What is Man-in-the-Middle Attack?
An attack where the adversary secretly intercepts and potentially alters communications between two parties who believe they're communicating directly with each other. MITM attacks can capture credentials, inject malware, or modify data.
Also known as: MITM, MitM Attack, On-Path Attack
In a MITM attack, the attacker positions themselves between you and whoever you're trying to communicate with. They can read everything, modify messages, or impersonate either party.
How MITM Attacks Work
Normal Communication
You ←→ Server
With MITM
You ←→ Attacker ←→ Server
Both you and the server think you're talking to each other, but the attacker sees everything.
Attack Techniques
ARP Spoofing
- Attacker claims to be the router
- All traffic routes through attacker
- Common on local networks
DNS Spoofing
- Redirect domain to attacker's server
- Fake version of real website
- Capture credentials
SSL Stripping
- Downgrade HTTPS to HTTP
- User sees no padlock
- All traffic unencrypted
Rogue Access Points
- Fake "Free WiFi" hotspot
- All traffic passes through attacker
- Common in coffee shops, airports
BGP Hijacking
- Redirect internet traffic at routing level
- Nation-state level attack
- Can affect entire regions
Protection Mechanisms
HTTPS
- Encrypts connection
- Validates server identity
- Look for padlock in browser
HSTS (HTTP Strict Transport Security)
- Forces HTTPS
- Prevents SSL stripping
- Browser remembers HTTPS-only
Certificate Pinning
- App expects specific certificate
- Rejects impersonation attempts
- Used in banking apps
VPN
- Encrypts all traffic
- Bypasses local MITM
- Doesn't protect against compromised VPN
Detecting MITM
Warning Signs
- Certificate warnings in browser
- Unexpected HTTP instead of HTTPS
- Slow or unusual network behavior
- Unknown certificates in system
Prevention
- Don't ignore certificate warnings
- Use VPN on public WiFi
- Verify HTTPS before entering credentials
- Keep software updated
Related Terms
Encryption
The process of converting information into a code to prevent unauthorized access. Encryption transforms readable data (plaintext) into an unreadable format (ciphertext) using a cryptographic algorithm and key. Only those with the correct key can decrypt and read the original data.
TLS
Transport Layer Security is a cryptographic protocol designed to provide secure communication over a computer network. TLS encrypts the connection between your browser and web servers, ensuring privacy and data integrity. It's the technology behind HTTPS.
Virtual Private Network
A technology that creates a secure, encrypted connection over a less secure network, such as the public internet. VPNs mask your IP address, encrypt your internet traffic, and can make it appear as though you're browsing from a different location.
Have more questions?
Use our guided flow to get the right next privacy step for Man-in-the-Middle Attack.
Open Guided Flow