AiTM attacks don't steal passwords; they copy the result of a real login. You need to watch what happens after the user logs in to catch a hijacked session.
Most web applications using session based authentication provide a sliding expiration for the session, meaning every time the user performs an action, the expiration timer is reset. If you know the ...
Results that may be inaccessible to you are currently showing.
Hide inaccessible results