Man-in-the-Browser

advancedAdditional Vector

Intercepting browser-server communication through malicious browser extensions or trojans to capture and manipulate session data.

Detailed Overview

Man-in-the-Browser (MitB) attacks compromise the browser itself, intercepting communication between the user and web application. Malicious browser extensions or trojans modify web pages, capture form data, and steal session tokens in real-time. Unlike network-based attacks, MitB operates within the trusted endpoint, making it harder to detect. The attacker sees everything the user sees and can manipulate transactions transparently.

Prevention Strategies

01Install browser extensions only from official stores
02Regularly audit installed browser extensions
03Use endpoint detection and response (EDR) solutions
04Implement transaction signing for sensitive operations
05Enable browser security features and updates

Tools

Common software used to explore or defend against this technique.

Browser DevTools
Selenium
Puppeteer
EDR

BYO — Build your code

Programmatic approaches that recreate what tools do — for learning, detection, and hardening on systems you are authorized to test.

Out-of-band transaction confirm

typescript

Server-side pattern: require a second channel for high-value actions.

type Tx = { id: string; amount: number; to: string };

export async function confirmTransfer(
  tx: Tx,
  otpFromPhone: string,
): Promise<boolean> {
  const expected = await lookupOtp(tx.id);
  if (otpFromPhone !== expected) return false;
  await settle(tx);
  return true;
}

// MitB can rewrite a form; OOB confirm still sees the real intent.

Puppeteer smoke test for DOM integrity

javascript

Lab check that critical form fields keep expected names/actions.

import puppeteer from "puppeteer";

const browser = await puppeteer.launch();
const page = await browser.newPage();
await page.goto("https://staging.example.com/transfer");
const action = await page.$eval("form#transfer", (f) => f.action);
console.log("form action:", action);
await browser.close();