← VCE Software Development U4O2

Man-in-the-middle attacks

An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 36, ACARA Digital Technologies Years 9–10 — Networked Systems and Access Control — Module 75, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 37, QCE Digital Solutions Unit 4 — Digital Methods for Exchanging Data — Module 7, QCE Digital Solutions Unit 4 — Complex Digital Data Exchange Problems and Solution Requirements — Module 28, WA Computer Science ATAR Year 11 — Network Communications — Module 97, WA Computer Science ATAR Year 11 — Cyber Security — Module 31

Understanding Man-in-the-middle attacks in VCE Software Development U4O2

What it does: HTTP has no encryption, so an attacker in the middle can see logins or alter the data. HTTPS is the protection. A man-in-the-middle attacker may present a fake certificate. A mismatch warning is a sign the connection is not safely with the real server. Unsecured networks let attackers capture traffic easily, especially when the data is not encrypted. Session tokens that are intercepted in transit can be replayed by the attacker to impersonate the user without needing the password. Encryption in transit means an intercepted message cannot be read, and valid certificates help confirm the server is genuine. Code in transit can be changed by a man-in-the-middle attacker if it is not encrypted and verified, which can lead to compromised software.

Common mistakes: The URL uses http, so the card details are sent unencrypted. A man-in-the-middle on the network could read or change them. It should use https. verify=False turns off certificate checking. An attacker with a fake certificate could then sit between the app and the API. It should be verify=True.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Man-in-the-middle attacks to a class →

This module's key terms are also in a printable crossword (Modules 23–47) and word search (Modules 1–47).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
An attacker sits on a café's unsecured Wi-Fi and silently reads the traffic between a developer's laptop and a server. What is this?
A man-in-the-middle attackA brute-force password attack
Matches
if cert_error: ignore_warning() # keep going
↓
Ignoring certificate errors lets an attacker with a fake certificate sit in the middle unnoticed. The code should stop the connection when validation fails.
Applying
Meanings
Term
man-in-the-middle attack
Meaning
An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.
Practice
BEGIN SecureLogin
Testing
Gaps
url = "://mybank.com.au/login"
Check Answer
Spots
1import requests
2url = 'http://shop.com/pay'

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Nautilus' badge — Default Expert, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. An attacker sits on a café's unsecured Wi-Fi and silently reads the traffic between a developer's laptop and a server. What is this?
A. A man-in-the-middle attack ✓
B. A brute-force password attack
In a man-in-the-middle attack, the attacker secretly sits between two parties and can read or change the data passing between them.
2. Which statement describes a man-in-the-middle attacker correctly?
A. They can only block a website so that nobody can reach it
B. They can read or change data passing between two parties ✓
Blocking access is an availability attack. A man-in-the-middle attacker intercepts data, so confidentiality and integrity are at risk.
3. Which network is the MOST likely to allow an attacker to intercept traffic?
A. A private network protected by a strong password and encryption
B. Unsecured public Wi-Fi ✓
Unsecured networks let attackers capture traffic easily, especially when the data is not encrypted.
4. An attacker intercepts a session token and reuses it to take over a logged-in user's account. Which sub-type of attack is this?
A. Man-in-the-middle: stolen session token ✓
B. SQL injection through a form field
Session tokens that are intercepted in transit can be replayed by the attacker to impersonate the user without needing the password.
5. A user connects to a fake access point called 'Free_Cafe_WiFi' set up by an attacker. What does this allow?
A. The attacker can see and alter the traffic that passes through it ✓
B. Nothing, because the Wi-Fi name does not affect security
A fake access point routes all of the victim's traffic through the attacker's device, putting the attacker in the middle.

Match the Pairs

Wi-Fi name: Free_Airport_WiFi (rogue access point) → An attacker sets up a fake access point so devices connect through it and the attacker can read or change their traffic.
Cookie: sessionId=9f3a7c (captured in transit) → A stolen session token lets the attacker pose as the logged-in user without needing the password.
Data sent over plain HTTP can be read or changed by an attacker sitting between the user and the server. → http://login.example.com
A fake or invalid certificate warning can mean an attacker is impersonating the server to intercept traffic. → Warning: certificate does not match site
if cert_error: ignore_warning() # keep going → Ignoring certificate errors lets an attacker with a fake certificate sit in the middle unnoticed. The code should stop the connection when validation fails.
download_update('http://updates.example.com/app.zip') → Downloading code over unencrypted HTTP means an attacker in the middle could swap in a malicious file. It should use HTTPS and verify the signature.

Key Term

man-in-the-middle attack
An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.

Fill in the Blanks

1. url = "https://mybank.com.au/login"
Hint: Type the secure protocol name that encrypts data in transit so an interceptor cannot read it.
2. response = requests.get(url, verify=True)
Hint: Type the Boolean value that makes the code check the server's certificate, so a fake one is rejected.
3. Set-Cookie: session=abc123; Secure; HttpOnly
Hint: Type the cookie flag that stops the session token being sent over an unencrypted connection.
4. IF certValid = FALSE THEN BLOCK connection
Hint: Type the Boolean value that shows a fake certificate has failed the check, so the connection must be blocked.
5. data ← encrypt(message, key) SEND data TO server
Hint: Type the function name that scrambles the message before sending, so an interceptor only sees unreadable data.

Spot the Error

Question 1
A import requests
B url = 'http://shop.com/pay'
C data = {'card': card}
D requests.post(url, json=data)
Line B — The URL uses http, so the card details are sent unencrypted. A man-in-the-middle on the network could read or change them. It should use https.
Question 2
A from requests import get
B url = 'https://api.com/data'
C r = get(url, verify=False)
D print(r.status_code)
Line C — verify=False turns off certificate checking. An attacker with a fake certificate could then sit between the app and the API. It should be verify=True.
Question 3
A sid = generate_token()
B cookie = Cookie(sid)
C cookie.http_only = True
D cookie.secure = False
E send(cookie)
Line D — With secure set to False, the session cookie can be sent over unencrypted connections. An attacker on the network could steal the token and hijack the session. It should be True.
Question 4
A if cert.is_valid():
B abort_connection()
C else:
D send(password)
Line A — The condition is reversed. It aborts when the certificate is valid and sends the password when it is fake, which is what a man-in-the-middle wants. It should be if not cert.is_valid():.
Question 5
A git clone http://git.co/app
B cd app
C git pull origin main
Line A — Cloning over http means the code is not encrypted in transit. An attacker could change it on the way to the developer. It should use https.

Student with a class code? Join your class →