3

I am currently looking for ideas to test my application for Man in the middle (MITM) vulnerabilities. I was thinking about using Fiddler or Cain to examine the network traffic to see if a MITM attack is even possible.

Here's a quick background: I have two applications that use the same stack, one runs on an external network and the other runs on an internal network and accepts authenticated connections from the external application.

I would like to test the connection to ensure that nothing can be sent over in plain text (which is where Fiddler and Cain come into play).

I wanted to see if anyone out there has done any similar testing and if you had any suggestions for testing MITM attacks. It should be noted that both applications are not web based.

1

2 Answers 2

3

Use Fiddler to inspect network traffic. In addition to clear text passwords you can try to reuse a session token by making a call using Fiddler or PostMan. Also, checkout OWASP's ZAP scanner.

0

I do not much knowledge or experience in Security testing, so my assumption may be flawed.

One of the ways, you can test for the MITM is by simulating one on your test system. You can then analyse your system , and find the possible loopholes.

  • I see this link where they have given this process.
  • This other link talks about a Software which acts as a MITM proxy. There are some test cases discussed, which you can take a clue from and use them in your testing.

Tools : This might be of some help for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.