Questions tagged [man-in-the-middle]
A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to each other via the attacker in the middle.
1,376
questions
2
votes
2
answers
626
views
Are my internal systems susceptible to MitM if the root/chain is shared amongst all customers?
Suppose that my certificate authority issues private certificates using the same chain for all of their customers. Does this mean that a malicious actor who happens to be another one of their ...
- 2,289
49
votes
6
answers
10k
views
My school wants me to download an SSL certificate to connect to WiFi. Can I just avoid doing anything private while on the WiFi?
I go to a secondary school and want to use my Macbook Air to type out long essays. The school won't allow anyone to connect to the WiFi unless we download an SSL certificate (the file is labelled as ...
- 451
0
votes
1
answer
71
views
Security measures with JSONs watermarking and such
I have an interesting problem to tackle, let's say we have different clients for an app that we serve some JSON documents. If, perchance, some leak happens I'd like to know from which client the leak ...
- 121
1
vote
0
answers
94
views
Are some of my calls to my bank being intercepted?
For three of the past four months, I've had to call customer service regarding my credit card, which is issued by a major U.S. bank. I am suspicious that some of these calls were highjacked.
How can ...
- 126
0
votes
0
answers
30
views
Stolen certificate attack in MITM attack [duplicate]
Let say there is a client want to connect over https to a server. There is me, the attacker, in the middle between the client to the gateway.
The attacker (me) see that the client want to do TLS ...
- 1
1
vote
0
answers
49
views
Possible workaround for IP-MAC binding security feature on routers
I have been reading about the IP-MAC binding security feature on routers, and have found a possible technique to bypass it (have yet to test it, currently in the theory phase). Let's assume the ...
- 131
1
vote
1
answer
77
views
How to limit the Wireless CA can only use in wireless connection on Windows?
My school require me to install a CA to do connect to the school Wi-Fi network. In android, I can install it into Wireless CA list, and based on my understanding, that won't give the CA owner ...
- 11
1
vote
1
answer
95
views
ARP Spoof: Will it work on public wifi networks as compared to a home network?
I have recently successfully demonstrated a simple ARP spoofing attack on my home network. The setup in my home network, described to the best of my abilities is as follows:
Optical network router (...
- 131
1
vote
0
answers
34
views
Possibility of eavesdropping on app-server comms after redirect to deep link
I'm being asked to investigate a possible attack vector that I don't understand and I don't want to take action that is useless or even negatively affects users if it isn't going to address something ...
- 111
0
votes
1
answer
86
views
BankID and QR codes attacked by man-in-the-middle?
There is a general national login ID system used in the Nordics called BankID.
Very often a user will go to a website that employs the BankID login and click "login with QR". Having done so ...
- 103
7
votes
2
answers
4k
views
How should I report a Man-in-the-Middle attack in my workplace?
I work at a small-to-medium business. Most of my coworkers were born in the 1960s and do not have a background in computer science. I have a background in computer science, but I specialize in ...
- 181
2
votes
1
answer
61
views
Why is the "intermediate" challenge needed in Bluetooth ECDH since the "real" verification is performed at the end with code comparison?
Why is step 4 needed? What does it protect in terms of security? Doesn't the protection arrives from the last step so when Va and Vb (so called TK, Temporary Keys) are compared?
Other thing: I read ...
- 129
1
vote
0
answers
46
views
MITM experiment works with DLink DIR-605L but not Hitron CGN3AMF
I am trying to learn about man-in-the-middle. I was able to successfully demonstrate it in when I'm using a DLink DIR-605L wifi router that's connected to a Hitron CGN3AMF wifi modem. But I failed ...
- 307
1
vote
0
answers
167
views
Bettercap not detecting HTTPS websites (?)
The built-in sslstripping feature (http.proxy.sslstrip) in bettercap is not working against HTTPS websites in this issue I will be using cygwin.com and winzip.com as an example, as we can see they are ...
0
votes
0
answers
75
views
What kinds of attacks are eliminated in WPA2-PSK if for each device there's a different (secret) PSK?
With regular WPA2-PSK there's the fact that every device shares the same PSK, hence it's possible to impersonate the AP by setting up an Evil Twin and watching the traffic. This isn't possible without ...
- 81
0
votes
0
answers
71
views
What is the security impact of disabling certificate check [duplicate]
I have this line of code in a client server project:
sslContext.init(null, new TrustManager[]{new TrustAnyManager()}, null);
A security guy pointed out that this is skipping the validation of the ...
