Man-in-the-middle attacks

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. An attacker sits on a café's unsecured Wi-Fi and silently reads the traffic between a developer's laptop and a server. What is this?

A A man-in-the-middle attack

B A brute-force password attack

2. Which statement describes a man-in-the-middle attacker correctly?

A They can only block a website so that nobody can reach it

B They can read or change data passing between two parties

3. Which network is the MOST likely to allow an attacker to intercept traffic?

A A private network protected by a strong password and encryption

B Unsecured public Wi-Fi

4. An attacker intercepts a session token and reuses it to take over a logged-in user's account. Which sub-type of attack is this?

A Man-in-the-middle: stolen session token

B SQL injection through a form field

5. A user connects to a fake access point called 'Free_Cafe_WiFi' set up by an attacker. What does this allow?

A The attacker can see and alter the traffic that passes through it

B Nothing, because the Wi-Fi name does not affect security

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Wi-Fi name: Free_Airport_WiFi (rogue access point)		Ahttp://login.example.com
2Cookie: sessionId=9f3a7c (captured in transit)		BWarning: certificate does not match site
3Data sent over plain HTTP can be read or changed by an attacker sitting between the user and the server.		CAn attacker sets up a fake access point so devices connect through it and the attacker can read or change their traffic.
4A fake or invalid certificate warning can mean an attacker is impersonating the server to intercept traffic.		DA stolen session token lets the attacker pose as the logged-in user without needing the password.
5if cert_error: ignore_warning() # keep going		EIgnoring certificate errors lets an attacker with a fake certificate sit in the middle unnoticed. The code should stop the connection when validation fails.
6download_update('http://updates.example.com/app.zip')		FDownloading code over unencrypted HTTP means an attacker in the middle could swap in a malicious file. It should use HTTPS and verify the signature.

Definitions

man-in-the-middle attack

Fill in the Blanks

Complete each line of code by filling in the missing parts.

url = "_____://mybank.com.au/login"

response = requests.get(url, verify=____)

Set-Cookie: session=abc123; ______; HttpOnly

IF certValid = _____ THEN BLOCK connection

data ← _______(message, key) SEND data TO server

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A import requests

B url = 'http://shop.com/pay'

C data = {'card': card}

D requests.post(url, json=data)

Question 2

A from requests import get

B url = 'https://api.com/data'

C r = get(url, verify=False)

D print(r.status_code)

Question 3

A sid = generate_token()

B cookie = Cookie(sid)

C cookie.http_only = True

D cookie.secure = False

E send(cookie)

Question 4

A if cert.is_valid():

B abort_connection()

C else:

D send(password)

Question 5

A git clone http://git.co/app

B cd app

C git pull origin main

Answer Key

Man-in-the-middle attacks

Section A: Quick Questions

A — A man-in-the-middle attack

B — They can read or change data passing between two parties

B — Unsecured public Wi-Fi

A — Man-in-the-middle: stolen session token

A — The attacker can see and alter the traffic that passes through it

Section B: Match the Pairs

Wi-Fi name: Free_Airport_WiFi (rogue access point) → An attacker sets up a fake access point so devices connect through it and the attacker can read or change their traffic.

Cookie: sessionId=9f3a7c (captured in transit) → A stolen session token lets the attacker pose as the logged-in user without needing the password.

Data sent over plain HTTP can be read or changed by an attacker sitting between the user and the server. → http://login.example.com

A fake or invalid certificate warning can mean an attacker is impersonating the server to intercept traffic. → Warning: certificate does not match site

if cert_error: ignore_warning() # keep going → Ignoring certificate errors lets an attacker with a fake certificate sit in the middle unnoticed. The code should stop the connection when validation fails.

download_update('http://updates.example.com/app.zip') → Downloading code over unencrypted HTTP means an attacker in the middle could swap in a malicious file. It should use HTTPS and verify the signature.

Section C: Definitions

man-in-the-middle attack — An attack where someone secretly sits between two parties and can read or change the data passing between them, such as logins, session tokens or code sent over an unsecured network.

Section D: Fill in the Blanks

url = "https://mybank.com.au/login"

response = requests.get(url, verify=True)

Set-Cookie: session=abc123; Secure; HttpOnly

IF certValid = FALSE THEN BLOCK connection

data ← encrypt(message, key)
SEND data TO server

Section E: Spot the Error

B — The URL uses http, so the card details are sent unencrypted. A man-in-the-middle on the network could read or change them. It should use https.

C — verify=False turns off certificate checking. An attacker with a fake certificate could then sit between the app and the API. It should be verify=True.

D — With secure set to False, the session cookie can be sent over unencrypted connections. An attacker on the network could steal the token and hijack the session. It should be True.

A — The condition is reversed. It aborts when the certificate is valid and sends the password when it is fake, which is what a man-in-the-middle wants. It should be if not cert.is_valid():.

A — Cloning over http means the code is not encrypted in transit. An attacker could change it on the way to the developer. It should use https.