A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to the attacker.

learn more… | top users | synonyms (1)

3
votes
1answer
49 views

If I visit a https site from a Family Safety-enabled computer, and someone drops in on the connection, will I be notified?

While reading about Family Safety and HTTPS: Since HTTPS is designed to prevent snooping, Microsoft Family Safety would be unable to monitor the encrypted traffic unless it performs what is ...
2
votes
4answers
3k views

Can I listen to a remote IP's traffic using Wireshark? (Man in the Middle)

How can I listen to a remote IP's traffic using Wireshark? (Man in the Middle)
0
votes
2answers
182 views

Does public key auth in SSH prevent most MITM attacks?

I found this article that claims asymmetric crypto signature of DH-obtained key prevents MITM: http://www.gremwell.com/ssh-mitm-public-key-authentication Key idea: The value of 'signature' is a ...
-1
votes
0answers
39 views

What is the Security Impact of HTTP1.0?

Nessus and other tools are detecting HTTP1.0 vulnerability. The status of the severity is "Informational" only. But what is the impact of this issue and how attacker can perform using this ...
3
votes
3answers
2k views

How trustable are third party root certificates?

I recently tried to use Fiddler2 from a third-party vendor Telerik. While decrypting the HTTPS traffic of my network, it asked me to install its own root certificate in my Windows operating system: ...
2
votes
1answer
194 views

“What's my IP” shows a different result when running over https than over http [closed]

We had issues with one internet provider, and switched to another one. However, we received word that the new internet provider is somewhat affiliated with the previous. When running a "what's my ip" ...
1
vote
3answers
109 views

What is the best way to run MitM attack on my wireless network?

For research purpose, I want to launch a MitM attack on computers that are connected to my wireless network. I wonder what is the best way to do so. Notice that I control the router, and do not want ...
0
votes
1answer
87 views

MITM faking certificates

I am looking at the theory behind MITM attacks in order to see some unencrypted packets from the 3DS. From research here is what I understand so far: 3DS > Proxy > Nintendo server I am going to try ...
3
votes
3answers
164 views

With HTTPS, what information would a MitM attacker be able to glean?

Consider a user accessing a site that is using HTTPS for all its traffic. A hacker is trying to use a man-in-the-middle to snoop on the user. What information can he glean? Obviously the content is ...
0
votes
0answers
45 views

Is it possible to intercept traffic by using a WAN facing DHCP server on an ISPs cable network?

I am running pfSense on an edge firewall conncted to a cable line. I can see many DHCP requests hitting my firewall. I guess this requests are getting send by cable modems currently booting up and ...
1
vote
2answers
75 views

MITM on program with no proxy settings

I'm trying to inspect the traffic of a program (which is running on my computer) that uses SSL over TCP to a non-standard port. The traffic may or may not be HTTP traffic, likely isn't. Neither ...
0
votes
1answer
79 views

TLS Authentication/OpenVPN/MITM Attacks on Public Wifi [duplicate]

My question is about how an SSL VPN connection such as OpenVPN is protected against MITM/Spoofing attacks on a public Wifi. For example, if somebody has a 'pineapple' or router setup as a honeypot ...
0
votes
0answers
55 views

Victim loses Internet connection during MITM attack

I tried to do MITM attack on my network. I enabled ettercap, marked my router as TARGET1 and my second computer as TARGET2. Then I enabled 'ARP Spoofing'. I do not know why - but after this operation ...
6
votes
2answers
189 views

Remediation against relay attacks (ie. NFC)

Question first: Is there any remediation for passive MITM? I've come across examples of NFC relay attacks which use phones to get around the proximity requirement for NFC payments. It looks ...
2
votes
1answer
43 views

BTLE pairing: Where does the code come from?

When trying to pair 2 bluetooth LE devices (e.g. 2 iPhones), a popup shows up that requires to input a code displayed on the other device. I am aware of the concept of out-of-band authentication, and ...
0
votes
1answer
253 views

CAPTCHA Bypassing with Captcha Clipping Attack is Like MiTM between servers, Is that even Possible?

