4 ms·
If you can a) route the traffic through your proxy and b) generate a valid certificate for the target site that's accepted by web browsers, then yes, it's a mit
by jvehent 11y ago
If you can a) route the traffic through your proxy and b) generate a valid certificate for the target site that's accepted by web browsers, then yes, it's a mitm :)
- wwwhizz 11y agoWhilst a) is possible under some circumstances, b) should be impossible.
- tobbez 11y ago...unless you have somehow acquired a CA's private keys, or are in control of the clients' certificate stores.
- electrum 11y agoThe latter of which is very common in corporate environments where employee's machines are provisioned by the IT department and contain the company's private CA (which is useful for non-nefarious purposes such as signing certificates for internal services).
- nileshtrivedi 11y agoIn case of (a), you can use MITMProxy[1] - a handy tool especially for debugging traffic from mobile devices. 1: https://mitmproxy.org/ https://mitmproxy.org/