Tagged Questions
6
votes
1answer
76 views
Are there any situations when one can only mount a passive MITM?
This came up while discussing Web & insecure HTTP - Using RSA for encrypting passwords on the client side
Is there any such situation possible when requesting an HTTP page where an attacker is ...
5
votes
3answers
226 views
Is it possible to “protect” against MITM attacks over HTTP?
In a conversation on twitter I warned a site about a security vulnerability. Specifically, the possibility of a MITM (Man in the Middle) attack used to compromise their registration form.
The ...
15
votes
4answers
543 views
Credit card forms on HTTP pages a MITM risk?
The other day, there was a web developer mailing list thread about a fundraiser page.
One person noted that the page with the credit card form was HTTP, not HTTPS.
In response, one person said that ...
2
votes
1answer
177 views
Burp proxy between non proxy aware device
I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp.
Can burp sit on my ...
1
vote
2answers
337 views
Signed request vs HTTP digest auth for API authentication?
By signed request I mean something like this (simplified example):
Client creates a sig in his request:
$sig = hash('sha256', $api_key.$data); which generates 7409ur0k0asidjko2j for example. He then ...
5
votes
2answers
3k views
How to thwart sslstrip attack?
I need help understanding the dynamics of an sslstrip attack. I'm using it to test the security of a site that I own. I can successfully sniff the victim (in this case, myself) credentials over the ...