Sorry if this is a very amateur question. I was checking out some article regarding CAPTCHA bypassing. And I though this article seemed interesting ...
1
vote
2answers
239 views

Intercepting SSL traffic on Android app

I am trying to intercept SSL traffic from my Android app to test the security. I am using certificate pinning in the hopes I can prevent people from snooping. I have tested by configuring ProxyDroid ...
2
votes
1answer
70 views

Local AP - Outside Router MitM Attack?

Let's say that we have our computer inside the local network. Our local network is connected to the Internet by AP+Router that connects to the router in other network which is connected to the ISP. ...
6
votes
1answer
116 views

What to do about “approved” direct banking MITM sites like sofort.com?

Brussels Airlines allows several payment types, only two of which are free: Maestro and Sofort Banking: The second option was new to me, but direct debit is usually a free and practical way to pay: ...
-1
votes
2answers
107 views

Can I create a fake AP with my wireless card? [closed]

I type iw list and these are the supported modes: Supported interface modes: * IBSS * managed When I run hostapd hostapd.conf I get this: Failed to create ...
4
votes
2answers
234 views

Why Sniff Session Cookies when UN/PW should also be available?

I've recently been reading on session cookies and how they can be hijacked via man-in-middle attacks. It seems this is mainly possible on an unencrypted connection between a client and a webserver. ...
0
votes
2answers
129 views

How much does a GET request over HTTPS reveal to an eavesdropper

Correct me if I am wrong, according to HTTP v1.1 a simple CONNECT request initiates a SSL tunnel between the server and a client. its only after the tunnel is created that the complete GET or POST ...
8
votes
1answer
448 views

How well is the SSL/TLS handshake protected against modifications?

The SSL/TLS handshake is protected against downgrade attempts by the Finished message, a signed and authenticated hash of the master secret and all previous handshake messages. Consider a client that ...
3
votes
1answer
920 views

How can the OpenSSL CCS Injection vulnerability (CVE-2014-0224) be exploited?

Just curious how this one works in practice and if it's as much of a risk as has been made out? It says you actively require a MiTM scenario, which is understandable, but then what are the steps to ...
2
votes
2answers
124 views

Decrypting TLS Traffic

Context: I want to reverse engineer a protocol in place for the Nintendo 3DS. The implementation however, uses TLS, which makes it difficult to reverse engineer. I'm currently able to sniff packets ...
5
votes
1answer
3k views

ECDHE_RSA and gmail

I'm using Chrome on Ubuntu Linux to connect to Gmail. The connection info says that ECDHE_RSA is used for the https symmetric key exchange. Based on my understanding of TLS and Gmail, my client ...
2
votes
4answers
503 views

MiTM, can a binary file be changed or swapped enroute

I genuinely looked for an answer to this but my terminology is lacking. If an attacker was in a MiTM position running a proxy, wouldn't it be possible for them to detect a binary like an .exe or .pdf ...
1
vote
1answer
126 views

Chat encryption system avoiding protocol sniffing and then key+decryption replay?

I'm working on a chat system and I want to add it some kind of security (not just HTTPS with SSL since I've read it can be sniffed and decrypted with a few tools). Now, my knowledge in cryptography is ...
-3
votes
3answers
154 views

How to capture the traffic of a computer in my LAN?

I have a machine with the Windows 10 preview installed and I want to capture all the traffic it sends for a day and then block all the MS hosts it sent data to without my direct permission. I don't ...
12
votes
6answers
3k views

Does the US government protect its physical internet lines in the US?

It seems like there are lots of ways to prevent man in the middle attacks. I've read many on here and on the rest of the internet. According to wiki you need a secure channel as well to completely ...
1
vote
2answers
998 views

SSL / TLS Renegotiation Handshakes MiTM Plaintext Data Injection- medium or low risk?

This is a Nessus finding, which is considered medium by default. Basically it may allow for some plaintext injection which may allow for some man in the middling. My question is, has these been ...
125
votes
4answers
14k views

Is there anything preventing the NSA from becoming a root CA?

There are now tons of Certification Authorities (CAs) that are trusted by default in major OS's, many of which are unrecognizable without online lookup or reference. While there have been attempts ...
16
votes
2answers
2k views

Why is TLS_FALLBACK_SCSV secure against a MITM attack?

