A man-in-the-middle attack is a cyberattack where an attacker intercepts the communication between two parties to eavesdrop, modify, or manipulate the conversation. The attacker can intercept the communication by intercepting the network traffic, usually on a public Wi-Fi network, and can then read, insert, or modify the data being transmitted.

This type of attack can be extremely dangerous, as it can lead to the interception of sensitive information, such as login credentials, credit card details, and other personal information. In this article, we will discuss how a man-in-the-middle attack works and what steps you can take to protect yourself from it.

How Does a Man-in-the-Middle Attack Work?

In a man-in-the-middle attack, the attacker intercepts the communication between two parties, such as a client and a server. The attacker does this by placing themselves between the two parties, essentially becoming a “man in the middle.”

The attacker can achieve this in several ways. One common method is by intercepting the network traffic on a public Wi-Fi network. Once the attacker has intercepted the network traffic, they can then read, insert, or modify the data being transmitted. For example, they can intercept a login request to a website and capture the username and password, allowing them to log in to the user's account.

How Does SSL with hostname verification solve this?

In an HTTPS connection, the client encrypts the information using the server's public key, which can only be decrypted by the server. However, if a malicious user can trick the client into communicating with them instead of the real server, using their own public key, a man-in-the-middle attack can occur. As a result, the client may unknowingly encrypt data using the fake server's public key and send it back, which can be decrypted by the attacker using their private key. The attacker can then forward the information to the real server, potentially compromising sensitive information.

SSL uses certificates and hostname verification in the client to establish a connection.

The Certificate has two important fields:

• the DNS Name in the remote server's certificate (CN entry in the certificate)
• the Host Name in the HTTP request by the client (subjectAltName entry in the certificate)

When a client initiates a secure connection with a server, the server presents its digital certificate to the client. The digital certificate contains information such as the server's public key, and the hostname of the server. To ensure that the client connects to the correct server, it uses a hostname verifier to compare the hostname in the URL with the one in the digital certificate sent by the server.

However, if the hostname in the certificate presented by the server does not match the hostname of the server being connected to, it could indicate that the client is being redirected to a malicious server that is trying to intercept the secure connection. In such cases, hostname verification can detect the mismatch and prevent the connection from being established, thereby preventing potential security threats.

To generate a self-signed certificate in a PKCS#12 format (.p12 file)

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365  -subj "/CN=example.com/OU=IT/SAN=dns:example.com,SAN=ip:192.168.0.1"