🕵️ Man-in-the-Middle (MITM) Attack Flow
OWASP Mobile #3 - Intercepting Mobile Communications
flowchart TD
A[📱 Mobile App] -->|1. HTTP request| B[📡 WiFi Network]
B -->|2. Intercepted| C[👤 Attacker with Proxy]
C -->|3. Decrypt traffic| D[🔓 SSL/TLS Bypass]
C -->|4. Forward request| E[🌐 API Server]
E -->|5. Response| C
C -->|6. Steal credentials| F[🔑 Session Tokens]
C -->|7. Modify response| G[📝 Tampered Data]
G -->|8. Inject malware| H[💉 Malicious Payload]
C -->|9. Forward to victim| A
F -->|10. Account takeover| C
I[🎯 Attack Vector:
Public WiFi] -.->|Unsecured network| B
J[🎯 Attack Vector:
Rogue Access Point] -.->|Evil Twin AP| B
K[🎯 Attack Vector:
ARP Spoofing] -.->|Network poisoning| B
style A fill:#74c0fc,stroke:#f59e0b,stroke-width:2px,color:#000
style B fill:#ffd43b,stroke:#f59e0b,stroke-width:2px,color:#000
style C fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style D fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style E fill:#a855f7,stroke:#f59e0b,stroke-width:2px,color:#fff
style F fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style G fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style H fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style I fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style J fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
style K fill:#ff6b6b,stroke:#f59e0b,stroke-width:2px,color:#fff
L[🔒 Defense:
Certificate Pinning] -.->|Validate cert| D
M[🛡️ Defense:
TLS 1.3] -.->|Strong encryption| B
N[⚙️ Defense:
VPN] -.->|Encrypted tunnel| B
style L fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style M fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
style N fill:#f59e0b,stroke:#00cc33,stroke-width:2px,color:#000
📋 Attack Flow Breakdown
1
Network Interception: Position between victim and server.
Tools: Wireshark, mitmproxy, Burp Suite, Charles Proxy
2
Rogue WiFi Access Point: Create fake public WiFi hotspot.
SSID: "Free Starbucks WiFi" (Evil Twin Attack)
3
SSL Stripping: Downgrade HTTPS to HTTP.
Tool: sslstrip - Removes SSL/TLS protection
4
Certificate Installation: Trick user into trusting attacker's CA certificate.
Install malicious root certificate on device
5
Intercept API Calls: Capture authentication tokens and sensitive data.
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5...
6
Session Hijacking: Replay stolen tokens to impersonate victim.
Use captured JWT token to make authenticated requests
7
Response Modification: Inject malicious content into server responses.
Inject: <script>steal_credentials()</script>
8
DNS Spoofing: Redirect to phishing sites.
bank.com → attacker-phishing-site.com
🛡️ Defense Mechanisms
✅ Certificate Pinning:
Pin the server's SSL certificate to reject any other certificates.
iOS: TrustKit | Android: Network Security Configuration
Prevent man-in-the-middle even with installed CA certs
✅ Use TLS 1.3:
Latest TLS version with stronger encryption and reduced attack surface.
Minimum TLS version: 1.2 (preferably 1.3)
✅ Disable Clear-text Traffic:
Force all communications over HTTPS.
Android: usesCleartextTraffic="false"
iOS: NSAppTransportSecurity settings
✅ Implement Mutual TLS (mTLS):
Require client certificates for authentication.
Both client and server authenticate each other
✅ Detect Proxy/VPN:
Alert users when running through suspicious proxies.
Check: System proxy settings, VPN connections
✅ User Education:
Warn users about untrusted WiFi networks and certificate prompts.
Display warnings for self-signed or untrusted certificates
✅ End-to-End Encryption:
Encrypt sensitive payloads at application layer.
Even if HTTPS is broken, data remains encrypted