# mitm Published articles for mitm. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Собрать прошлое: как архивировать весь трафик сборки SONiC DevFeed: [Собрать прошлое: как архивировать весь трафик сборки SONiC]() Original publisher: [Read original article]() Author: denballakh (Яндекс, Yandex Cloud & Yandex Infrastructure) Published: 2026-07-20T07:03:18Z Content type: tutorial Language: ru Sources: [Яндекс - Как мы делаем Яндекс / Статьи]() Topics: [Docker](), [Debian](), [HTTP](), [docker registry](), [GitHub](), [PyPI](), [Python]() Tags: [build](), [debian](), [docker](), [docker-registry](), [github](), [http](), [infrastructure](), [mitm](), [proxy](), [pypi](), [reproducibility](), [sonic]() ### AI overview This article explains how Yandex Infrastructure developed a caching MITM proxy for SONiC and YaSONiC builds. The proxy captures HTTP/HTTPS traffic and serves previously saved responses to improve build reproducibility when external dependencies change or disappear. ### Source excerpt Интернет -- это зависимость без зафиксированной версии. Сегодня он возвращает одно, завтра -- другое, а послезавтра -- ничего. Поэтому мы решили сохранить для сборки тот интернет, который она однажды увидела. Для этого пришлось перехватывать HTTPS, выпускать собственные сертификаты, переподписывать индексы Debian и выяснять, почему Docker отправляет "случайные" заголовки. В этой статье я расскажу, как разрабатывал кеширующую MITM-проксю, которая перехватывает весь HTTP/HTTPS-трафик и отдаёт ранее сохранённые ответы. Разберём также неочевидные технические проблемы, с которыми пришлось столкнуться. Читать далее ## 'guix substitute' and 'guix pull' Vulnerabilities DevFeed: ['guix substitute' and 'guix pull' Vulnerabilities]() Original publisher: [Read original article]() Author: Caleb Ristvedt Published: 2026-07-02T17:00:00Z Content type: release Language: en Sources: [GNU Guix -- Blog]() Topics: [Vulnerabilities](), [Security](), [upgrade]() Tags: [cve](), [mitm](), [root](), [security](), [security-advisory](), [upgrade](), [user](), [vulnerabilities]() ### AI overview The article details several security vulnerabilities in Guix substitute and guix pull, including remote privilege escalation, remote store corruption, possible disclosure of sensitive files, and file overwrite issues. It advises users to upgrade the Guix daemon and describes a regression affecting some unprivileged users. ### Source excerpt Several security issues (CVE IDs pending) have been identified in guix substitute , a helper utility invoked by guix-daemon , which enable a variety of harmful activities including remote privilege escalation to the build daemon user , remote store corruption , and potentially local disclosure of sensitive files accessible to the build daemon user. All systems are affected, whether or not guix-daemon is running with root privileges; the harm that can be done when guix-daemon runs without root privileges is more limited. You are strongly advised to upgrade your daemon now (see... ## \[Pentesting\] HTTP auth, part II: digest DevFeed: [\[Pentesting\] HTTP auth, part II: digest]() Original publisher: [Read original article]() Published: 2025-11-20T23:00:00Z Content type: article Language: en Sources: [Dennis Yurichev]() Topics: [HTTP](), [passwords](), [TLS (Transport Layer Security)](), [web browser]() Tags: [apache](), [attacks](), [browser](), [code](), [compatibility](), [crack](), [http](), [legacy](), [mitm](), [password](), [protection](), [protocol](), [server](), [tls](), [upgrade]() ### AI overview The article examines HTTP Digest Authentication, including how the server and browser exchange hashed credentials, how the exchange resists password interception and replay attacks, and how attackers can attempt to crack MD5-based exchanges with hashcat. It notes that Apache 2.4.63 still uses MD5 and recommends upgrading HTTP authentication to TLS. ### Source excerpt [Pentesting] HTTP auth, part II: digest ## Fighting TLS fingerprinting with Node.js DevFeed: [Fighting TLS fingerprinting with Node.js]() Original publisher: [Read original article]() Author: HTTP Toolkit; Tim Perry Published: 2021-12-07T13:40:00Z Content type: tutorial Language: en Sources: [HTTP Toolkit]() Topics: [TLS (Transport Layer Security)](), [Node.js](), [Web Scraping](), [HTTP]() Tags: [browser](), [http](), [interception](), [javascript](), [mitm](), [node-js](), [proxy](), [tls]() ### AI overview This tutorial explains how TLS fingerprinting lets servers and proxies identify client software from unencrypted connection metadata. It examines how this can block HTTP Toolkit and other automated traffic, then shows how Node.js techniques can work around that blocking. ### Source excerpt The modern internet is full of services that want to know who you are. Fingerprinting is the latest way to do this: capturing many small details about your client, and using it to create an id that's sufficiently unique to