A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

0
votes
1answer
16 views

Is there any security implication of using WebRTC over unencrypted channel for streaming?

I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible. However, my project ...
0
votes
0answers
21 views

EVIL AP - Internet connection bridging issue [migrated]

I've been trying to create an EVIL AP scenario in my test lab for a couple of days, but I always face the same issue. I can connect to the WIFI adapter and I receive an IP address etc, via dhcp. ...
1
vote
1answer
91 views

What can a trusted certificate do?

I am doing some reading about security on mobile applications because I found an article about Man in the Middle Attacks. I saw in that article and in many other places (including ...
0
votes
2answers
58 views

SSLstrip is not working in the local network

My issue is the SSL stripping is not working in my LAN, but it works if I try to attack a HTTPS website with no HSTS. I am not using any domain name just the IP address of the server. Is there any ...
1
vote
0answers
30 views

Transmitted sensitive user data

At the moment, I have set up mitmproxy and can record all HTTP/HTTPS communications between the client and server. For research purposes I am looking to find a way to detect potential leakage of ...
4
votes
2answers
120 views

What is the difference between MITMproxy and SSLsplit?

I am aware that MITMproxy only captures HTTP/HTTPS protocols where SSLsplit is a transparent proxy and therefore can capture also other non-HTTP protocol communications. However MITMproxy can operate ...
1
vote
1answer
104 views

Network Security with EAP: PEAP and Phase 2: MSCHAPv2?

I want to connect to my college WiFi but I’m worried about the security (data leakage, hacks, MITM). The configuration I used to connect to my college WiFi is as follows, EAP: PEAP Phase 2: MSCHAPv2 ...
2
votes
2answers
96 views

Using separate HAProxy and API tiers, how can I ensure a request came from HAProxy?

I have two machines and a HAProxy machine doing SSL termination and accepting client certs successfully. How can I configure HAProxy to ensure that the messages coming into the API box are from ...
1
vote
1answer
107 views

There might be a man in the middle attack against my server

I have a little $7.20/y VPS, and the fingerprint for the ECDSA key has changed three times on me. This time, it happened shortly after I reinstalled the server (same day, in fact.) I always disable ...
-1
votes
0answers
29 views

CSploit/Zanti - MITM takes 4 minutes - is it normal? [closed]

Working on a school project for network security and I wanted to demonstrate a MITM attack from my mobile Android device. I currently have been working with Csploit and Zanti2 on a roooted Ellipsis 7. ...
0
votes
1answer
27 views

Does subterfuge work on ALL networks?

Does subterfuge's ARP poisoning attack work on all networks? If not, what kind of precautions can be taken against it? Meaning, what kind of networks, if any, does it fail on? My understanding is that ...
0
votes
1answer
42 views

Where can emails be sniffed from? [duplicate]

I understand that you should not send private information in emails due, in part, to the fact that this traffic is usually unencrypted and can therefore be sniffed while in transit. Where would a ...
4
votes
2answers
78 views

Check validity of SSL cert on public network?

So my company has just started issuing their own SSL certificates, so HTTPS sites now show as being secure, but if you check the certificate used the root CA is us, not whoever the site used. This ...
3
votes
1answer
47 views

Simulate Tor Circuit

So an interesting thought popped into my head as I was thinking over the Cryptowall malware. If you don't already know, Cryptowall utilizes the Tor service to make the back-end service it uses ...
0
votes
1answer
46 views

Sample attack scenarios on file downloads over HTTP

The websites that serve files over https, can it be considered overkill? or is it a best practice everyone has to follow? The downside to serving files over HTTPS is that you will lose the caching as ...
3
votes
3answers
251 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
2
votes
1answer
27 views

SAML without certificate

A company asked me if it is possible to use the SAML-protocol without any certificate at all. The standard doesn't require a SAML-ticket to be signed or encrypted so the answer would be yes? Is this a ...
4
votes
3answers
158 views

