So, imagine that a vulnerable app provides a login interface. This login sends the user's credentials to the App's server to authenticate the user. However this is done via HTTP, therefore not secure.
If I were inside the user's LAN network, I could easily perform a MITM and sniff the traffic and therefore the unencrypted credentials.
The questions is, how can I retrieve the credentials of a specific user by knowing this vulnerability WHILST being outside the network? What kind of practical attack vectors would there be?
- One could be a malicious but disguised app on the user's phone which monitors this traffic? (but obviously this would require a way of convincing the user of installing this app and also would count as being part of the LAN)