Skip to main content
1 of 2
Nasrus
  • 1.2k
  • 12
  • 13

There are other vectors for MITM in SSL. For instance:

  1. Using a weak cipher with weak hashing function (think DES with MD2, gasp...)

  2. Using an outdated SSL version (eg SSL 2.0, which for some weird reason some sites support even now).

  3. Using a client or server that does not do 1 or 2, but allow doing so (attacker can cause downgrade attacks and force the parties to use a weaker cipher/SSL algorithm, then cracking from there)

These allow an attacker to perform MITM by cracking the encryption or protocol itself, whilst still remaining transparent to the user or server.

Nasrus
  • 1.2k
  • 12
  • 13