+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449)
+---- Forum: Beginner Hacking (https://hackforums.net/forumdisplay.php?fid=4)
+---- Thread: A question about MitM attacks (/showthread.php?tid=6293322)
A question about MitM attacks - jasonnix - Feb 27, 2025
Hello,
I have a question about MitM attacks. As the name suggests, the hacker is placed between the user and the destination. Suppose a web application like GitLab uses the HTTP protocol. When the hacker places himself between the user and the GitLab server to perform a MitM attack, where is this middleman? Is it the router that the user uses to reach the destination via the Internet?
Please explain simply and briefly.
Thank you.
RE: A question about MitM attacks - vetbesim - Feb 27, 2025
No mitm: User -> router -> gitlab
Mitm: User -> hacker -> router -> gitlab
https://www.imperva.com/learn/application-security/arp-spoofing/
explains that the hacker lies to the user and the router, he tells the router that he is the user and he tells the user that he is the router
RE: A question about MitM attacks - grady - Feb 27, 2025
Depends on the method of MitM.
For DNS cache poisoning/ARP cache poisoning, the traffic is redirected to the attacker and, optionally, can be proxied to the legitimate destination.
For network sniffing, you're eavesdropping on traffic in the same broadcast domain.
RE: A question about MitM attacks - OtterBot - Feb 27, 2025
It also could be something like a pineapple, where the user connects to the hackers network. This then allows the hacker to access all traffic while the victim thinks they’re on says Starbucks’s network.
RE: A question about MitM attacks - DramaKing - Feb 27, 2025
(Feb 27, 2025 01:23 PM)jasonnix Wrote: Hello,
I have a question about MitM attacks. As the name suggests, the hacker is placed between the user and the destination. Suppose a web application like GitLab uses the HTTP protocol. When the hacker places himself between the user and the GitLab server to perform a MitM attack, where is this middleman? Is it the router that the user uses to reach the destination via the Internet?
Please explain simply and briefly.
Thank you.
First of all, GitLab uses HTTPS like virtually every other website. And realistically you're not doing MitM on the WAN. Datacenters have seriously high security. ARP spoofing Internet routers hasn't successfully been done in a long time. A VPN or proxy service could do it but little else.
RE: A question about MitM attacks - jasonnix - Apr 19, 2025
(Feb 27, 2025 01:49 PM)vetbesim Wrote: No mitm: User -> router -> gitlab
Mitm: User -> hacker -> router -> gitlab
https://www.imperva.com/learn/application-security/arp-spoofing/
explains that the hacker lies to the user and the router, he tells the router that he is the user and he tells the user that he is the router
Hello,
Thank you so much for your reply.
You said:
Code
User -> hacker -> router -> gitlabWhat is the hacker here that the user can connect to?
(Feb 27, 2025 02:05 PM)grady Wrote: Depends on the method of MitM.
For DNS cache poisoning/ARP cache poisoning, the traffic is redirected to the attacker and, optionally, can be proxied to the legitimate destination.
For network sniffing, you're eavesdropping on traffic in the same broadcast domain.
Hello,
Quote:For DNS cache poisoning/ARP cache poisoning, the traffic is redirected to the attacker and, optionally, can be proxied to the legitimate destination.
How does the hacker redirect traffic to himself? Did he hack a router?
Quote:For network sniffing, you're eavesdropping on traffic in the same broadcast domain.
The same broadcast domain? Does that mean the hacker is on the same network as the users?
RE: A question about MitM attacks - vetbesim - May 2, 2025
(Apr 19, 2025 05:39 AM)jasonnix Wrote: Hello,
Thank you so much for your reply.
You said:
CodeUser -> hacker -> router -> gitlab
What is the hacker here that the user can connect to?
Hello,
How does the hacker redirect traffic to himself? Did he hack a router?
The same broadcast domain? Does that mean the hacker is on the same network as the users?
The hacker is going to be in the same network as the victim
the hacker tells the victim that he is the router, and tells the router that he is the victim via arp spoofing, and the user sends data to the hacker, believing that he is the router. But the hacker can only view the data in insecure protocols like http, he cannot view data send to or received to/by a website using https. If I were you I'd look up what arp spoofing is so you can understand it better, and ask chatgpt if you still dont get it
RE: A question about MitM attacks - DramaKing - May 2, 2025
(Apr 19, 2025 05:39 AM)jasonnix Wrote: Hello,
Thank you so much for your reply.
You said:
CodeUser -> hacker -> router -> gitlab
What is the hacker here that the user can connect to?
Hello,
How does the hacker redirect traffic to himself? Did he hack a router?
The same broadcast domain? Does that mean the hacker is on the same network as the users?
Are you really asking for someone to explain ARP poisoning to you? DNS cache poisoning is also easy to learn if you take five minutes. It's been discussed in depth here.
A broadcast domain is the same as a subnetwork, i.e. all the hosts that can send and receive broadcasts to each other. That should be obvious if you're doing MitM. All the answers are here.
RE: A question about MitM attacks - jasonnix - May 4, 2025
(May 2, 2025 06:07 PM)DramaKing Wrote: Are you really asking for someone to explain ARP poisoning to you? DNS cache poisoning is also easy to learn if you take five minutes. It's been discussed in depth here.
A broadcast domain is the same as a subnetwork, i.e. all the hosts that can send and receive broadcasts to each other. That should be obvious if you're doing MitM. All the answers are here.
Hello,
One thing is unclear to me. If a hacker wants to do this for a home user, how should he\she impersonate the router? Would he\she have to hack the ISP?
RE: A question about MitM attacks - DramaKing - May 4, 2025
(May 4, 2025 03:34 AM)jasonnix Wrote: Hello,
One thing is unclear to me. If a hacker wants to do this for a home user, how should he\she impersonate the router? Would he\she have to hack the ISP?
In 2025? You would need to control the ISP, although there was an in-depth thread not long ago on DNS poisoning.
You'll find that SSL/TLS remediates a lot of the classic MitM attacks.