A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

3
votes
4answers
86 views

How to Protect Webservice on Private Network?

We are building a webservice that will only be queried by other servers on our private network. I was suggesting that we put that webservice over https and use either client ssl authentication or a ...
2
votes
1answer
37 views

Security of https website which resolves to local ISP (ex. twitter)

Recently I noticied that some of social networks (ex. twitter) domains points to an IP in my local ISP. (ping twitter.com resolved to local ip: 3.4.5.6-static.bad-government-isp.com). Note: now ...
8
votes
1answer
357 views

Can ICMP Redirects still be used to redirect traffic in a LAN?

I tried just tried to migrate a MITM attack using hping3 with ICMP Redirects in my testlab. hping3 -I eth0 -C 5 -K 1 -a 192.168.2.1 --icmp-ipdst 192.168.2.15 --icmp-gw 192.168.2.100 --icmp-ipsrc 192....
7
votes
1answer
223 views

“Fix” man in the middle

I've just tried to ssh connect to a server (auth via ssh key), and get the well-known message WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED!. I'm the server administrator (but I'm not really a good ...
2
votes
2answers
66 views

What problem does PKI fix; how would someone “lie about their identity”? [duplicate]

What does having a certificate issued by a Content Authority protect against? In everything I've red (and watched) they teach it as "you are given the public key to communicate with Alice, but how do ...
4
votes
1answer
439 views

Why does sslstrip+ fail to intercept the traffic from websites like facebook and gmail?

I have been reading an article about sslstrip and mitm. Before the introduction of HSTS it was possible to strip ssl and send an insecure http page to the victim. Anyway it was overcome by using HSTS ...
3
votes
2answers
256 views

Is it possible for my employer to replace the root CA on my phone?

I've read about corporate MITM 'attacks' where they replace the root CA on company hardware in order to monitor traffic over SSL that takes place on their network, but is it possible for them to do ...
2
votes
1answer
123 views

Flaw in HTTP Digest Authentication

I am working through my textbook and I came across this question: Below is the message format for a browser response to access a password-protected web page using HTTP digest authentication. GET URI ...
4
votes
2answers
155 views

How should software respond when Captive Portals or Untrusted SSL certs prevent connectivity?

I need to fix an issue where the initial (or perhaps only) HTTPS call to a website is blocked by a captive portal, not managed by me. The resolution has been to ask the user to navigate to a "http" ...
-2
votes
1answer
267 views

How to dnsspoof against HTTPS

I am doing a dnsspoof PoC, but apparently it doesn't work with HTTPS because of the certificate. Please don't tell me that I have to generate a certificate or send a legitimate certificate, I want ...
2
votes
2answers
50 views

How to Ensure Post Data in Services is Safe from User Tampering In WebGL Games?

We are currently making WebGL games for an online portal that then rewards users points they get from In Game Score. The Score is sent to the WebServer in the form of POST service, Recently we have ...
3
votes
2answers
123 views

Is it possible to let a fake certificate appear valid by sending fake OCSP responses?

In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the ...
0
votes
1answer
139 views

How are man-in-the-middle attacks actually implemented? [closed]

For research purposes. I'm wondering, in a high level way, how MITM attacks are actually done in the real world. So over the internet the client talks to the server, or one person emails the other, ...
3
votes
1answer
106 views

Is it possible to maintain security and data integrity through a network decrypting HTTPS?

A network I often use has started to decrypt HTTPS traffic (and reencrypt, using a different key) using a local proxy. This proxy is operated by people I mostly trust. However, I would like to know if ...
4
votes
1answer
190 views

Intercept DNS query packet and send spoofed response after ARP poisoning

On my network, I am able to perform ARP poisoning but only for a target machine not router. Therefore, I cannot spoof responses by intercepting router's packets and modifying them (http://...
1
vote
1answer
202 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
1
vote
1answer
90 views

DHCP Exhaustiation / Rogue DHCP interrupted by real DHCP NACK

I was trying to run a Rogue DHCP Server which should cause a MITM attack. I did the following Exhaust the real DHCP Server using DHCPig (worked) Run a Rogue DHCP Server using the auxiliary/server/...
0
votes
0answers
71 views

How does STK (Short Term Key) generation work in a Bluetooth Low Energy?

