Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [man-in-the-middle]

A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to each other via the attacker in the middle.

0
votes
0answers
40 views

Problems relaying NTLMv2 with Responder and MultiRelay

I'm currently experimenting with mitm relay attacks using Responder.py and MultiRelay.py tool and running into problems. I have the following LAB setup: Kali Box: IP: 192.168.1.13 ...
0
votes
0answers
48 views

no HSTS but still protected to mitm attacks?

i am aware of HSTS and their directives... If you had enabled HSTS on your site however, and this user has visited your site before, the browser will remember it should go back to https. As the fake ...
0
votes
1answer
46 views

Does SSLSTRIP in MITMF only works when the victim visits for the first time?

I just started learning MITM attacks and I use MITMF to perfom these attacks. I have one question regarding to sslstrip. I notice that sslstrip only works when we first clear the cache and history in ...
15
votes
2answers
5k views

Possibility of faking someone's public key

I know how public key cryptography works; (very) simplified: Alice takes Bob's public key and sends an encrypted message with said key and sends it to Bob. Bob and only Bob can decrypt the message, ...
1
vote
0answers
62 views

What are the risks involved in blindly trusting all certificates for https requests over unknown proxy servers?

My use case is a Java application where no sensitive data being transmitted whatsoever, and the response being accurate (i.e. unmodified) is unimportant.
1
vote
1answer
48 views

Use subject key identifier for certificate pinning

As said here, certificate (or public key) pinning refers to a certificate (or a public key) which is hardcoded in the app that we want to protect and then compared to the one provided by the server. ...
1
vote
1answer
69 views

Is it possible to exploit XSS by replacing image data for img tag

If I have HTML page served over https with image loaded over http (image from other domain): <img src="http://some-image.png"/> so it's possible to inject any data to browser as image by using ...
4
votes
2answers
1k views

Is SSH secure against MiTM if server fingerprint is not checked, public key authentication is used and confidentiality is not needed for that service?

When connecting to a server for the first time, ssh usually requires users to check server's fingerprint and then caches the info. This is needed in order to prevent MiTM. Is it a design flaw in SSH ...
0
votes
0answers
40 views

sslstrip partially working

I'm currently working on a MITM + sslstrip attack educational talk to create awareness on the importance on checking certificates specially if connected to public WiFi and having strong WiFi passwords ...
1
vote
0answers
44 views

How secure is my apartment's building wide wifi network using Spectrum Community Solutions?

Recently my apartment moved from having individual modems (with our own router/wifi network) to this Spectrum Community Solutions building wide network. Everyone can connect to the network anywhere, ...
2
votes
1answer
45 views

How to protect against mitm attacks in first connection? - no HSTS Preload

i have been searching around this area about mitm attacks and realize that every single page that doesn't have HSTS preload is vunerable to mitm attacks in first connection to the site. the solution ...
2
votes
1answer
163 views

Am I actually seeing a Man-in-the-Middle when pushing to GitHub?

When I attempt git push origin, I get the following error: @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@ @ WARNING: REMOTE HOST IDENTIFICATION HAS CHANGED! @ @@@@@@@@@@@@@@@@@@@@...
0
votes
1answer
43 views

Is it safe to use RPC with sensitive data through an encrypted VPN connection instead of SSL/TLS?

I have an application where there I'm planning the following setup: user <-----------------> layer 1 server <------------------> backend server internet (https) ...
0
votes
1answer
85 views

Client HTTPS request redirection attack

Assume a Mam in the Middle that wants to redirect a client's HTTPS (Secure HTTPS) request from a.com to b.com. The MitM can not impersonate neither a.com nor b.com. The MitM does not have to use a TLS ...
1
vote
1answer
53 views

Self-signed certificates and ephemeral Diffie–Hellman key exchange protocol

If we use a self-signed certificate, is ephemeral Diffie–Hellman key exchange protocol vulnerable to a man in the middle attack?
0
votes
2answers
131 views

How to conduct this MITM attack [duplicate]

For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is: 1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The ...
0
votes
0answers
77 views

HTTPS MITM Proxy breaks HTTPS

I tried to reverse engineer an Android APP using MITMProxy, and the Server responds with an unauthenticated-error. If the whole authentication would be using headers (Basic, etc...), the Proxy should ...
0
votes
1answer
83 views

