What Is a Man-in-the-Middle Attack?

A Man-in-the-Middle (MITM) attack happens when an attacker secretly intercepts communication between two parties. Learn how ARP spoofing, SSL stripping, and rogue access points work — and how to defend against them.

What Is a Man-in-the-Middle Attack?

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly intercepts and potentially alters communication between two parties who believe they are communicating directly with each other. The attacker sits between the victim and the legitimate server — reading, modifying, or injecting data without either side knowing.

How a MITM Attack Works

Normal:
User ─────────────────────────── Server

MITM attack:
User ──── Attacker (intercepts) ──── Server

Once in position, the attacker can:

  1. Eavesdrop — read all traffic passing through
  2. Modify data — change requests or responses in real time
  3. Inject content — insert malicious code or redirect to fake pages
  4. Steal credentials — capture usernames, passwords, session-how-the-world-wide-web-works) tokens

Common MITM Techniques

1. ARP Spoofing (ARP Poisoning)

ARP maps IP addresses to MAC addresses on a local network. An attacker sends fake ARP replies associating their MAC address-explained) with a victim's IP. All traffic meant for the victim now flows through the attacker first.

Prevention: Dynamic ARP Inspection (DAI) on managed switches, static ARP entries.

2. DNS Spoofing (DNS Cache Poisoning)

The attacker corrupts a DNS resolver's cache with false records, redirecting users to malicious servers even when they type the correct domain-kerberos-directory-services-explained) name.

Example: You type bank.com → DNS returns attacker's IP → you land on a fake bank site.

Prevention: DNSSEC-and-how-does-it-work), encrypted DNS (DoH/DoT).

3. SSL Stripping

The attacker downgrades an HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) connection to HTTP, reading traffic while the server thinks it is encrypted.

User requests: https://bank.com
Attacker intercepts → serves HTTP to user, keeps HTTPS to server
User sees HTTP (no padlock) — attacker reads everything

Prevention: [HTTP Strict Transport Security](/learning-center/what-are-http-security-headers-CORS-HSTS-explained)-csp-hsts-explained) (HSTS), always check the padlock.

4. Rogue Wi-Fi Access Point (Evil Twin)

The attacker creates a fake Wi-Fi hotspot with the same SSID as a legitimate network. Victims connect and route all traffic through the attacker.

Prevention: Avoid untrusted public Wi-Fi; use a VPN.

5. Session Hijacking

After a user logs in, the attacker steals their session-how-the-world-wide-web-works) cookie and impersonates them — no password needed.

Prevention: Secure + HttpOnly + [SameSite-cross-site-request-forgery-explained) cookie-how-the-world-wide-web-works)](/learning-center/what-is-csrf-cross-site-request-forgery-explained) flags, short session timeouts, MFA-explained).

Real-World Examples

| Year | Attack | Impact | |------|--------|--------| | 2011 | DigiNotar CA breach | Fake certificates-how-https-keeps-your-data-safe)-tls-how-HTTPS-keeps-your-data-safe) issued; users MITM'd on Google | | 2015 | Lenovo Superfish | Pre-installed software intercepted HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) on millions of laptops | | 2017 | KRACK (WPA2 attack) | Attackers within Wi-Fi range could decrypt traffic |

How to Detect a MITM Attack

  • Unexpected certificate-certificates-and-PKI-explained) warnings in your browser
  • Duplicate MAC addresses in your [ARP table](/learning-center/what-is-arp-address-resolution-protocol-explained) (arp -a)
  • Unusual network latency or traffic anomalies
  • certificate-certificates-and-PKI-explained) Transparency log mismatches

How to Defend Against MITM Attacks

| Protection | What It Does | |-----------|-------------| | HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) everywhere | Encrypts data in transit | | HSTS-security-headers-cors-CSP-hsts-explained) | Forces browsers to use HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) only | | certificate-certificates-and-PKI-explained) pinning | Apps reject unexpected certificates-tls-how-HTTPS-keeps-your-data-safe) | | VPN | Encrypts all traffic on untrusted networks | | MFA-explained) | Stolen credentials alone are insufficient | | DNSSEC-and-how-does-it-work) | Validates DNS responses cryptographically |

Quick Recap

  • A MITM attack places the attacker between two communicating parties without their knowledge
  • Common techniques: [ARP spoofing](/learning-center/what-is-arp-address-resolution-protocol-explained), DNS poisoning, SSL-how-https-keeps-your-data-safe) stripping, evil twin Wi-Fi
  • HTTPS-how-https-keeps-your-data-safe)-tls-how-https-keeps-your-data-safe) and TLS are your primary defences — always verify the padlock
  • On public Wi-Fi, always use a VPN
  • MFA-explained) limits the damage even when credentials are compromised