I want to understand how STK (Short Term Key) generation works in a Bluetooth Low Energy. I don't want to go deep at a packets exchange level of a Security Manager Protocol, but I want to understand ...
1
vote
2answers
144 views

Arp network (prevent mitm attack)

On my school network, using wireshark to see network traffic (filter=arp), I only see gratuitous packets. Meaning, all hosts on network send gratuitous packets (ex: gratuitous for 10.10.3.54, ...
12
votes
6answers
3k views

Is it possible for corporation to intercept and decrypt SSL/TLS traffic? [duplicate]

I found there are some companies claim that they offer service that can eliminate SSL/TLS blind spot, such as Blue Coat and Gigamon. Are they talking about some way of decipher the https content (...
2
votes
1answer
112 views

Can MITMf exploit SSL CCS vulnerability (CVE-2014-0224)?

I just wonder if MITMf (https://github.com/byt3bl33d3r/MITMf) can be used to exploit the 2014 early CCS bug, or is there a tool out there which can (preferably open source, so I will be able to ...
3
votes
1answer
904 views

How can Port Stealing be used as a MiTM attack?

I read about and tried a lot of MiTM attacks but I just don't get how Port Stealing can be used as a MiTM attack. In my understanding one can "steal" a Port by sending Ethernet Frames faking the ...
2
votes
0answers
73 views

What are the formal methods to analyze Authentication Protocol

I designed an authentication protocol for consumer-producer applications, which barrows features from Kerberos and Tesla. To check the strength of protocol I considered different well known attacks ...
0
votes
3answers
182 views

How to an “emulate” man in the middle attack for SSL and TLS?

I need to compare TLS and SSL for an essay and I thought a good way to do this would be to emulate a Man in the Middle attack, however I have no clue how to do it.
3
votes
2answers
71 views

Does the Content Security Policy header provide a false sense of security if a page is served over unencrypted HTTP?

I have been thinking about how a developer restricted (for whatever reason) to serving an unencrypted site might protect themselves from threats such as overzealous ISPs injecting ads or notifications ...
2
votes
1answer
97 views

Avoiding repeaters in radio-communication

Suppose a sender and a receiver communicate over some radio channel. Is there a way to prevent packets sent and received are not being repeated/forwarded by a MiTM? That is, when the agents are out of ...
2
votes
1answer
156 views

MitM Android Java Application

I'm trying to MitM an Android Application for research purposes (it's designed to be broken). I'm using Burp as an attack proxy and already exported the Burp CA certificate and imported it into the ...
5
votes
1answer
69 views

SSH MITM on new host

If you are connecting to a new host for the first time, what is to stop an intruder from performing a MITM attack: swap out the public key and fingerprint for a public key they have the private key to ...
2
votes
2answers
149 views

Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from ...
2
votes
2answers
206 views

Can a properly implemented TLS connection be intercepted?

Assuming a TLS connection where both the server and client perfectly adhere to the pertinent standards. Can an transparent HTTPS proxy intercept the TLS connection? (Assuming the "mock CA" ...
1
vote
3answers
255 views

Unencrypted FTP to transfer encrypted data - okay if IP-restricted?

If unencrypted FTP over the public internet is the only file transfer option for a particular situation, what security concerns are applicable assuming: The data being transferred is strongly ...
12
votes
1answer
158 views

How can mobile sign-on be secured from imposter authentication screens?

History seems to have come almost full circle where old issues are shown in new/emerging technologies. Background If you trust the operating system, Windows originally had the Control - Alt - Delete ...
6
votes
2answers
674 views

How to Man-in-the-middle a whole network?

