A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

2
votes
1answer
59 views

Why does Canonical not enable https here?

It is always verify disk images before using. In Ubuntu's website, many pages are sent through https. However, some of the most crucial pages are not. For example, http://releases.ubuntu.com/trusty/. ...
3
votes
2answers
102 views

Is email sent form a Java web-app over a HTTPS connection encrypted?

I'm working on a Java web-application which runs on a HTTPS connection. This application sends emails to its users. I want to protect those emails from man-in-the-middle attacks and other potential ...
58
votes
3answers
5k views

Why aren't IMSI catchers rendered ineffective by standard MITM defenses?

There's been a lot of reporting in the past few years about law enforcement agencies using IMSI catchers (also known as Stingrays after a popular brand of them) to intercept cellular communications. ...
1
vote
1answer
130 views

MITMproxy doesn't display HTTP/HTTPS traffic of Android Apps

I am using mitmproxy to analyse the https traffic of some Android Apps. A few days ago I was able to intercept all the traffic without any problem and now mitmproxy doesn't seem to work properly. ...
6
votes
1answer
75 views

What is Credential forwarding attack?

What is credential forwarding attack? Does this happen only when the client connects to two servers with same credentials?
1
vote
1answer
43 views

mitmproxy not displaying ARP-poisoned traffic

I have a target computer at 10.0.0.14 and gateway at 10.0.0.1. I successfully insert myself as a MITM by running sudo arpspoof -i wlp3s0 -t 10.0.0.1 10.0.0.14 sudo arpspoof -i wlp3s0 -t 10.0.0.14 ...
5
votes
2answers
109 views

Server-side man-in-the-middle/eavesdropping: attacks between two servers using unencrypted HTTP

I’m new to security, and I’m wondering how man-in-the-middle and eavesdropping attacks between web servers work, rather than between personal devices and servers. Most questions I see here about ...
11
votes
2answers
832 views

How long can X.509 certificate chains be?

Usually, I only see certificate chains with a root CA, an intermediate one, and a third one for the particular SSL/TLS website; but can X.509 certificate chains be deeper than 3 levels? Is there a ...
6
votes
1answer
146 views

Does Perfect Forward Secrecy (PFS) make Man-in-the-Middle (MitM) atacks more difficult?

Does Perfect Forward Secrecy (PFS) make Man-in-the-Middle (MitM) attacks more difficult? If not, why?
4
votes
1answer
61 views

MITMf which files can it patch

From this tutorial i found that it is possible using tool MITMf to patch exe files ''victim'' downloads in order to open a meterpreter shell. The commands that have been used are the following: use ...
6
votes
2answers
858 views

How does an attack on a digital signature work?

In our IT Security class we have been told that you need CA's to prevent attacks on a digital signature. Sadly, our docent didn't elaborate how such attack would be performed - I can only guess that ...
8
votes
2answers
2k views

How is it possible to do TLS through proxy without anyone noticing?

My workplace uses a proxy to connect to the internet, even for https sites. It was my understanding that for this to work, the proxy would be considered a MITM, and the certificate presented would be ...
1
vote
0answers
49 views

Open source tool to test a WAF against OWASP Top 10? [closed]

Are there any open source tools to test a WAF against OWASP Top 10? Especially I am looking for a tool that tests a WAF against different types of attacks & reports test results.
0
votes
3answers
95 views

Intercept HTTPS traffic.. with a cert

So I am working with Charles proxy server, I understand I can decrypt HTTPS traffic, if the user accepts the invalid cert warning on the browser or trusts charles as a root CA. However what I have ...
1
vote
1answer
62 views

Can username/passwords be intercepted on an App using public wifi?

I use the ADVFN finance app for stock prices every morning on the public wifi on my train to work. This requires me to login with my username and password on the app(which are saved). Do apps provide ...
1
vote
1answer
56 views

How can an attacker downgrade/modify the cipher suites when they are MACed? (Freak, Logjam use downgrade attacks)

In the Finished handshake of TLS all previous messages exchanged are sent from the client to the server (and reverse) and protected by a MAC. This is what also "prevents" TLS_FALLBACK_SCSV from being ...
-2
votes
1answer
56 views

How to add scripts in HTML file passing through network? [closed]

how to add JavaScript file to every HTML document that is passing through your network ?
0
votes
0answers
43 views

How to prevent injection of Layered Service Provider (LSP) module in application with kernel-level?

LSP technology is often exploited by spyware and adware programs in order to intercept the communication across the Internet. For example, malware may insert itself as an LSP in the network ...
3
votes
3answers
695 views

Why don't ISPs offer encryption?

I was quickly wondering, why don't ISPs offer encryption for the traffic from the customer's router to the ISP-server? Until now, if you want to protect against e.g a MitM-attack you solely rely on ...
1
vote
1answer
76 views

is it possible to intercept network packets outside lan?

User A is in a different country than user B and they have different IP ranges and ISPs. Is it possible for A to intercept B's communication sent to a third party, without using techniques like ...
0
votes
0answers
90 views

Intermediate proxy intercepting my SSL data between my computer and the ISP

I did a simple scan of my linux firewall today using grc.com's shieldsup on their website (https://www.grc.com/x/ne.dll?bh0bkyd20). Previously when doing this it shows I have full stealth but today it ...
0
votes
2answers
43 views

Is there any security implication of using WebRTC over unencrypted channel for streaming?

