What is a man-in-the-middle attack?

A man-in-the-middle (MITM) attack, also called an on-path attack, occurs when an adversary secretly positions themselves between two communicating parties, relaying and possibly altering their traffic while each side believes it is talking directly to the other. A successful attack undermines confidentiality and integrity at once, letting the attacker read secrets, steal credentials, or inject malicious content. The core weakness these attacks exploit is missing or unverified authentication.

How does a man-in-the-middle attack work?

A MITM attack has two phases: first the attacker gets onto the path between the endpoints, then they deal with any encryption protecting the traffic. Positioning is achieved with techniques like ARP spoofing, rogue wireless access points, DNS cache poisoning, or route hijacking. Once on-path, the attacker either reads plaintext directly or attempts to strip or impersonate the encryption.

What is SSL stripping?

SSL stripping is a MITM technique that prevents encryption rather than breaking it, with the attacker speaking plaintext HTTP to the victim while maintaining HTTPS to the real server. If the victim's initial request is unencrypted, the attacker can keep them on HTTP and read everything they send. HTTP Strict Transport Security (HSTS), which forces browsers to use HTTPS, directly counters this.

How do I protect against man-in-the-middle attacks?

The primary defense is authenticated encryption everywhere, meaning correctly deployed TLS with strict certificate validation, which defeats both passive interception and impersonation. Enforce HTTPS with HSTS so browsers refuse to downgrade to plaintext, and never click through certificate warnings. Hardening the local network with measures like dynamic ARP inspection and using strong mutual authentication for sensitive systems further shrink an attacker's opportunities.

Can attackers read HTTPS traffic in a man-in-the-middle attack?

Against correctly deployed TLS, reading HTTPS traffic is very hard, because the attacker cannot present a certificate the victim's system trusts. Instead attackers target the seams, using SSL stripping to keep the victim on plaintext or relying on a fraudulently issued or attacker-installed certificate. Strict certificate validation and certificate transparency exist precisely to make those approaches difficult.

What is the difference between passive and active interception?

Passive interception means the attacker only observes and records traffic without altering it, which is stealthier and harder to detect because the conversation proceeds normally. Active interception means the attacker modifies traffic in flight by injecting, altering, or dropping messages, enabling more damaging manipulation but risking detectable anomalies like broken sessions or certificate warnings. Attackers often begin passively to gather intelligence, then escalate to active manipulation when a valuable opportunity appears.

⇄ Network Security

Man-in-the-Middle (MITM) Attacks Explained

A man-in-the-middle (MITM) attack, also called an on-path attack, occurs when an adversary secretly positions themselves between two communicating parties, relaying and possibly altering their traffic while each side believes it is talking directly to the other. MITM attacks matter because a successful one undermines confidentiality and integrity at once, letting an attacker read secrets, steal credentials, or inject malicious content. Understanding the positioning techniques and interception methods reveals why authenticated encryption is the essential countermeasure.

What a Man-in-the-Middle Attack Is

In a MITM attack the adversary becomes an invisible relay. Traffic that should flow directly from a client to a server instead passes through the attacker, who can observe it, modify it, or drop it. The attack has two phases: first, getting into the path; second, dealing with any encryption that protects the traffic once there.

The core weakness these attacks exploit is missing or unverified authentication. If endpoints never rigorously confirm who they are talking to, an interposed party can impersonate each side to the other.

Passive and Active Interception

MITM attacks vary in how aggressively the attacker interferes with the traffic:

Passive interception means the attacker only observes and records traffic, harvesting data without altering it. This is stealthier and harder to detect because the conversation proceeds normally for both parties.
Active interception means the attacker modifies traffic in flight, injecting, altering, or dropping messages. This enables far more damaging manipulation but risks introducing detectable anomalies such as broken sessions or certificate warnings.

An attacker often begins passively to gather intelligence, then escalates to active manipulation when a valuable opportunity appears. Both modes depend on first occupying the path between the endpoints, which is why positioning is the critical enabler.

Where Attackers Position Themselves

Getting on-path is the first objective, and several techniques achieve it.

Local Network Interception

On a shared local network, an attacker can redirect traffic that should go to the gateway through their own machine. A common method is ARP spoofing, where forged Address Resolution Protocol replies trick hosts into associating the attacker's MAC address with the gateway's IP. Rogue wireless access points achieve a similar result by luring devices to connect through attacker-controlled hardware.

DNS and Routing Manipulation

Corrupting name resolution sends victims to attacker-controlled servers. By poisoning a resolver's cache or answering DNS queries with forged records, an attacker redirects a hostname to their own IP address. This is one reason encrypted and authenticated DNS is valuable. At a larger scale, manipulating routing announcements can divert traffic for entire address ranges through a hostile network.

Intercepting Encrypted Traffic

Being on-path is not enough when traffic is protected by TLS; the attacker must also defeat the encryption, and against correctly deployed TLS this is very hard. The techniques below target the seams rather than the cryptography itself.

SSL Stripping

Rather than break encryption, SSL stripping prevents it. The attacker sits between the victim and the server, speaking plaintext HTTP to the victim while maintaining HTTPS to the server. If the victim's initial request is unencrypted, the attacker can keep them on HTTP and read everything. Defenses like HTTP Strict Transport Security (HSTS), which forces browsers to use HTTPS, directly counter this.

Rogue Certificates

If an attacker can present a certificate the victim's system trusts, they can terminate TLS themselves and impersonate the server. This requires a fraudulently issued certificate, a compromised or attacker-installed trust anchor, or a client that fails to validate certificates properly. Certificate transparency and strict validation exist precisely to make this difficult.

What an Attacker Can Do Once In the Middle

Once established on the path with visibility into traffic, an attacker may:

Harvest credentials, session cookies, and tokens for account takeover.
Inject malicious scripts or modify downloaded files.
Hijack an authenticated session by stealing its identifiers.
Silently record sensitive communications.

The impact scales with how much of the traffic is unprotected or how completely the attacker has defeated its protection.

Defenses Against MITM Attacks

Because MITM attacks exploit weak authentication, the defenses center on proving identity and protecting integrity:

Authenticated encryption everywhere. Correctly deployed TLS with valid certificate validation defeats passive interception and impersonation.
Enforce HTTPS with HSTS so browsers refuse to downgrade to plaintext.
Validate certificates strictly and heed browser warnings rather than clicking through them.
Protect the local layer with measures such as dynamic ARP inspection and network segmentation to limit an attacker's vantage point.
Use strong mutual authentication for sensitive systems, so both parties prove identity.

You can observe a change in a server's certificate fingerprint from the command line:

echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -fingerprint -noout

An unexpected fingerprint change can indicate interception, though it may also reflect a legitimate certificate rotation.

Key Takeaways

A man-in-the-middle attack secretly relays traffic between two parties who believe they are talking directly.
Attackers get on-path with techniques like ARP spoofing, rogue access points, DNS poisoning, and route hijacking.
Encryption alone is not enough; SSL stripping and rogue certificates target weak authentication and downgrade paths.
Correctly validated TLS, HSTS, and strict certificate checks are the primary defenses.
Hardening the local network and using mutual authentication further shrink an attacker's opportunities.

mitmarp-spoofinginterceptionnetwork-securityencryption