Loop Back Check

Today, I encountered a problem where I encountered http 401.1 when modifying the host file to access the local machine.

 

After investigation, it is found that the reason for the configuration is called loop back check.

 

What is loop back check?

This configuration is used to prevent reflection attack. After this configuration takes effect, NTLM authentication will fail if you use FQDN or custom host header (which does not match the machine name.

 

So what is reflection attack?

The main idea of this attack is to use trick to give the attacked machine the answer to attacker's own challenge.

 

The process is as follows:

1. The attacker initiates a connection to a target.
2. The target attempts to authenticate the attacker by sending it a challenge.
3. The attacker opens another connection to the target, and sends the target this challenge as its own.
4. The target responds to the challenge.
5. The attacker sends that response back to the target on the original connection.

 

References:

Reflection attack

Http://en.wikipedia.org/wiki/Reflection_attack

You receive error 401.1 when you browse a Web site that uses Integrated Authentication and is hosted on IIS 5.1 or a later version

Http://support.microsoft.com/kb/896861

What is loopback check?

Http://www.cnblogs.com/awpatp/archive/2010/03/11/1683672.html