⚠   HTTP CONNECTION — DATA IS TRANSMITTED IN PLAINTEXT — NO ENCRYPTION   ⚠
⚠️
HTTP Danger Zone
MAN-IN-THE-MIDDLE ATTACK DEMONSTRATION · EDUCATIONAL USE ONLY
HTTP:// · UNENCRYPTED
⚠ Insecure Login Form
// RUNNING OVER HTTP — DATA NOT ENCRYPTED
🔓 This form posts to http:// — your browser may show "Not Secure" in the address bar. That warning exists for exactly this reason.
🕵 Attacker's View
// SIMULATED PACKET INTERCEPT · WHAT A MITM ATTACKER SEES
MITM PROXY · TCP STREAM INTERCEPT
Waiting for POST data... Fill in the form and click Submit to simulate what an attacker would see on the wire. $ tcpdump -A -i eth0 port 8080 listening on eth0, link-type EN10MB ...
Why is this visible?
HTTP sends everything as readable text. Any device on the same network (a router, a switch, a coffee-shop access point) can read every byte of your form submission — username, password, credit card — without breaking any encryption, because there is none.
What HTTPS would look like
With TLS, the intercepted packet would show only binary gibberish: ‹Ò€Â§Ë_5þîçnRᆟ°…
— completely unreadable without the server's private key.
⚠ How Man-in-the-Middle Attacks Work
📡

Step 1 — Position

The attacker places themselves between your device and the server. On a local network this is done via ARP spoofing, a rogue Wi-Fi hotspot, or a compromised router.

👁️

Step 2 — Intercept

Because HTTP has no encryption, all traffic flows through the attacker's machine in plain readable text. Tools like Wireshark or mitmproxy can capture it automatically.

✏️

Step 3 — Read or Modify

The attacker can read credentials silently — or even modify the page content in transit, injecting malicious scripts before the page reaches you.

🔒

Defense — Use HTTPS

TLS encrypts the entire connection. Even if traffic is intercepted, the attacker sees only encrypted bytes. Look for https:// and a padlock icon.

📍

IP Address Hosting Risk

Sites hosted by raw IP address (like this demo) cannot obtain a TLS certificate from a public CA. This forces HTTP — another reason to use a proper domain with HTTPS.

☕

Public Wi-Fi Warning

Coffee shops, hotels, and airports are prime MITM hunting grounds. Anyone on the same network can run this attack against HTTP traffic. Always verify HTTPS before logging in.