How to implement an active Man-In-The-Middle attack that changes the request URL address

For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack. The attack scenario that I want to do is a toy example (which has countermeasures ...
-5
votes
1answer
215 views

Monitor SSL traffic at home

There is an underage guest in my house for whom I will be legally responsible for the next few months and I'm concerned about some of his interactions online from some of the public postings I've seen ...
0
votes
0answers
48 views

ettercap packet modification

I am trying to figure out how to write a plugin in ettercap which modifies the payload of a packet. I have a vm with a simply python socket server and a simply python client on the ettercap machine. ...
1
vote
1answer
50 views

Is a company decrypting all SSL traffic through a Root CA GDPR compliant? [closed]

I am wondering if a company employing EU citizens is allowed to decrypt SSL traffic of those citizens in a MITM style attack without even informing them what data is collected (without even notifying ...
2
votes
2answers
123 views

How can I trust a server's public host key when I first login remotely? [duplicate]

As I understand it, a host sends its public host key to the client to confirm it's the host the client intended to connect to. On initial login the host's public host key is added to the client's ~./...
1
vote
1answer
108 views

Capturing traffic on WiFi Network using Wireshark [duplicate]

Is it possible to capture, using Wireshark, regular data sent by another machine inside my Wireless LAN?
1
vote
2answers
179 views

Can't Cloudflare sniff sensitive login data from its users' websites?

So I recently started using the free Cloudflare plan for my website to provide any sort of protection. And I noticed that, given they do the whole "We'll accelerate your website by caching parts of ...
1
vote
1answer
173 views

What is more safe: 3g/4g or public wifi?

The scenario is: John is out of home and, using his smartphone, he need to send some messages from Whatsapp, use Facebook's app and do some bank operations. Since I have read this and this topics, I'...
0
votes
1answer
75 views

How do FIDO keys prevent MITM reflection attacks?

FIDO keys, used for 2 factor authentication are based on a challenge-response mechanism. Besides generating a common 1-time-key using diffie-hellman, or transferring all data over TLS, how can they ...
1
vote
1answer
41 views

Finding the reason behind an RDP Certificate Change (man in the middle attack?)

I've installed some new networking equipment: firewall, switches, vlans, etc. I won't mention the brand name here, because I don't want to cause them harm by my suspicions. Right after doing this, I ...
1
vote
2answers
47 views

Transactional replication through VPN, do I need to encrypt connection?

New to security. We are planning to setup SQL Server transaction replication over a VPN to Azure over the internet. The source server is inside our data center and the target will be a managed ...
1
vote
1answer
63 views

Can a SSH jump host act as MITM?

Let's say, for example, a company has a "centralised" SSH bastion/jump host on an untrusted server (e.g. a virtual machine in "the cloud"). Meanwhile the corporate/customer/whatever network(s) have ...
1
vote
1answer
75 views

Are self signed certs safe to a developer use in local debug?

The same computer I use for work in home, is the same for personal uses (gamimg, social medias) and of course, internet banking. I'm back-end developer and recently, I started to work with fiddler to ...
1
vote
1answer
99 views

Key reinstallation attack how does it work without a pre-shared key?

The author of the key reinstallation attack released scripts on Github to test AP and clients. To test the clients, you have to connect to a fake AP but you still need to know the pre-shared key. Of ...
2
votes
2answers
106 views

What is MITM attack in terms of implementation?

When I search for MITM in the google most of the results say an unauthorized person positions himself in a conversation between two authentic users for malicious reasons, and there are several types ...
-1
votes
2answers
129 views

How does this spyware intercept my https traffic? [duplicate]

The firm I'm working for has installed a "spying" software on my computer which intercepts my https traffic. No hard to understand how it works, it's something like mitmproxy, which signs on the fly ...
0
votes
0answers
165 views

What are the dangers of using 3g/4g in smartphones?

