CAPEC-701

Browser in the Middle (BiTM)

High severityMedium likelihoodStandard pattern

An adversary exploits the inherent functionalities of a web browser, in order to establish an unnoticed remote desktop connection in the victim's browser to the adversary's system. The adversary must deploy a web client with a remote desktop session that the victim can access.

On this page

Ask an AI about this attack pattern
How the attack unfolds
Prerequisites
Skills required
Resources required
Consequences
Mitigations
Weaknesses it exploits
Related attack patterns

Unlike Adversary in the Browser, the victim does not need to install a malicious application. Browser in the Middle uses the inherent functionalities of a web browser to convince the victim they are browsing normally under the assumption that the connection is secure. All the actions performed by the victim in the open window are actually performed on the machine of the adversary. These victim-authenticated sessions are available to the adversary to use. All entered data such as passwords and usernames can be logged by the adversary and the content displayed to the victim can be altered arbitrarily. Varieties of multifactor authentication which rely solely on user input and do not use a form of hardware-based secret exchange are vulnerable to browser in the middle.

Ask an AI about this attack pattern

ChatGPT Claude Google AI Mode

Show the prompt

Explain the attack pattern CAPEC-701: Browser in the Middle (BiTM): how it unfolds, what it needs and how to prevent and detect it in my systems. Use https://capec.mitre.org/data/definitions/701.html and https://cve.bz/cve/capec/701?via=ask-ai-copy, which lists recent CVEs with the weaknesses it exploits. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this attack pattern's id and public links.

How the attack unfolds

Explore
The attacker looks for a way in.
1. [Identify potential targets] The adversary identifies an application or service that the target is likely to use.
  1 technique
  - The adversary stands up a server to host the transparent browser and entices victims to use it by using a domain name similar to the legitimate application. In addition to the transparent browser, the adversary could also install a web proxy, sniffer, keylogger, and other tools to assist in their goals.
Experiment
They probe what they found.
1. [Lure victims] The adversary crafts a phishing campaign to lure unsuspecting victims into using the transparent browser.
  1 technique
  - An adversary can create a convincing email with a link to download the web client and interact with the transparent browser.
Exploit
They carry out the attack.
1. [Monitor and Manipulate Data] When the victim establishes the connection to the transparent browser, the adversary can view victim activity and make alterations to what the victim sees when browsing the web.
  1 technique
  - Once a victim has established a connection to the transparent browser, the adversary can use installed tools such as a web proxy, keylogger, or additional malicious browser extensions to gather and manipulate data or impersonate the victim.

Prerequisites

The adversary must create a convincing web client to establish the connection. The victim then needs to be lured onto the adversary's webpage. In addition, the victim's machine must not use local authentication APIs, a hardware token, or a Trusted Platform Module (TPM) to authenticate.

Skills required

Medium skill

Resources required

A web application with a client is needed to enable the victim's browser to establish a remote desktop connection to the system of the adversary.

Consequences

What a successful attack can lead to
Impact	Affects	Note
Gain Privileges	Confidentiality, Access Control, Authentication	High likelihood
Read Data	Confidentiality, Authorization	High likelihood
Modify Data	Integrity	Medium likelihood

Mitigations

Implementation: Use strong, mutual authentication to fully authenticate with both ends of any communications channel

Weaknesses it exploits

CWE-294 Authentication Bypass by Capture-replay
CWE-345 Insufficient Verification of Data Authenticity

Recent CVEs with these weaknesses

7.4CVE-2026-1209992026-11-10
Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an attacker who registers another person's email address to share that person's account once they sign in. NervesHub.Account…
8.9CVE-2026-769662026-11-10
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management,…
8.1CVE-2026-1238022026-11-09
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, a licensed deployment with a configured SAML client can authenticate an identity from an assertion that did no…
7.4CVE-2026-1238012026-11-09
SuperTokens Core is an open source authentication server. From 11.3.0 until 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, and 12.3.1, SAML.handleCallback does not consume RelayState, record assertion identifiers, or enforce Response.InResponseT…
8.1CVE-2026-1153382026-11-09
Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network attacker to intercept sensitive information or modify requests when unencrypted connections are used.
6.3CVE-2026-1235992026-11-08
Hickory DNS hickory-proto before 0.26.0-beta.1 and hickory-net before 0.26.2 contain a DNSSEC validation bypass because verify_rrsets() ignores DNS class when partitioning RRsets, so non-IN records skip signature verification yet are marke…
8.7CVE-2026-1235962026-11-08
Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC handler that accepts parent-side ancestor-delegation NSEC records as proof of n…
8.7CVE-2026-1235952026-11-08
Hickory DNS hickory-proto 0.25 through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC validation flaw in the validating recursor's NSEC3 handler, which matches the closest encloser by hash alone without checkin…

The newest records naming one of them. Each weakness's page lists them all.

Part of: CAPEC-94 Adversary in the Middle (AiTM)
Can lead to: CAPEC-151 Identity Spoofing
CAPEC-148 Content Spoofing
Can follow: CAPEC-98 Phishing

MITRE's words, unchanged: CAPEC-701 at MITRE. CAPEC is Copyright © 2007–2026, The MITRE Corporation, used under the CAPEC terms of use: “The MITRE Corporation (MITRE) hereby grants you a non-exclusive, royalty-free license to use Common Attack Pattern Enumeration and Classification (CAPEC™) for research, development, and commercial purposes. Any copy you make for such purposes is authorized provided that you reproduce MITRE’s copyright designation and this license in any such copy.” CAPEC and the CAPEC logo are trademarks of The MITRE Corporation. Credits. All attack patterns.