-1

As title states, I never really understood this.

From my understanding, a proxy whatever it's socks or http, can reveal packet information even while under httpS (ssl). However, during a mitm this is not possible.

What's the mechanics behind this? Does a proxy setup also submit cert consensus or handshake information?

  • 1
    Please provide a reference for packet inspection in case of HTTPS. It's unusual, and I'd assume it requires special client configuration. – domen Mar 12 '18 at 15:05
  • 1
    An active MITM attack will completely break the TLS connection, whereas a passive one will let the connection continue. This will let you see the packets, but their contents will be encrypted so you can't really tell what data they contain. – Ajedi32 Mar 12 '18 at 15:14

1 Answers1

2

I think you have some misconceptions. MITM just means man in the middle, i.e. that there is someone in the path between client and server which can read and modify the traffic. Insofar a proxy is a man in the middle too and the difference between a proxy and a MITM attack is that the proxy is in the middle due to either network design (transparent proxy) or explicit proxy configuration in the client, whereas the attack in the MITM attack is not by design in the path but only due to attacks like ARP spoofing, DNS spoofing, DHCP spoofing or by successfully attacking some middlebox or router in the existing path.

Both an expected proxy (no attacker) and an unexpected proxy (the attacker) work essentially the same. Since both are in the network path they can both intercept and modify the traffic. They could also both in theory intercept HTTPS traffic for decryption and modification inside the proxy. But HTTPS is designed to detect this and will only accept it from the expected (trusted) proxy and not from the unexpected proxy of the attacker. For the details on why this will work with a trusted proxy and not an untrusted proxy see the answers in Does https prevent man in the middle attacks by proxy server?.

Steffen Ullrich
  • 184,332
  • 29
  • 363
  • 424