Questions tagged [man-in-the-middle]

A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to each other via the attacker in the middle.

Filter by
Sorted by
Tagged with
1
vote
3answers
91 views

Are TLS v1.3 connections over open Wi-Fi secure?

If a non-compromised device is connected to the internet via open Wi-Fi, anyone can view the traffic. But if all the connections to the servers use a reasonably secure cryptographic protocol (such as ...
0
votes
0answers
43 views

How wifi network MITM works?

I have seen a lot of tutorials showing how to MITM a network using various tools. But it usually says that we require a network adapter with monitor mode options. I own my wifi router and can connect ...
2
votes
1answer
730 views

Is it secure to share a public (RSA) key over http?

The following scenario: We have a HTTP (not HTTPS, so unencrypted) server which contains an open (RSA) public key. The general sharing of the public key should not be a problem since it is the public ...
1
vote
2answers
208 views

What are possible implications of ignoring the ssh host key warning?

With password authentication you're basically giving your password to the attacker. At least that is my understanding. What about public key authentication? I hear that a private key never leaves your ...
1
vote
1answer
56 views

Does the lack of a secure channel really allow a replay attack to HOTP?

RFC 4226 on HOTP (7.1 Authentication Protocol Requirements) says RP3 - P [the protocol] SHOULD be implemented over a secure channel in order to protect users' privacy and avoid replay attacks. But ...
0
votes
1answer
43 views

"Mutuality" of public key authentication

I'm a newbie when it comes to cryptographic security, but there's something I'm not quite getting concerning the "mutual" aspect of public key authentication. Say you have a client X, and ...
1
vote
1answer
46 views

Simple Key Exchange, One Server

Posted this on Cryptography; reposting here in case it's more relevant. I am trying to better understand how TLS works. I understand in the normal use case you need various random values generated and ...
2
votes
1answer
116 views

SSH Agent Forwarding - What are the best practices and current security issues?

Using agent forwarding comes with a risk, but stored private keys can also abused if the attacker has compromised the remote machine. In this thread I want to discuss, if agent forwarding is save to ...
15
votes
3answers
3k views

Can an HTTPS request be sent twice?

When sniffing network traffic, one can see an HTTPS packet and all its (encrypted) data. I am wondering what would happen if this packet is copied and then re-sent. Is there a protocol at some layer ...
0
votes
0answers
60 views

Why my certificate does not have OCSP must-staple extension even when CSR contains it, is OCSP must-staple still used?

We received recently security report with [low] security issue: Missing "Must-Staple" extension on certificate. With help of old article oscp-must-staple I managed to create CRA with ...
0
votes
1answer
110 views

How google is protecting the MITM attack

If we intercept Google account creation form using burp and change any form data, even a single character in the first name and forward the request will result in to "Some thing went wrong" ...
2
votes
2answers
91 views

SSH: MITM attack during fingerprint verification?

The first time I connect via SSH, a "fingerprint" appears. How can I be sure that it belongs to my server/router/etc. and has not been tampered with by a fraudster (MITM)? For example, for ...
1
vote
1answer
77 views

Could a bad actor get hold of your credential sent via https if you are connect to their fake network?

Imagine this typical Fake WiFi scenario: A bad actor creates a fake coffee shop Wifi and therefore is in full control of the network. An unsuspecting victim would connect to the Wifi and log in to ...
0
votes
1answer
85 views

Could having intermediate CA not installed to trust store be a vulnerability?

I've read through several articles and posts here and on other resources and I'm still confused. Say I have a key pair, and I got a server certificate for my public key from some trusted CA. Now I'm ...
1
vote
1answer
166 views

How can someone on the same GPON splitter network sniff my internet traffic?