It is recommended, to mitigate POODLE, if SSLv3 cannot be disabled entirely, to make use of TLS_FALLBACK_SCSV, a signaling cipher suite value that indicates that fallback has occurred. The draft ...
6
votes
2answers
2k views

How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy?

I'm working on one client's network where they have enabled HTTPS authority spoofing on their proxy. This allows them to effectively perform a man-in-the-middle attack to decipher all outgoing ...
2
votes
1answer
80 views

Could I counter SiteKey MitM attack with user-agent identification?

I find it very strange that bank use service like SiteKey without user-agent identification. This still makes them very vulnerable to MitM attack which is exactly what they are trying to protect ...
1
vote
2answers
347 views

SSLv3 cannot be disabled, can I use weak cipher as a workaround?

We're using lighttpd 1.5.0-2349 which unfortunately doesn't support the option to disable SSLv3. I think a potential workaround would be to only allow it to use some cipher which has already been ...
0
votes
1answer
89 views

arp spoofing in VMware ESXi

I have a VMware ESXi server and I want to create two virtual machines with specific public IP addresses. Is it possible for the 2 virtual machines to sniff each other's traffic ? If so how can it be ...
1
vote
1answer
133 views

MITM Attacks with Web GUI

I'm thinking of writing an application that communicates sensitive information (using Python, if that's relevant). Instead of using the standard GUI libraries (like GTK, Qt or wxWidgets), I was ...
2
votes
2answers
82 views

Securing commands

For a project I'm working on, I need to securely send commands between servers. These commands should not be able to be altered, and there should be some security about not being able to just keep ...
0
votes
5answers
155 views

Are most MiTM attacks done to impersonate web sites, or simply decrypt traffic?

The more I read about impersonating web sites the more I get confused. Does an attacker need the private key of the server in order to impersonate a website or does having the private key simply give ...
2
votes
1answer
139 views

How to secure my ajax call to the backend?

In my website I'm using an ajax call to get some information from the backend. Even if I'm using SSL someone can intercept the call and replace the real response with a fake one. Is there a way to be ...
0
votes
1answer
112 views

Why can't all wireless cards perform packet injection?

If a wireless card can send packets, why can't it inject packets? All have to do to inject a packet is create a raw socket, construct a packet with the spoofed headers and then send the packet ...
2
votes
2answers
150 views

Does a self-signed certificate offer more protection than a public key?

I'm having a hard time finding the practical benefits of transmitting a self-signed certificate over simply a public key. I understand that a self-signed certificate proves the integrity of the public ...
1
vote
1answer
135 views

Can't I forge an SSL certificate? [duplicate]

I read What's keeping a malicious man in the middle server from forging a valid certificate?, but when the client goes to verify the certificate, can't an attacker intercept that connection and say ...
1
vote
0answers
90 views

Deauth attack without being able to contact the AP

In my home pentest lab I though it would be interesting to try this scenario and see if it works: I have 2 computers and 1 AP, computer A is authenticated to the access point with WPA2 and computer B ...
3
votes
2answers
744 views

How to simulate man in the middle attack in android emulator?

I am new to pen-testing. Yesterday i analysed one android application using dex2jar application and i saw an android application implemented https connection using empty trust manager. class miTM ...
0
votes
1answer
266 views

Why is stackoverflow not using HTTPS for all it's page?

Most webpage from stackoverflow use http even if you are logged in. Isn't it a security issue? Could an eavesdropper steal my session and authentication cookie then impersonate me since it's sent ...
1
vote
1answer
129 views

What is stopping me from replaying an SSL certificate?

Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in ...
0
votes
1answer
383 views

Can eavesdropping be facilitated by injecting content that will be transmitted?

I was asked during a job interview the following question, to which I couldn't find an answer then, and this thing is still bothering me. I was hoping someone might know the answer here: Consider ...
2
votes
2answers
277 views

How to avoid session fixation (Login CSRF) by MitM attack without HSTS?

I'm writing a web app that already uses TLS encrypted connections (HTTPS), Secure; HttpOnly session cookie, HMAC-SHA1 CSRF token, requires correct Referer header to avoid Login CSRF and changes ...