Man-in-the-Middle (MITM)
A man-in-the-middle attack intercepts communication between two parties, reading or modifying traffic without either party's knowledge. TLS prevents MITM by authenticating the server via certificates and encrypting the channel. MITM succeeds when: TLS is absent (HTTP), certificate validation is disabled, or the attacker controls a trusted CA.
Definition
Man-in-the-middle attacks position the attacker between client and server, relaying and potentially modifying traffic. On a local network, ARP spoofing redirects traffic through the attacker's machine. On WiFi, a rogue access point with the same SSID captures all traffic. At the network level, BGP hijacking can redirect internet traffic through malicious routers. TLS defeats MITM by: verifying the server's certificate chain (proving identity), using authenticated encryption (detecting modification), and negotiating session keys via Diffie-Hellman (preventing key extraction from recorded traffic). MITM still succeeds when: applications skip certificate verification (verify=False in Python requests), users click through certificate warnings, or attackers have access to a trusted CA's signing key (corporate TLS inspection proxies operate this way deliberately).
Examples
- –mitmproxy -p 8080 (intercepts HTTP/HTTPS with custom CA)
- –ARP spoof + sslstrip: downgrades HTTPS to HTTP on local networks
- –HSTS + certificate pinning prevents MITM even with a compromised CA
Related Protocols
Related Terms
HSTS (HTTP Strict Transport Security)
HSTS is an HTTP response header that instructs browsers to only connect via HTTPS for a specified duration. Once set, the browser refuses HTTP connections to that domain – even if the user types http://. HSTS prevents SSL-stripping MITM attacks. The preload list hardcodes HSTS into browsers, protecting even the first visit.
DNS Spoofing
DNS spoofing injects forged DNS responses to redirect victims to attacker-controlled servers. Cache poisoning targets recursive resolvers – a single poisoned cache entry redirects all clients using that resolver. DNSSEC cryptographically signs DNS records to prevent spoofing. DNS-over-HTTPS (DoH) and DNS-over-TLS (DoT) encrypt queries.
ARP Poisoning
ARP poisoning (ARP spoofing) sends forged ARP replies on a local network to associate the attacker's MAC address with another host's IP. This redirects traffic intended for the victim (usually the gateway) through the attacker, enabling man-in-the-middle attacks. Defense: Dynamic ARP Inspection (DAI) on managed switches.