I currently have a fiber optic internet connection at home. My ISP uses GPON where the ONU acts as a gateway device which has a direct fiber optic connection to it. ONU is a Huawei HG8145V5. I ...
0
votes
1answer
105 views

Intercepting responses using mitmproxy in Python. Problem in decryption

I have set up MitmProxy with a Python script to intercept network responses from one domain, used by a Desktop App. However, when I start up the App, I get the following series of transactions { &...
0
votes
0answers
19 views

MITM attack on public wi-fi and ISP wired connection [duplicate]

I know how MITM attacks work (theory/videos on the subject etc), but I am a bit confused and not sure what are the worst-case scenarios that can happen. If I'm using a public VPN and someone is indeed ...
0
votes
1answer
90 views

How to prevent server know what data is being transferred through it between two clients

Imagine a web application in which two computers can communicate with each other by transferring files, through the server linked with some unique password. Every file sent between the clients are ...
0
votes
2answers
106 views

Tool for injecting data in existing tcp connection

I would like to perform arp spoofing on an existing tcp connection between a server and a client and perform a mitm attack. In addition to altering existing packets, I would like to be able to inject ...
0
votes
2answers
86 views

With Network Security Systems Decrypting SSL traffic to scan for Malware Is Server-Side hashing of Credentials Still Enough?

I am not a Security Expert by any means. Nor am I a Cryptographer. That's why I'm here. After discovering that the server side of some software I work on was operating on plain text passwords (though ...
0
votes
0answers
57 views

Possibility of Man-in-the-middle Attack on Homebrew

It has been brought up in the past that package managers such as pip are vulnerable to man in the middle attacks (see https://www.reddit.com/r/Python/comments/17rfh7/...
0
votes
1answer
73 views

How to encrypt http traffic in an offline enterprise network?

I am building a golang offline application for a company that will operate in their office internal Wireless / Wired Network. There will be one server computer and many client computers communicating ...
1
vote
1answer
86 views

How vulnerable is security if a public key is swapped by active attacker if a key check is done?

Trying to understand this from a high level conceptually. It is obvious from all information on Asymmetric encryption that a public key can be of course, public and there isn't a danger of ...
1
vote
0answers
70 views

What prevents attackers from posing as legitimate smb server?

Let's suppose on my computer was a connection to a smb network share, set to reconnect automatically on startup. Now one of the following things happens: The computer is booted up in another network ...
0
votes
2answers
78 views

PCI DSS Compliance and Firewalling Dynamic Hosts with MITM Certificates

Question Would using a firewall MITM capability to inspect all HTTPS web requests be against PCI compliance/rules? Further Info We have an issue where we need to allow access to some HTTPS sites on ...
0
votes
0answers
56 views

is MITM attack possible when we verify only the jump host's fingerprint (host key)?

I am connecting to remote hosts via jump host where I verify only the jump host's host key, but turn off host key verification for the target hosts. the ssh command arguments look like this: -o ...
0
votes
1answer
175 views

Can this be MITM attack?

a friend of mine wanted to install MongoDB Community when he encountered a problem. The .msi file downloaded from https://www.mongodb.com/try/download/community was rejected by Windows when he tried ...
0
votes
1answer
74 views

Man-in-the-Middle Mobile (e.g. Android) Application Tool

I'm trying to MITM an Android application but I cannot get it to work properly. Usually, I'm using Burp for those kind of attacks, which allows me to intercept and decrypt HTTPS traffic. (Assuming the ...
0
votes
1answer
106 views

Forging SSL certificate to the browser

A man in the middle attacker can intercept and send a different certificate (a self-signed one, maybe) to the browser. In this case, browser will show warning to the user and doesn't display's the ...
1
vote
0answers
68 views

Decoupled authentication flow, very vulnerable to Man in the Middle attacks?

I'm in the process of building a kinda odd mechanism to "bypass" authentication. Which of course I know its weird, but many business requirements are weird... So it is a design that derives ...
81
votes
7answers
20k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
1
vote
1answer
156 views

AES-256-GCM transfer IV and AuthTag

Question is for transfer encrypted data between two services (Like HTTP, GRPC or etc...) Can I transfer IV and AuthTag in plain, Is this approach secure? I have sample code in Node.js and I'm not ...
0
votes
0answers
81 views

Using AWS: Is it possible to hide the traffic from amazon?

