Questions tagged [man-in-the-middle]

A man-in-the-middle attack (MiTM) is an attack against a communication protocol where the attacker relays and modifies messages in transit. The parties believe they are talking to each other directly, but in fact both are talking to each other via the attacker in the middle.

Filter by
Sorted by
Tagged with
1 vote
3 answers
6k views

Android app man-in-the-middle attack

Let's suppose I have an Android app that after strong authentication pulls sensitive data from server A and sends it to server B without storing it. The data appears only in the network traffic (...
Richard Leonard Kirner's user avatar
10 votes
2 answers
420 views

How is the security of SSH affected in the presence of a passively monitoring MITM?

In an ideal world, where all links are fully trustworthy from a data integrity point of view, with proper settings, modern SSH can be more or less assumed to be fully secure against eavesdropping on ...
user's user avatar
  • 7,785
2 votes
0 answers
403 views

Is standalone git susceptible to MITM?

Is standalone Git protocol susceptible to MITM where an attacker impersonates the server? According to https://git-scm.com/book/en/v2/Git-on-the-Server-The-Protocols There are 3 main protocols to ...
channel's user avatar
  • 401
0 votes
1 answer
774 views

Why does Driftnet capture only part of the image?

I'm simulating Driftnet (using Kali Linux) on VMware Workstation. I do an ARP poisoning MITM attack first to capture all the packets between two virtual machines (both Windows), then I open Driftnet. ...
Leftover's user avatar
1 vote
1 answer
301 views

Why is the Java download only offered via HTTP, not HTTPS? [closed]

I am looking to get the newest Java package on http://www.oracle.com/technetwork/java/javase/downloads/index.html However, I can not open that page using https, which seems to leave open a great ...
Marcel's user avatar
  • 4,086
1 vote
1 answer
559 views

Perform man-in-the-middle attack on HTTPS website with same certificate [duplicate]

I'm using Cloudflare to serve my GitHub pages website with a custom domain over HTTPS. I noticed that the Cloudflare certificate I received is valid for many domains (according to it's details on ...
user avatar
0 votes
1 answer
3k views

Vulnerability of challenge-response (authentication) protocols to on-line man-in-the-middle attacks

Are all challenge-response (or other authentication) protocols vulnerable to on-line main-in-the-middle attacks? Let's say Alice wants to setup a connection with Bob (e.g. she wants to login on a ...
Thomas Vanhelden's user avatar
2 votes
1 answer
881 views

MITM in "Next generation" firewalls becoming a norm? [duplicate]

So I went to a seminar lately and heard about the "SSL inspection" part of Nextgen firewalls. It was basically MITM to be able to monitor the users of the network. Is it becoming a common practice in ...
CinisSec's user avatar
1 vote
1 answer
623 views

How well the OpenVPN router defend against mitm

I'm not an expert in VPN, so I'm curious about how well does a router with installed vpn defend against an mitm attack. Since ARP Spoofing can decrypt https, I'm concerned if it's able to decrypt a ...
Corbee's user avatar
  • 113
1 vote
2 answers
318 views

MITM and https for authentication

If I want to go to https://www.example.com, can my ISP instead give me a different https website instead but make it look like it came from https://www.example.com If they do, will my browser tell me ...
Simd's user avatar
  • 597
5 votes
1 answer
1k views

WAF logs show plaintext password and login in a POST header sent via HTTPS

Scenario I was monitoring some events from our web application firewall (WAF), Imperva SecureSphere, when a weird one appeared. Here is the client's POST request: POST some_url HTTP/1.1 Host: ...
Emka's user avatar
  • 53
3 votes
3 answers
1k views

Problems with Chrome, Skype and Discord - possible MITM attack? [duplicate]

Two days ago everything was working just fine, but then I got this error in Google Chrome: Your connection is not private. www.youtube.com might attempt to steal your personal information. At the ...
Daniel Tutorials's user avatar
0 votes
1 answer
2k views

Protecting against CSRF, JWT, cross domain

I have a frontend heavy app with a rest api in node.js. The app and the backend are on different hosts. Moreover, the app can be accessed both with http and https. The reason why is mixed content: ...
Maciej Kravchyk's user avatar
1 vote
0 answers
17 views

Protect against MitM faking requests responses [duplicate]

How can we protect against a MitM faking the first server request response and also faking Certificate Authority response (in case of a HTTPS request)? Basically the MitM would provide the answers (...
Cumatru Cosu's user avatar
2 votes
1 answer
202 views

My local certificates may have been compromised. What to do now? [closed]

My hard drive was accessed by an attacker. I'm concern that my root certificates might have been compromised or a rogue certificate was installed to perform MiTM attacks against my SSL connections ...
victim's user avatar
  • 29
0 votes
1 answer
1k views

MITM attack DNS spoofing problem [closed]

I’ve tried to DNS spoof dnsspoof -i eth0 -f spoofhosts.txt (inside spoofhosts.txt there is my (the attacker) local ip and the domain which i want to poison) and I just keep receiving this: ...
MercyDude's user avatar
  • 149
1 vote
1 answer
2k views

Is Android Gmail app susceptible to MITM, sslstrip? If yes, how?

