According to the OSI Model, the session layer is where connections are established, managed, and torn down. For connection-oriented network protocols, understanding how the session layer works, and ...
AiTM attacks don't steal passwords; they copy the result of a real login. You need to watch what happens after the user logs in to catch a hijacked session.