimsPrincipal(identity);
            var ticket = new AuthenticationTicket(principal, Scheme.Name);
            return AuthenticateResult.Success(ticket);
        }

        return AuthenticateResult.Fail("Invalid username or password.");
    }
}

In the above examples, the application redirects HTTP to HTTPS and ensures that Basic Authentication is only processed over encrypted channels. This approach neutralizes arp spoofing attempts because credentials are never transmitted in cleartext across the network. The use of RequireAuthorization and HTTPS enforcement ensures that any attempt to intercept credentials via link-layer attacks will fail to recover usable authentication information.

middleBrick can verify whether an ASP.NET endpoint enforces HTTPS and whether Basic Authentication is exposed over unencrypted HTTP. The scanner checks for encryption and proper authentication configurations, providing findings that highlight missing transport-layer protections.

Use the middleBrick CLI to scan your ASP.NET endpoints from the terminal and detect missing HTTPS enforcement or unsafe use of Basic Authentication:

middlebrick scan https://yourapi.example.com

Integrate scans into your CI/CD pipeline with the GitHub Action to fail builds when an endpoint accepts Basic Authentication without TLS:

- name: middleBrick API Security Check
  uses: middlebrick/github-action@v1
  with:
    url: https://yourapi.example.com
    fail-below-score: 80

For continuous monitoring, the Pro plan enables scheduled scans and alerts when security scores degrade, helping you maintain protection against network-layer threats like arp spoofing over time.