- 127
0
votes
0
answers
60
views
In TLS, how are the Diffie-Hellman exchange parameters protected from a MITM attack? [duplicate]
Authentication alone will not stop a MITHM from intercepting and modifying plaintext exchanges, since he can let the authentication occur, then begin modifying the exchange data and neither end will ...
- 23
1
vote
1
answer
189
views
Can a VPN company perform a MiTM attack if SSL Pinning is in place?
Recently, I read news about Facebook acquired the Onavo VPN company to monitor Snapchat users' traffic. It seems they executed a Man-in-the-Middle attack by replacing the certificate. But could they ...
- 13
1
vote
2
answers
71
views
Preventing Data Tampering in HTTPS Requests: Safeguarding User-Initiated Donations
Could a Man-in-the-Middle (MITM) attack compromise the integrity of user-initiated transactions over HTTPS? Specifically, if a user selects an amount to donate on a website, is it possible for a ...
- 13
0
votes
2
answers
144
views
How to Capture Mobile API Requests in burp when Server side pinning is implemented
I recently encountered a scenario where Mobile Application is generating CSR request, call a POST API request and in response, Ask Server for certificate. Server will respond with the temporary ...
- 153
0
votes
2
answers
141
views
Is a MITM attack possible for my apt repo?
OS is Debian. Imagine I have my own apt repo set up inside a private network.
This repo is set up to provide a single package to other servers on this network.
I can easily create a signing key for my ...
- 101
0
votes
1
answer
164
views
Fake access-point + custom DNS-server to intercept mobile app credentials? [duplicate]
Would it be possible to create a fake twin access-point for a router with a custom DNS-configuration in a way to fool mobile apps like for example Instagram to send authentication requests to my own ...
- 3,426
4
votes
2
answers
851
views
securely tunneling through a MITM proxy
I am wondering if there is a practical way to establish a secure, encrypted network connection through an MITM proxy given the ability to communicate secrets out-of-band with a second, external proxy. ...
0
votes
0
answers
103
views
Decrypt TLS (DHE cypher) inside of TDS (Microsoft SQL Tabular Data Stream protocol)
Is there a possibility to decrypt TLS data encapsulated within TDS Microsoft TSQL protocol?
The TLS handshake seems to occur within TDS data, right after the TDS pre-login
The handshake itself is ...
- 113
0
votes
1
answer
171
views
It is possible to receive ntlm response with ipv6. What about ipv4?
I performed ntlm relay attack with mitm6 and ntlmrelayx. I used mitm6 for dns spoofing. When the victim sent a query containing where the DHCP is located, I identified myself as the DHCP server. Then ...
- 13
2
votes
0
answers
95
views
Does DNSSEC prevent man-in-the-middle at all? [duplicate]
I just watched a video on DNS that explained that if there is a man-in-the-middle or if someone has taken over your resolver, DNSSEC can prevent the responses from being tampered with because the ...
- 23
0
votes
1
answer
360
views
Why can't we encrypt twice instead of having Cloudflare MITM half the internet?
First of all I want to address a thought I had which is that they might market their ability to read the encrypted code being sent so they can spot "bots" and such, and that this is why they ...
- 11
0
votes
3
answers
247
views
Does TLS interception necessarily require a self-signed certificate? Please explain why
A brief schema of a TLS intercepting proxy - the Client connects to the Host via the Proxy in a way which allows the Proxy to perform a (consensual) MITM.
[Client] -> [Proxy] -> [Host]
It's ...
- 511
0
votes
0
answers
235
views
Intercepting Android App: Google detects burp proxy and block the request to app
I was recently doing bug bounty on a website and found it also has an app so i tried to pentest on it using burpsuite via MITM and intercepting it through burp proxy
Though my request got blocked by ...
0
votes
0
answers
245
views
Router level SSL Inspection
Is there any way I could inspect the traffic from an untrusted device connected to my network? I would like to get a router that has ssl inspection capabilities, where I could check the https packets ...
- 1
1
vote
0
answers
95
views
Triple handshake (TLS) EMS protection against attacks
In TLS we have such an extension as EMS (extended master secret).
It has been applied to protect the master secret. But I don't understand how it helps against triple handshake attack.
I assume that ...
- 11
1
vote
1
answer
220
views
Is FIDO authN vulnerable to relay attacks?
In this question: Is FIDO2 authentication vulnerable to a social engineering replay attack?
it was answered that no, not vulnerable because "the keypair used to by the FIDO device to authenticate ...
- 137
40
votes
2
answers
12k
views
Did a Huawei modem just try to do a Man-In-The-Middle attack on me?
I have a replica of Huawei B535-333 LTE modem. While I was working from home on my computer I randomly got a security alert saying that certificate for connection with outlook.office365.com was issued ...