My scenario: I connected to an open WiFi at Kuala Lumpur Airport to read a news site from home (I know I was being absolutely careless). I forgot to turn off sync on my Android phone, so all my apps "...
Itarill's user avatar
  • 13
2 votes
2 answers
4k views

Burp+Genymotion: Not all traffic from app in Emulator proxied through Burp

I've set up Burp+Genymotion like this: https://linuxsuperuser.com/configure-burp-suite-proxy-genymotion/ to do some penetration testing on Android apps for work. The Genymotion (Android 6.0.0, API 23)...
Martin Fürholz's user avatar
0 votes
1 answer
928 views

SSL MITM and Mutual Authentication - vendor marketplace

In the interests of validating my thinking: I’ve been looking at commercial man-in-the-middle (MITM) appliances. It seems like the major players in the marketplace don’t support client certificates ...
The_Glidd's user avatar
1 vote
0 answers
3k views

Unknown device in home network

I have a home network that is behind NAT. My router IP address is 192.168.0.1 and DHCP is configured to provide addresses from the 192.168.0.1/24 range. My desktop is connected trough the ethernet ...
Ana Mandic's user avatar
1 vote
0 answers
261 views

Why is Skype traffic not passing through the NAT table of the PREROUTING chain in iptables?

I have successfully performed a MITM attack and have managed to view the HTTP/HTTPS packets of the victim passing through the nat table of the PREROUTING chain of my iptables.(using -j LOG) However, ...
Lew Wei Hao's user avatar
2 votes
2 answers
11k views

Understanding SSL man-in-the-middle and its limitations

I’m trying to develop a good sense of how an SSL man-in-the-middle(s) (MITM) works. As I understand it, MITMs do their work in one of two ways: Decrypt the SSL by having a copy of the server’s ...
The_Glidd's user avatar
1 vote
1 answer
326 views

How does sslsniff sign a certificate with a leaf certificate in trust chain?

In my opinion, signing a certificate with a leaf certificate in trust chain need to know the private key in left certificate. However, sslsniff has no way to know the leaf certificate's private key. ...
guo's user avatar
  • 173
1 vote
2 answers
392 views

How to Verify the identity of another computer

So I'm building an application that is designed for sharing files across a local network, and eventually across the Internet. I want to have a system for verifying the identities of computers, ...
Ibi's user avatar
  • 11
2 votes
1 answer
573 views

Does X.509v3 certificates prevent MITM attacks in SSH

I was reading RFC 4251 (really all of the SSH RFCs) and in section 9 it goes into great length about security considerations listing 3 cases of MITM attacks. In several places in the RFCs the authors ...
Nolan Robidoux's user avatar
2 votes
2 answers
217 views

Was the Stuxnet S7-417 payload a firmware update?

I'm a bit confused about the Stuxnet S7-417 attack. I believe Stuxnet performed a man-in-the-middle attack on the PLC, closing various valves in the background while it spoofed the values in the input ...
Lord Cat's user avatar
  • 151
1 vote
1 answer
1k views

SSL Proxy as a man in the middle

Does man in the middle realy work using proxy? i guess this works in an enterprise network where an administrator has access to the internet access, yet in a real network, if one tries to set on a ...
zafrir's user avatar
  • 11
0 votes
2 answers
2k views

IMSI catcher vs MiTM attack

On reading about IMSI catchers, it is almost always mentioned together with MITM attacks, i.e. as if IMSI catchers are same as MITM. But from my understanding, IMSI catchers and MITM are not the same ...
ransh's user avatar
  • 525
8 votes
1 answer
5k views

MITM attacks on FIDO UAF and U2F [closed]

In Section 6 of the Universal 2nd Factor (U2F) Overview, where MITM attacks are discussed – near the end of the section, it reads: It is still possible to MITM a user's authentication to a site if ...
weaver's user avatar
  • 351
1 vote
0 answers
178 views

Manipulate EAP negotiation

The EAP method to use is suggested from the client to the server during the EAP negotiation. I'm trying to make the EAP negotiation ends on one specific EAP method (inner authentication included) of ...
JohnLocke's user avatar
0 votes
1 answer
171 views

How difficult is it to mitm ssh connection after trusting fingerprint [duplicate]

If I connect using ssh to an ip address of a server and have to trust a new fingerprint. How hard is it to be a man in the middle to redirect my ip connection? I.e. How much risk am I taking if I ...
Cyrus's user avatar
  • 35
1 vote
1 answer
248 views

How to exploit RSA and DHE export? [closed]

I'm a white-hat beginner and I found two sites on Censys which have DHE and RSA exports. How can I show that these sites are not secure and are vulnerable to attack?
bkk's user avatar
  • 111
0 votes
1 answer
332 views

Which chain of the iptables receives the sniffed packets

Host C is using wireshark to sniff packets from Host A to Host B. I am able to see those packets from wireshark but I am not able to find them in the PREROUTING chain of iptables. When Host C ...
Lew Wei Hao's user avatar
0 votes
1 answer
513 views

If a MiTM has server's cert, how can certificate pinning protect against this?