How does a Man In the Middle attack happen in reality

I am trying to improve the MITM protection of an iOS app I am responsible for, so I want to understand exactly how it happens. I have set up Charles to act as a proxy which required setting the proxy ...
3
votes
1answer
51 views

Xfinity Wifi Risk

I recently discovered and would like to use Xfinity Wifi around town. However, it seems like a remarkably dangerous thing to do, even if you do confirm an access point's location via their ...
0
votes
0answers
3 views

How to detect and alert automatically ARP Poisoning on OSX? [migrated]

As the Title, I seen various tool with function to detect the Arp Poisoning but nothing of them alerts with message popup or other on OSX. What is the tool that programmatically, every X minute, ...
1
vote
4answers
80 views

Why is MITM required for Session Hijacking?

As I understand, the basic concept of Session Hijacking is intercepting a packet in which the victim sends its cookie/session credentials to a server, be it Facebook/Twitter/YouTube/Whatever. But ...
1
vote
2answers
70 views

is the evil twin attack considered sniffing?

Is the evil twin attack included in the sniffing category ? I am really confused and i can't tell if it is.
-1
votes
2answers
738 views

How do certificates stop this man in the middle attack?

Alice and Bob are trying to set up a secure conversation, but unknown to them in the middle is Eve, who can intercept and modify all packets sent between them. The communication goes as follows: ...
1
vote
2answers
66 views

How do web hosts know you own your domain?

Let's say I registered a domain on Namecheap and want DigitalOcean to be my host. This can be achieved by first setting the nameservers to DigitalOcean in Namecheap's backend: Second, we add some ...
1
vote
2answers
72 views

Understanding the behaviour of existing eavesdropping techniques

I am studying the behaviour of existing eavesdropping techniques (part of my research). I have a question through the following scenario: Suppose Bob lives in New York and wants to listen (i.e. ...
8
votes
2answers
2k views

HSTS bypass with SSLstrip2 + DNS2proxy

I am trying to understand how to bypass HSTS protection. I've read about tools by LeonardoNve ( https://github.com/LeonardoNve/sslstrip2 and https://github.com/LeonardoNve/dns2proxy ). But I quite ...
3
votes
1answer
69 views

MITM over WPA2 (e.g. with ettercap)

I've read on a few sites that it's possible to conduct MITM attacks over WPA2-secured connections. So for example I could replace the content of a site a user tries to access over HTTP. Is this true? ...
2
votes
0answers
48 views

Local sockets: does SSL add security? [duplicate]

Situation We have a Windows Service that is listening on a TCP port. This service is responsible for capturing a user's fingerprint using the Windows Biometric Framework, when requested to do so by a ...
5
votes
1answer
79 views

Detect man-in-the-middle on server side for HTTPS

Background: We have a site which works over HTTPS (HTTP not supported, we use HSTS). It's deployed in 3rd party cloud, which restricts our control and log abilities over server hardware. We cannot ...
0
votes
0answers
19 views

What stops a man in the middle attack from intercepting SSL encrypted data and sending it with a spoofed ip address to the server? [duplicate]

Say you have a client that connects to a server using SSL. The server, upon receiving a certain command, launches a missile. Then say there's someone in the middle of the connection listening to the ...
4
votes
3answers
2k views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
1
vote
1answer
51 views

MitM attempt resulting in ICMP redirects

I am trying to 'man in the middle' a device on my wifi network. I have configured it to use my Linux machine (also in the wifi network) as a default gateway. On the Linux (attack) host, I switched on ...
0
votes
1answer
61 views

What is the difference between Wireshark and Ettercap for man in the middle attacks!

I know of the two programs, one is Wireshark (a packet sniffing program) and the other is Ettercap (a man in the middle attack program). I tried doing a MITM attack before, legally on my own home ...
4
votes
4answers
177 views

Can MITM change the protocol?

