MITM (Man-in-the-Middle)
Definition
Any attack in which the adversary sits between two endpoints and reads or modifies traffic. ARP poisoning, rogue access points, BGP hijacks and SSLstrip are all paths into MITM.
- Full name
- Man-in-the-middle attack
- Mechanism
- Adversary positions between two communicating endpoints
- Common vectors
- ARP poisoning, rogue access points, BGP hijacks, SSLstrip
- Effect
- Reads or modifies traffic in transit
Common questions
How does ARP poisoning specifically enable a MITM attack on a local network?+
ARP poisoning sends forged Address Resolution Protocol messages that associate the attacker's MAC address with a legitimate IP address such as the network gateway, tricking other devices into routing their traffic through the attacker's machine before it reaches its intended destination.
Does HTTPS fully prevent man-in-the-middle attacks?+
It significantly raises the difficulty by encrypting traffic and authenticating the server's certificate, but techniques like SSLstrip attempt to silently downgrade a connection to plain HTTP, and a compromised or misissued certificate can still allow interception, so HTTPS reduces rather than eliminates the risk.
What forensic artefacts typically reveal that a MITM attack occurred on a network?+
Investigators look for evidence such as duplicate or conflicting ARP entries, unexpected certificate warnings or certificate mismatches in browser or application logs, unusual routing changes, and packet captures showing traffic passing through an unauthorised intermediate host.
Related terms
- ARP Poisoning
- Sending forged ARP replies on a LAN to bind an attacker's MAC to a victim's IP in other hosts' ARP caches, redirecting...
- CVE / KEV
- Common Vulnerabilities and Exposures (MITRE-assigned identifier per public flaw). Known Exploited Vulnerabilities catalogue (CISA), which lists CVEs proven to be actively exploited...
- DDoS (Distributed Denial of Service)
- Service-denial attack sourced from many hosts at once. Volumetric (saturate bandwidth), protocol (exhaust state on stateful boxes), or application-layer (exhaust application resources).
- OWASP Top 10
- Open Worldwide Application Security Project's ranking of the most common web application security risks, refreshed every 3 to 4 years. Current edition:...
- Packet Sniffing
- Capture of network traffic from a wired tap, a switch SPAN port, or a Wi-Fi monitor-mode radio. Passive sniffing reads; active sniffing...