In a scenario where client -> server through SSL, the server replies with the set of cert(chain-of-trust) which also contains the certificate pinned inside the client. Let's say the Root CA is ...
Josh's user avatar
  • 3
2 votes
2 answers
16k views

Ettercap error - 'ARP poisoning needs a non empty hosts list'

I use Kali linux VirtualBox VM with its network adapter attached to NAT. I checked that it is connected to the internet [made a simple apt-get update]. I run this command in a terminal: for ip in $(...
Kostas Demiris's user avatar
3 votes
2 answers
2k views

How does a client's web-browser know if a website is HTTPS only?

How would a client's web-browser know if a websites is HTTPS only? Here is the scenario, a client tries to access facebook.com by typing facebook.com in the address bar, the browser automatically ...
ChrisK's user avatar
  • 137
0 votes
1 answer
675 views

How man in the middle attack works on multiple targets?

I'm finding hard to understand how it is possible to perform a man in the middle attack to a whole network. It is easy for the attacker to tell every victim in the subnet that his mac address is the ...
Pedro de Lyra's user avatar
2 votes
0 answers
967 views

HTTP proxy for smart card based SSL

I am trying to pentest a web application, which seems to be using the user's smartcard for building up the SSL tunnel, and by that implementing smartcard authentication. My problem is that I haven't ...
gerion's user avatar
  • 59
3 votes
1 answer
960 views

Man in The Middle attack on secure key exchange protocols

I am going through CISSP materials and I got stuck on Secure Exchange Protocols such as Diffie Hellman and RSA. It is known that DH by itself is vulnerable to MiTM. So the answer is to use ...
Martin S's user avatar
3 votes
2 answers
4k views

Is HSTS Header Helpful For Mobile Applications?

I'm using HSTS(Strict-Transport-Security Header) for web applications. As far as I know browser keeps that information and when a user tries to connect to my website, browser loads it via HTTPS ...
Ivan Todorov's user avatar
5 votes
4 answers
6k views

DNS MITM Attack

If you're in a public space (eg. airport, coffee shop) and and mistakenly connect to a rogue access point is it possible for them to intercept your DNS queries and replace them with ones that send you ...
JohnSmith's user avatar
9 votes
3 answers
15k views

Is it risky to allow SMB traffic to the Internet

SMB is a well-known network file sharing protocol, and I assume it's supposed to be used internally only. At my company I found someone connecting to a share on a server on the Internet over port 445 ...
expertsnipo's user avatar
1 vote
0 answers
123 views

Man in the middle server [closed]

At my school, the server (only internet available) uses a MITM attack at all times, on all computers. We also lose access to most VPN's because of this. Is there any method to avoid this without using ...
B_D1214's user avatar
  • 19
0 votes
1 answer
1k views

Man-in-the-middle attack detected by antivirus, how is that possible?

I have tried to perform a mitm attack on one of my pc's which has Eset antivirus installed. I tried to intercept http/https data by forwarding port 80 & 443 with iptables. Then I used arpspoof ...
CrypticX's user avatar
2 votes
1 answer
1k views

Sniff API request through proxy

I have an iOS application that consumes an API. That application sucks so I was trying to "discover" that API and make my own application consuming that API. The issue is that the API is under SSL/...
Juan's user avatar
  • 21
-3 votes
1 answer
767 views

Why arp spoofing only attack layer 2

I am studying network security. I am wondering about ARP Spoofing. As you know ARP and ICMP only work at Layer 3 (network). But ARP spoofing attacks layer 2 (data link: mac address table). I don't ...
Nguyễn Ngọc Anh's user avatar
0 votes
3 answers
1k views

What about SSL makes it resistant to man-in-the-middle attacks? [duplicate]

Here's how I understand what SSL certificates actually do, in 4-year-old-child terms. There need to be three parties involved. Two parties are just my client, and the server I'm communicating with, ...
Digital Ninja's user avatar
1 vote
0 answers
102 views

SRP and compromised verifier [closed]

Let's assume that attacker knows verifier, so now he can commit MitM attack. 1) Client sends A to Server 2) MITM takes it and sends B to client While MITM knows the verifier, he also can compute ...
Tony's user avatar
  • 111
7 votes
3 answers
1k views

Can MitM attack be avoided without using a 3rd party?

I'm a little new to this area and have been reading up on Man-in-the-middle attacks. Almost everywhere the solution provided seems to be to use a trusted third party such as a Certification Authority. ...
JustAnotherUser's user avatar
37 votes
1 answer
3k views

Why are some websites seemingly immune to self-signed certificate MitM attacks?

I recently did an experiment using MitM to gain account information (username and password) while accessing websites. I used two PCs in the scenario; one as the target, running Internet Explorer, and ...
Pierrot's user avatar
  • 473

1
11 12
13
14 15
28