There is an example for illustration purposes:

Let's suppose that there is educational site about Celtic mythology. It's purely read-only site, not even comments are allowed. It's also very simple, it has no executable parts like Javascript/Flash/Java/Silverlight/Unity/ActiveX. There are no ads because the site lives on donations. In short, this is just collection of completely harmless HTML documents.

But this site uses HTTP instead of HTTPS. Does it mean that theoretically some malicious agent (like hacker, malware from other machine or ISP) could become "man-in-the-middle" and inject malicious Javascript (for example) into transfered page, despite that the original page had no Javascripts at all?


A man in the middle can answer the plain HTTP requests sent by the client on behalf of the server. This includes modifying the original response of the server to include Javascript which gets executed in the context of the page. Or the attacker might serve some malware to the visitor. It does not matter at all in these cases that the original site had only static HTML, all what matters is what the attacker serves. In fact, the attacker might serve completely different content without even contacting the original site.

| improve this answer | |
  • The only addition I have to this answer is if you want to see how easy that is to do, look up MiTMF on YouTube – Anthony Russell Jun 30 '18 at 13:01
  • As an additional detail, this is why chrome refuses (by default) to scripts served over HTTP to an HTTPS site. Doing such a thing completely breaks any semblance of security gained by TLS encryption because javascript access lets an attacker do anything with their cleartext access – Sirens Jun 30 '18 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.