I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible. However, my project ...
1
vote
1answer
119 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including ...
1
vote
0answers
39 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
1
vote
1answer
228 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
0
votes
2answers
134 views

SSLstrip is not working in the local network

My issue is the SSL stripping is not working in my LAN, but it works if I try to attack a HTTPS website with no HSTS. I am not using any domain name just the IP address of the server. Is there any ...
5
votes
2answers
399 views

What is the difference between MITMproxy and SSLsplit?

I am aware that MITMproxy only captures HTTP/HTTPS protocols where SSLsplit is a transparent proxy and therefore can capture also other non-HTTP protocol communications. However MITMproxy can operate ...
0
votes
1answer
47 views

Does subterfuge work on ALL networks?

Does subterfuge's ARP poisoning attack work on all networks? If not, what kind of precautions can be taken against it? Meaning, what kind of networks, if any, does it fail on? My understanding is that ...
0
votes
1answer
56 views

Where can emails be sniffed from? [duplicate]

I understand that you should not send private information in emails due, in part, to the fact that this traffic is usually unencrypted and can therefore be sniffed while in transit. Where would a ...
4
votes
2answers
89 views

Check validity of SSL cert on public network?

So my company has just started issuing their own SSL certificates, so HTTPS sites now show as being secure, but if you check the certificate used the root CA is us, not whoever the site used. This ...
0
votes
1answer
66 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
3
votes
1answer
60 views

Simulate Tor Circuit

So an interesting thought popped into my head as I was thinking over the Cryptowall malware. If you don't already know, Cryptowall utilizes the Tor service to make the back-end service it uses ...
2
votes
1answer
50 views

SAML without certificate

A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes? Is this a ...
4
votes
3answers
266 views

How does a Man In the Middle attack happen in reality

I am trying to improve the MITM protection of an iOS app I am responsible for, so I want to understand exactly how it happens. I have set up Charles to act as a proxy which required setting the proxy ...
3
votes
1answer
115 views

Xfinity Wifi Risk

I recently discovered and would like to use Xfinity Wifi around town. However, it seems like a remarkably dangerous thing to do, even if you do confirm an access point's location via their ...
1
vote
4answers
125 views

Why is MITM required for Session Hijacking?

As I understand, the basic concept of Session Hijacking is intercepting a packet in which the victim sends its cookie/session credentials to a server, be it Facebook/Twitter/YouTube/Whatever. But ...
1
vote
2answers
93 views

is the evil twin attack considered sniffing?

Is the evil twin attack included in the sniffing category ? I am really confused and i can't tell if it is.
1
vote
2answers
85 views

How do web hosts know you own your domain?

Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend: Second, we add some ...
1
vote
2answers
89 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
3
votes
1answer
151 views

MITM over WPA2 (e.g. with ettercap)

I've read on a few sites that it's possible to conduct MITM attacks over WPA2-secured connections. So for example I could replace the content of a site a user tries to access over HTTP. Is this true? ...
3
votes
0answers
53 views

Local sockets: does SSL add security? [duplicate]

Situation We have a Windows Service that is listening on a TCP port. This service is responsible for capturing a user's fingerprint using the Windows Biometric Framework, when requested to do so by a ...
5
votes
1answer
141 views

Detect man-in-the-middle on server side for HTTPS

Background: We have a site which works over HTTPS (HTTP not supported, we use HSTS). It's deployed in 3rd party cloud, which restricts our control and log abilities over server hardware. We cannot ...
0
votes
0answers
21 views

What stops a man in the middle attack from intercepting SSL encrypted data and sending it with a spoofed ip address to the server? [duplicate]

Say you have a client that connects to a server using SSL. The server, upon receiving a certain command, launches a missile. Then say there's someone in the middle of the connection listening to the ...
1
vote
1answer
60 views

MitM attempt resulting in ICMP redirects

I am trying to 'man in the middle' a device on my wifi network. I have configured it to use my Linux machine (also in the wifi network) as a default gateway. On the Linux (attack) host, I switched on ...
0
votes
1answer
110 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
1
vote
2answers
178 views

HTTP login to iframe HTTPS/ MiTM attack

I would like to know if the credentials can be intercepted/MitM attack if the site is using HTTP to HTTPS login iframe. Here are some login details from my Chrome dev tools (Form Data) So I can see ...
2
votes
0answers
41 views

Chrome: Watch for modified https-certificates

I read a lot about security of https and possible MITM attacks lately. For me it seems there is only possible way to make a https-MITM attack: When a MITM exchanges the shipped https-certificate and ...
5
votes
1answer
290 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
1
vote
1answer
119 views

Can network admin detect an MiTM attack?

I am on a WiFi network with a SonicWall router (I'm guessing this comes with an IDS). If someone on my network launches an MiTM attack on me, will the network admin be able to detect this? Does an ...
5
votes
4answers
301 views

How can I intercept video over a wireless network in real time?

Can you sniff the packets or use a network analyzer or MITM or ARP spoofing to somehow be able to see the videos that someone else is watching on a network in real time? Also: Can you somehow see ...