Assuming I use AWS to host a service with quite sensitive personal data, is it possible to hide traffic and stored data from amazon? I would assume the answer is no. I think I need to provide all the ...
0
votes
0answers
13 views

What if there is a "man in the middle" between the client and the certification authority and the same MITM is also between Client and server? [duplicate]

I've read other some articles (including this: https://medium.com/@technospace/tls-handshake-under-the-hood-79d20c0020de) and similar questions but none exactly like this hypothetical scenario. What ...
0
votes
0answers
423 views

Site "Not Secure" warning on Safari iOS, only on one device

Summary We are running a web site (https only) and have a single bug report from a user that says the site gets warned as "Not secure". The user gets this warning only when accessing it from ...
0
votes
0answers
50 views

Running ARP Spoof disables internet access on target machine, doesn't intercept traffic as well

So I'm learning to run MITM attacks on my own WiFi network but I seem to be running into an issue. I'm following this tutorial. The process is simple and I'm running the attack from my Ubuntu laptop. ...
0
votes
1answer
107 views

How to check TCP sequence number to detect mitm?

I suspect that my router (I'm using an iPhone as router) has been owned and the attacker is making some kind of mitm attack. I suspect also that some html and js code has not been sent to my laptop ...
0
votes
0answers
43 views

ARP Spoofing: Replying to requests meant for spoofed IP, while also being able to communicate with spoofed IP

I am simulating an ARP Spoofing attack on a local network. I have an Attacker machine on Linux, a web server, and a Victim machine which is trying to access the web server. I am successfully able to ...
0
votes
2answers
101 views

Tactics to ensure payload has not been modified

When sending a request (POST, PUT, etc). I have a security requirement to ensure that the data in the payload has not been tampered with. In other words I need to know with certainty that the data ...
18
votes
3answers
5k views

Why are SSH MITM tools able to read and modify data?

At my university, we are learning how to use SSH for server administration. We learned that SSH is secure, but there are some tools that allow man-in-the-middle attacks on SSH. How can such tools ...
0
votes
3answers
153 views

Multiple devices encrypting data using the same key?

I want to implement a service that can't read the data you store there. The Idea is that I, like in a password manager, use the password to derive a vault key, which is different from the ...
0
votes
1answer
105 views

Can a Man-in-the-Middle-Attack be achieved by adding a cloudfront distribution origin of a domain not owned by me?

Cloudfront supports adding external origins, i.e. domains that are not S3 buckets or ALBs. This led me to wonder whether adding domains that are not owned by the entity as an origin could allow for ...
0
votes
0answers
37 views

Possible to automatically store responses in Proxy?

I filter some responses in the HTTP history and would like to automatically store new incoming responses somewhere on disk so I can process these data in another automated script. Is there an... ...
14
votes
2answers
3k views

Ongoing effort to detect MitM attack on TLS?

Client B connects to server A using TLS. B knows A by it's FQDN (e.g. www.alice.tld), and by a root certificate for a CA that issued a certificate to A for this FQDN. Say B uses HTTPS and a standard ...
0
votes
0answers
67 views

SSL stripping - how is it possible to send back the HTTP page? [duplicate]

Been trying to wrap my head around SSL stripping. An explanation here writes: Keep in mind, however, that when you install SSL, you’re essentially creating a duplicate of your website with HTTPS URLs....
1
vote
1answer
40 views

How Data Link layer trailer prevents data from being intercepted and tampers

I am reading on https://tryhackme.com/room/introtonetworking, it is talking about OSI model. It said that Data Link layer trailer can increase security as the data can't be intercepted and tampered. ...
0
votes
0answers
41 views

How does https block the man in the middle from just forwarding the certificate chain? [duplicate]

Suppose I have a client : Alice and a server: Bob A ---- B There is a Charles in between. A ----- C ----- B When Alice asks for bob's public key and certificate. Charles can intercept this and form a ...
1
vote
0answers
67 views

How to interpret received packets, although not being destination host

Set up: Victim: 192.168.0.2 Attacker (also having SSH server installed): 192.168.0.3 SSH server: 192.168.0.4 I perform a successful ARP Spoofing attack (being obviously the attacker's MAC address): ...
0
votes
0answers
173 views

How to redirect ettercap or arp poisoned traffic to burp suite or mitmproxy?

I have poisoned the target using Ettercap and redirected the traffic to my IP address. The question is, how to intercept and modify this traffic using burp suite or mitm proxy? The only condition is, ...
0
votes
0answers
33 views

Can a man-in-the-middle replay a valid X.509 certificate? [duplicate]

Consider the following scenario: M (who will later be the man-in-the-middle) connects via https to bank.com. He saves the X.509 certificate (or certificate chain) received from bank.com. Alice ...

1
2 3 4 5
26