Man-in-the-middle interception
Man-in-the-middle interception is the positioning of a proxy between an application and its servers so that traffic, including TLS-protected traffic, can be read and modified in transit.
In authorised testing the proxy presents certificates from an authority trusted by the test device, which lets the tester observe exactly what the application sends. This is how transport findings are produced: unencrypted personal data, credentials in query strings, tokens without expiry, or sensitive fields sent to third-party hosts.
The technique is only legitimate against traffic you are authorised to inspect. Elenchia captures traffic from applications under test on devices the customer controls.
Related terms
- Certificate pinning — Certificate pinning is a control in which an application accepts only a specific certificate or public key for a server, rather than any certificate signed by a trusted authority.
- Transport Layer Security (TLS) — Transport Layer Security is the protocol that encrypts and authenticates traffic between a mobile application and the services it talks to.
- OWASP MASVS — The OWASP Mobile Application Security Verification Standard is a framework that defines what a mobile application must satisfy to be considered secure, organised into control groups covering storage, cryptography, authentication, network, platform interaction, code quality and resilience.