0
votes
2answers
74 views

Installing self-made cert as trusted CA on windows?

I'm looking into using mitm-proxy, but part of the process of filtering/snooping SSL is that you must generate and install a root cert as a trusted CA, so that mitm-proxy can generate and throw out ...
-1
votes
1answer
122 views

Man-in-the-middle attack with public wifi

I'm using Charles to sniff out the traffic on my iPhone at Starbucks and for some reason it won't work with at&t wifi. Google Starbucks wifi does, however. I use my iPhone to connect to the same ...
0
votes
1answer
47 views

MITM attack in a star network with proxy server

My community centre has a public computer center. I am pretty sure that it's connected in a star topology with some switch in the center. It also have a proxy server which we need to enter a username ...
1
vote
2answers
66 views

Security risk of Microsoft AD Certificate Services?

We have an internal CA server for our domain located at http://cert_srvr.local.domain/certsrv/certrqxt.asp. This server runs Microsoft Active Directory Certificate Services. When I went to the ...
0
votes
1answer
114 views

SSL decryption without installing a certificate on each client

Given a proxy performing MITM SSL decryption and inspection, is it possible to install a wildcard certificate (*.domain.com) on the proxy signed by a root CA (such as VeriSign or GoDaddy) such that ...
1
vote
1answer
93 views

What can entreprise admins do with our secured sessions?

The enterprise where I work has a proxy server that traces and filters our web activities. Employees claim that they can know the links that we visited and see the content of HTTP web sites, but they ...
0
votes
1answer
142 views

How to prove iOS app is vulnerable to MiTM

I'm updating an iOS app and I want to prove that it is vulnerable to MiTM attack. I have set up Charles Proxy on my mac and configured the Simulator so that it trusts Charles CA Certificate, per ...
0
votes
2answers
156 views

Are SSL encrypted communications through a company network safe?

If I'm using Skype, Facebook, or another type of communication at my work, can the network administrator see my Skype and Facebook conversations, although its encrypted with SSL? I found this text: ...
9
votes
2answers
773 views

HTTPS login vs MITM attack

http://www.troyhunt.com/2013/05/your-login-form-posts-to-https-but-you.html My question is, if the threat is that someone controls your internet connection and can serve up bad login pages, couldn't ...
0
votes
1answer
402 views

How to MiTM SSL on a device with no proxy settings

I'm trying to MiTM a device on my network and having some problems. SSLstrip doesn't work because the URL is https://, and I can't use something like Fiddler because the device has no configurable ...
1
vote
1answer
329 views

How should this system be protected from ARP spoofing?

Background My university uses an authenticated (squid) HTTP proxy server for accessing the internet. There are a few reasons for this: They want to track misuse of the connection Our university ...
10
votes
1answer
708 views

Is Nokia's “institutional MITM” of SSL traffic vulnerable to CRIME attack?

It's recently been in the news that some Nokia phones proxy all traffic, including SSL connections, through a Nokia proxy. This is effectively an "institutional MITM" attack on users those phones. ...
3
votes
1answer
472 views

Burp proxy between non proxy aware device

I want to intercept traffic between a Ethernet connected device, which is not proxy aware and modify/inject javascript. Conventionally when testing webapps I would use burp. Can burp sit on my ...
6
votes
2answers
1k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
5
votes
3answers
3k views

How do I check that I have a direct SSL connection to a website?

I always thought that if I had an SSL connection there would be no MITM attacks. Now it appears that isn't true (see comments in this question Is it okay from a security perspective to read foreign ...
5
votes
4answers
1k views

MiTM - Non-HTTP TLS

I'm doing some research into the privacy of various iOS applications. My main source of data is via wireshark or Burp (HTTP/S proxy). This has been rather sucessfull for MiTM for decrypting HTTPS ...