AiTM attacks don't steal passwords; they copy the result of a real login. You need to watch what happens after the user logs ...
Most web applications using session based authentication provide a sliding expiration for the session, meaning every time the user performs an action, the expiration timer is reset. If you know the ...