1

For research purposes.

I'm wondering, in a high level way, how MITM attacks are actually done in the real world.

So over the internet the client talks to the server, or one person emails the other, and basically all that is happening is that packets of information are being send from A to B, right? My question is, what are the methods for an attacker to get hold of the communications mid transit, over the internet, and attack as a MITM?

The adversary can be NSA or a local enthusiast in a coffee shop. I just want to know a list of the different methods a MITM attacker can actually intercept communications and act as a MITM. Maybe listing some software as well, eg., explaining how something like Wireshark actually works.

Many thanks for the help.

edit: I don't think my question needs is so broad you have to close it. i just want to know the different techniques for being a man-in-the-middle. Literally, if Alice sends emails to Bob, how does Eve spy on this connection?

closed as too broad by Ulkoma, Steffen Ullrich, StackzOfZtuff, Adi, Stephane Oct 12 '15 at 12:26

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • How powerful is your attacker? Nation-state? Disgruntled janitor? – StackzOfZtuff Oct 12 '15 at 10:53
  • Either. I just want to know a list of the different methods a MITM attacker can actually intercept communications and act as a MITIM. Maybe listing some software as well, eg., explaining how something like Wireshark actually works. – Lewis Oct 12 '15 at 10:58
  • It actually is really broad, man. Liiike there are so many different ways it could be done. Imagine there are two people writing notes on paper airplanes in order to communicate with each other from across the room. How would a man in the middle intercept the messages in transit? It's hard to give a suitable answer. I will have a crack at it when I have a bit more free time though. – tjt263 Oct 12 '15 at 13:04
  • Thanks for trying. I was thinking there must be really common ways to do it - eg., snopping wifi connections? I read something about DNS spoofing? If snooping wifi connections is a thing, how does it actually work? Like how does my computer look at the wifi connection and know which IP address is connecting to what? I just really want to understand it... – Lewis Oct 12 '15 at 13:08
2

There are a large number of ways you could MitM on the internet, but it is so much more easier and reliable if on the same network (in my opinion).

The way I would do it over the web is trying to use a service someone has connected to (a website, application, proxy) the proxy is the most dangerous one as you control their traffic routing, which means you can serve up false https certs decode and be the man in the middle. or just generally mess with them.

a victim needs a certain level of understanding (none basically) in order to fall for such a weak attack.

when within a home network its alot more fun, inject the victim and router with arps and force control, rather than waiting for them to fall in your trap.

network = hunter like a tiger forcing, chasing your pray. internet = hunter like a spider, waiting for the the pray to fall in your trap.

Not the answer you're looking for? Browse other questions tagged or ask your own question.