Since we should always avoid public networks, is there some sort of attack that intercept my online activity or steal passwords when I'm using 3g/4g? If exists, how I can protect myself from this type ...
0
votes
0answers
56 views

Arpspoof not working properly

I'm testing MITM packet manipulation on the fly between two computers on the same switch, a layer 2 switch. I'm using a Kali Linux machine as the attacker and i have written a python script to ...
0
votes
0answers
167 views

SSLStrip demonstration with bettercap 2.x

I'm trying to get bettercap 2.x working for an sslstrip proof of concept demonstration. I'm running it against a site that I know doesn't properly implement HSTS, found from several blogs. The site ...
0
votes
2answers
121 views

Aren't VPN servers exposed to the same threats as public Wi-Fi?

Besides trust of the VPN provider, are VPN servers safe? Other people connect to it and it can be compromised, right? Is it the same threat as being connected to a public Wi-Fi where someone could ...
3
votes
2answers
144 views

How to MiTM HTTP/2 Traffic

I recently had to MiTM an HTTP/2 connection over TLS and realized there is no MiTM tool out there that fully supports HTTP/2 over TLS, and no articles/blog posts written about this topic. After ...
0
votes
1answer
104 views

mitmf doesn't work when disabled ip forward

I have virtual machine windows connected to NAT network. I also have kali linux virtual machine connected to same NAT network. I have port forwarding disabled. cat /proc/sys/net/ipv4/ip_forward gives ...
3
votes
0answers
40 views

Risks of not enabling HSTS on a static content subdomain. Even though main domain does have hsts

I'm investigating an issue where our static content (js, css) is deployed in AWS Cloudfront under a subdomain of our main website and doesn't have HSTS enabled. The main domain does have HSTS enabled ...
2
votes
2answers
252 views

Wi-Fi Pineapple Device - is it that easy to steal people's info?

I've been doing research on the internet relating to cybersecurity and I came across an article talking about a "Wi-Fi Pineapple". The article made it seem like anyone can buy this and basically ...
1
vote
1answer
78 views

What are the ways to identify a DNS cache poisoning attack?

Consider a scenario: (at victims end) in DNS cache poisoning attack. When the victim will go to a website (eg: gmail.com), he will be taken to some other phishy website. Now here the URL remains the ...
0
votes
0answers
41 views

IPSec Sniff Traffic

I'm wondering if it is possible to Sniff IPSec connections. At the beginning of a connection, the two peers agree on a SA and exchange a PSK or Certificates. What I'm thinking about, is to ...
0
votes
1answer
97 views

Why does Cain and Abel downgrade SSH version 2 to v 1.51?

I am developing a lab exercise with Cain and Abel and want to know why it is necessary to downgrade SSH before attacking. Identification phase The server sends to the client an identification ...
0
votes
0answers
45 views

How to check if installed Trusted CAs are not dangerous? [duplicate]

I've checked my Windows 7 installed Trusted Certificate Authorities using MMC tool as below: Questions are: How can I be sure that they are genuine and are installed by Microsoft and not by a third-...
7
votes
2answers
993 views

Why is Huawei's potential spying activity a big issue given that communication protocols are supposed to be secure from MITM attacks? [duplicate]

As far as I understand, Huawei is currently accused of supplying hardware to Western countries that could be used for spying by the Chinese government. But why would this be a big deal? Properly ...
0
votes
1answer
80 views

How can I see the data content (HTML, JS, etc) in HTTPS responses in Wireshark?

I'm learning packet sniffing and analysis with Wireshark. At first, I could only see DNS, TCP, and ARP packets. I learned I couldn't see any HTTP packets because it was all encrypted in the transport ...
0
votes
1answer
378 views

How to do Mobile application testing using Burp Suite on latest ios and android devices

I am trying to intercept the request with burp suite for mobile application pen testing on iOS and Android devices. Here are the settings below which I have done in below points. I made sure that my ...
0
votes
2answers
101 views

What are MITM proxies used for in enterprises?

My company (like many others I assume), uses a "man in the middle" proxy with a personal root CA. Disclaimer : I'm not a security expert so perhaps I do not correctly understand what this network ...
1
vote
1answer
81 views

Is it possible to intercept HTTPS payload with a trusted CA but send it the wrong server?

I have a CA generate a cert and private key for my server. My server, however, does not have a domain name and its IP is dynamic and never static therefore validation of the host name must be ignored ...