- 503
3
votes
1
answer
533
views
Modern VPNs and average MITM attacks
I am trying to untangle a number of concepts (all of which i am unfamiliar with) in this question, but they all point to a seemingly basic question;
With modern tunneling protocols, SSL ciphers and ...
- 175
0
votes
0
answers
168
views
MITM with forwarding between 2 hosts in the same network
I have 3 hosts in the same network, let's say their IP addresses end with:
.10 (Host A)
.11 (Host B)
.12 (Host C)
I want to sniff packets between A and C through host B, so that host B acts as MITM.
...
- 11
0
votes
0
answers
201
views
Man in the Middle Attack for OAuth 2's Authorize endpoint
We all know that the /authorize endpoint is a standard endpoint of OAuth 2. Below is how it's commonly called:
GET /oauth2/authorize?client_id={client_id}&redirect_uri={redirect_uri}&...
- 1
3
votes
2
answers
2k
views
Understanding TLS Protections Against DNS Spoofing and Fake Websites
What protections does TLS use in the above scenario?
In the picture, the client asks the attacker for the address of Google.com, but the attacker gives them a different ip address which redirects to a ...
- 31
0
votes
2
answers
271
views
Website returns different certificate on my home network to mobile hotspot
This is a "should I be worried" question. I access a website on my laptop via my home network/router. My Edge browser gives me a "Your connection isn't private" warning page and ...
- 101
0
votes
0
answers
162
views
Bettercap filtering ARP Spoof
I want to see only monitored device's visited websites not the methods and the redirects how can I filter or can I?
0
votes
0
answers
95
views
Securing an internal tcp proxy
I am developing a TCP-Proxy in C#/.NET using dotNetty (Port of Netty). The proxy is translating messages between two different systems. It will be hosted on a server in the company network, so it is ...
- 101
0
votes
1
answer
631
views
Can China decrypt SSL as soon as people using their ISP?
While these VPNs can work inside of China, I wonder how private and secure they are since China is known for its great firewall, like most technically advanced countries. Are these methods working? ...
- 157
0
votes
2
answers
562
views
What is the difference between a VPN and a Tor Socks proxy on public wifi?
I seek protection against MITM & snooping of VPN or Tor proxy traffic on public WiFi.
So, what are the different security impacts of each of these 2 solutions:
Using a VPN (like Proton VPN) to ...
- 1
1
vote
2
answers
211
views
Evading authenticated diffie hellman with MITM
I understand that in a non-authenticated Diffie-Hellman setup, a man-in-the-middle attack can occur. Now i'm curious about the feasibility of the following scenario:
Let's assume a situation where www....
- 11
0
votes
0
answers
113
views
Could a trusted CA pretend to be me and run a MITM? [duplicate]
Sorry for the basic question, I'm still wrapping my head around the ins and outs of SSL and asymmetric encryption. In order to better test my understanding, I was considering the following thought ...
0
votes
1
answer
426
views
Is Certificate Pinning safe and worthwhile for an API server that will only accept requests from an android application?
I have hosted an api on an AWS Windows server, imported ssl certificates from a known CA, and made https mandatory.
Then built a client app that is an executable, then pinned the public key hash for ...
- 103
1
vote
0
answers
102
views
MS-CHAPv2 Auth protocol downgrade
I'm researching about PPP (Point to Point protocol) and it's security aspects.
While exploring PPP Authentication I've noticed possibility for security downgrade attack. Generally authentication ...
- 11
0
votes
1
answer
278
views
can a VPN provider do DNS poisoning?
I was wondering if we push our DNS over the VPN and basically let them do DNS resolution, is it possible to perform DNS poisoning and man in the middle attack on us?
I know browsers check certificates ...
0
votes
2
answers
255
views
What prevents certificate authorities from issuing fraudulent TLS certificates?
There have been reports of attacks against certificate authorities resulting in the issuance of fraudulent TLS certificates for sites such as google.com, yahoo.com, and skype.com. These attacks seem ...
- 31
0
votes
1
answer
127
views
Suitable method of encryption for user-hosted chat platforms
I am considering how to make my chat application a bit more secure. It has a similar structure to IRC, multiple users can join each server, and servers can be hosted by anyone. I have been using TLS ...
- 103
1
vote
2
answers
901
views
How does the MITM attack work when a client does not check the hostname vs the certificate? [duplicate]
One of the Paho MQTT client SSL options allows checking whether "a certificate matches the given host name.". If I enable this option then I cannot establish a TLS connection to MQTT using ...
- 13