recognize you and infer details about your network client and device. This is a privacy problem, which I'm not going to focus on here, but collecting and analysing interaction metadata is also a powerful tool to recognize certain types of clients, even when they attempt to disguise themselves. TLS provides a particularly good surface for this kind of fingerprinting, which allows a server or proxy to recognize the kind of software (a specific browser version, Python, Ruby, Node.js, etc) that's opening any TLS connection, before the client has even sent any data (such as an HTTP request) within the connection, and purely using unencrypted public data from the connection. In many cases, this is a problem. HTTP Toolkit acts as a MitM proxy for HTTP(S) traffic inspection & mocking, and this potentially allows servers to recognize and block it, along with any other similar debugging proxies. Many other automated scripts and tools can also be recognized, blocking web scraping and other requests from anything but a real browser. Until recently, I thought this was fairly theoretical, but last week an HTTP Toolkit user showed me a real-world example, where non-browser traffic is blocked completely, based just on its TLS fingerprint, causing big problems for HTTP Toolkit usage. Fortunately, we can work around this. In this article, I want to explain how TLS fingerprinting works, look at a real-world example, and then see exactly how you can defeat this blocking using Node.js (with techniques that you can easily apply elsewhere too). How does TLS fingerprinting work? TLS provides a huge amount of data for fingerprinting. Every connection secured by TLS (for example, all HTTPS requests) starts with a 'client hello' message from the client, sent unencrypted, wi ## Bettercap 2.0 Released as a Go-Based Framework for MITM Attacks and Network Monitoring DevFeed: [Bettercap 2.0 Released as a Go-Based Framework for MITM Attacks and Network Monitoring]() Original publisher: [Read original article]() Author: Simone Margaritelli Published: 2018-02-27T19:37:20Z Content type: release Language: en Sources: [evilsocket]() Topics: [Network](), [Monitoring](), [Go Language](), [Raspberry Pi](), [Android](), [macOS]() Tags: [2](), [android](), [bettercap](), [ble](), [cybersecurity](), [go](), [golang](), [macos](), [mitm](), [monitoring](), [network](), [network-attacks](), [offensive-tools](), [project-release](), [raspberry-pi](), [release](), [traffic-interception](), [wifi]() ### AI overview The article announces bettercap 2.0, a complete reimplementation of the Man-in-the-Middle attack framework. It describes a move from Ruby to compiled Go, with improved concurrency, performance, and reduced resource usage, alongside support for network monitoring, Wi-Fi and BLE attacks, and multiple platforms. ### Source excerpt It's with immense pleasure that I announce the release of the second generation of bettercap, a complete reimplementation of the most complete and advanced Man-in-the-Middle attack framework. This release not only brings MITM attacks to the next level, but it aims to be the reference framework for network monitoring (we <3 blueteams too), 802.11, BLE attacks and more! :D ベッターキャップ！ ## Teleport - SSH authentication with 2FA DevFeed: [Teleport - SSH authentication with 2FA]() Original publisher: [Read original article]() Author: sasha@goteleport.com (Sasha Klizhentas) Published: 2016-12-19T00:00:00Z Content type: release Language: en Sources: [Teleport]() Topics: [Authentication](), [MFA](), [Security](), [USB](), [Bluetooth]() Tags: [3](), [announce](), [authentication](), [bluetooth](), [mitm](), [phishing](), [security](), [ssh](), [usb]() ### AI overview Teleport 1.3 adds native support for Universal Second Factor (U2F) authentication. The article explains U2F as a hardware-based second factor using devices such as USB keys and describes its security and usability benefits compared with phone-based authentication. ### Source excerpt We are excited to announce that Teleport now supports Universal 2nd Factor out of the box. ## Reverse engineering and removing Pokémon GO's certificate pinning DevFeed: [Reverse engineering and removing Pokémon GO's certificate pinning]() Original publisher: [Read original article]() Author: Eaton Published: 2016-07-31T06:59:28Z Content type: tutorial Language: en Sources: [Eaton Works Feed]() Topics: [Reverse Engineering](), [Android](), [Android Security](), [APK](), [Network]() Tags: [android](), [android-security](), [apk](), [mitm](), [reverse-engineering]() ### AI overview A technical walkthrough of certificate pinning in Pokémon GO version 0.31.0 on Android. It explains how pinning blocks HTTPS interception and discusses a method for reverse engineering and removing the pinning, including limitations involving root access, account bans, Google login, and later security updates. ### Source excerpt A deep dive into Pokémon GO's certificate pinning.