According to my experience surfing the web, many websites foo.com don't support https. When I go to https://foo.com, it just changes to foo.com Can attackers forge the fact that foo.com doesn't ...
1
vote
2answers
114 views

HTTP login to iframe HTTPS/ MiTM attack

I would like to know if the credentials can be intercepted/MitM attack if the site is using HTTP to HTTPS login iframe. Here are some login details from my Chrome dev tools (Form Data) So I can see ...
2
votes
0answers
41 views

Chrome: Watch for modified https-certificates

I read a lot about security of https and possible MITM attacks lately. For me it seems there is only possible way to make a https-MITM attack: When a MITM exchanges the shipped https-certificate and ...
5
votes
4answers
246 views

How can I intercept video over a wireless network in real time?

Can you sniff the packets or use a network analyzer or MITM or ARP spoofing to somehow be able to see the videos that someone else is watching on a network in real time? Also: Can you somehow see ...
4
votes
1answer
209 views

Is it possible to detect DPI (Deep Packet Inspection)?

If one suspects one's packets are subject to DPI, how can it be detected?
1
vote
1answer
90 views

Can network admin detect an MiTM attack?

I am on a WiFi network with a SonicWall router (I'm guessing this comes with an IDS). If someone on my network launches an MiTM attack on me, will the network admin be able to detect this? Does an ...
3
votes
1answer
43 views

Sending noise over wire, using hashes of noise to carry data

Imagine highly dystopian environment, where oppressive evil government MITMs over all connections and uses DPI to thwart any attempts to use TLS/SSL, TOR, I2P etc. To establish connection, these ...
4
votes
1answer
81 views

MITM or Something Else?

Problem: When a given set of user devices (tablets/laptops) downloads files from a certain server from outside the host server's country, downloads are sporadically and routinely interrupted. The ...
9
votes
0answers
366 views

What is going on with my download of the recent Apple security update?

The update in question is the Mavericks combined update which, among other things, claims to fix the recent SSL vulnerability/gaping hole. This issue really annoyed me, so I decided to procure ...
3
votes
0answers
268 views

Routing Protocol Encryption

As far as I know 'newer' versions of routing protocols support authentication between routers. What about encryption and integrity checks? Some implementations like this one from Cisco use MD5, which ...
3
votes
2answers
190 views

What are the risks of using TLS 1.0 for web applications?

I work with a company that has several web applications available to its customers via HTTPS. Recently, client browsers will not access these web applications due to the HTTPS connection being made ...
42
votes
3answers
4k views

Is it common practice for companies to MITM HTTPS traffic?

My company has just introduced a new VPN policy whereby once connected all traffic is routed the company network. This is to allow for improved monitoring of data theft. It would appear that this ...
6
votes
1answer
1k views

Why is stackoverflow not using HTTPS for all it's page?

Most webpage from stackoverflow use http even if you are logged in. Isn't it a security issue? Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
2
votes
4answers
300 views

Risks of using HTTP

What are the risks of using HTTP instead of HTTPS assuming that there isn't any rogue hacker sitting on my personal WIFI network waiting to sniff my traffic? Can a hacker sit in his boat in the ...
2
votes
3answers
129 views

Why include a private key in a root certificate?

In the recent Dell root certificate issue (see https://threatpost.com/dell-computers-ship-with-root-cert-private-key/115455/), the private key was included with the certificate. This is baffling to ...
6
votes
1answer
68 views

Is there any benefit in having CNNIC certificates installed, if you're not in China?

All modern browsers/OS come with root certificates from the China Internet Network Information Center. AFAIK these certificates are required for computers sitting behind the Great Firewall to function ...
-3
votes
1answer
77 views

There is an actual working SSL MITM nowadays?

It's been a while since SSLstrip is deprecated and I see no more options for SSL mitm because of OSCP/HSTS and browser counter measures.. Is SSL so unbreakable to common sys admins? As the owner of ...