When performing a MiTM attack, you generally need to specify the router's IP address and the "victim" IP address. I'm trying to demonstrate to a business owner why he needs to secure his network, but ...
3
votes
2answers
247 views

SSL stripping in home network

I am trying to monitor the traffic of some "smart devices" in my home (TV, coffee machine, ...) but most of them communicate over SSL. What possibilities are there to look into SSL encrypted ...
2
votes
0answers
276 views

ssh dns spoofing warning - possible investigation?

Recently the router my ISP provided started to work suspiciously. At times the wireless connection from my devices to the router breaks and the router stops responding while sometimes the connection ...
0
votes
3answers
178 views

MITM on popular sites - DNS

Can a MITM attack on popular sites such as Facebook.com Google.com be done by intercepting the DNS requests? Will the user notice something? For instance: Loading https://fb.com The client ...
2
votes
1answer
169 views

Any real-world examples of root certificate store compromises?

Apart from the infamous Superfish/Lenovo case this year, are there any other known cases of a malicious root certificate being installed on a target machine to allow transparent MITM attacks, whether ...
3
votes
1answer
809 views

ARP poisoning and port forward together

Suppose these assumptions: Router IP address: 192.168.1.1 Router MAC address: 00:00:00:00:00:00 My IP address: 192.168.1.2 My MAC address: 00:00:00:00:00:01 Victim IP address: 192.168.1.3 ...
0
votes
2answers
171 views

How is this SSL spoofing possible?

Here is a description of a seemingly successful SSL certificate spoof: https://cryptostorm.org/viewtopic.php?f=67&t=8713 The session is initiated by pointing a newly-opened icedove window ...
3
votes
1answer
684 views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
2
votes
2answers
141 views

Does man in the middle require physical access to the network infrastructure?

Reading other questions such as this or this or this, it seems if I'm the only one using the wifi connection at home I can be sure no man in the middle attack is happening, because there is no way to ...
3
votes
4answers
201 views

Can MITM change the protocol?

According to my experience surfing the web, many websites foo.com don't support https. When I go to https://foo.com, it just changes to foo.com Can attackers forge the fact that foo.com doesn't ...
3
votes
1answer
150 views

SSL certificate trust chain shows root certificate with 1024-bit public key - Is this evidence of a MITM attack?

My account at my domain name registrar was hacked and I am trying to understand how the hackers were able to steal my login credentials. Because the root certificate in the trust chain for the ssl ...
2
votes
2answers
110 views

Forwarding an SSL connection

My general question: Can a two-way SSL connection be forwarded to a 3rd server? The specifics: I have a WebLogic server supporting two way-SSL, client side's cert is from their CAC card. The ...
25
votes
5answers
3k views

What prevents a man in the middle from requesting a certificate for your server?

Let's say you have a server at shop.example.com and you are requesting a certificate from some trusted CA like Comodo (they say they'll issue it within few minutes online). First of all, how can ...
5
votes
4answers
2k views

How do I verify someone's identity if the only method of contact is their email address?

Email addresses can be hacked or perhaps even spoofed. I need to pay individuals via paypal and I fear that over time people's email will change or become compromised. How can I ensure I am paying the ...
1
vote
0answers
19 views

OTR and active Man In The Middle attacks [duplicate]

As I'm currently playing around with cryptography, especially OTR, I'm wondering about its security against active MitM attacks. Let's say Alice and Bob created an OTR session, but Eve is acting as ...
5
votes
4answers
177 views

MITM attack between me and TOR entry node

In which ways can my ISP, who by the way controls the WiFi router I connect to, do a MITM attack on my TOR connections and hence read the traffic?
3
votes
3answers
376 views

Detecting a MITM attack

If my session is under a Man-In-The-Middle attack, can I detect it by checking the ip addresses my machine is connected to? For example, I want to know if my connection to a certain website is MITMed ...
2
votes
1answer
65 views

Security bounds of TLS client authentication (from browsers)

Say that there are two servers that perform TLS. Both servers have valid end-point certificates. In other words, neither of them would raise a warning from the browsers after the connection has been ...