What is MITM Attack?

A man-in-the-middle attack intercepts communications between two parties, allowing attackers to eavesdrop, modify data in transit, or impersonate legitimate endpoints.

What is a man-in-the-middle attack?

A man-in-the-middle attack occurs when an adversary secretly intercepts and potentially alters communications between two parties who believe they are communicating directly. The attacker positions themselves in the communication path through techniques like ARP spoofing, DNS poisoning, or rogue access points, enabling eavesdropping on sensitive data, credential theft, and session hijacking.

What techniques enable MITM attacks?

MITM techniques include ARP cache poisoning to redirect local network traffic, DNS spoofing to redirect domain resolution, BGP hijacking for route manipulation, SSL stripping to downgrade HTTPS connections, rogue Wi-Fi access points mimicking legitimate networks, DHCP spoofing to control network configuration, and LLMNR/NBT-NS poisoning in Windows environments to capture authentication credentials.

How does SSL stripping work?

SSL stripping downgrades HTTPS connections to HTTP by intercepting the initial unencrypted request before the TLS handshake. The attacker maintains an encrypted connection to the server while serving unencrypted content to the victim. Users may not notice the missing HTTPS indicator. HSTS preloading and HSTS headers mitigate this attack by forcing browsers to always use encrypted connections.

What defenses protect against MITM attacks?

Effective defenses include enforcing TLS with certificate pinning for critical applications, implementing HSTS with preloading, deploying 802.1X network access control, using certificate transparency monitoring, enabling DNSSEC for domain validation, deploying VPNs for untrusted networks, implementing mutual TLS for service-to-service communication, and monitoring for ARP anomalies and rogue DHCP servers.

How do MITM attacks affect wireless networks?

Wireless networks are particularly vulnerable to MITM attacks through evil twin access points that mimic legitimate networks, KARMA attacks exploiting device probe requests, WPA2 key reinstallation attacks, and Bluetooth MITM through relay proxies. Attackers in physical proximity can intercept wireless traffic without network access. Enterprise wireless security with 802.1X and certificate-based authentication significantly reduces these risks.

What tools do penetration testers use for MITM testing?

Penetration testers use tools like Bettercap for network MITM automation, mitmproxy for HTTP/HTTPS interception and modification, Responder for LLMNR/NBT-NS/MDNS poisoning, Evilginx2 for advanced phishing with session token capture, hostapd-wpe for rogue access point testing, and arpspoof for ARP cache poisoning. These tools are used with proper authorization to validate defensive controls.

How can organizations detect active MITM attacks?

Detection methods include monitoring for ARP table anomalies and gratuitous ARP packets, implementing certificate transparency monitoring for unauthorized certificates, deploying network intrusion detection signatures for known MITM tools, analyzing DHCP lease patterns for rogue servers, monitoring DNS responses for inconsistencies, and using endpoint agents that detect TLS interception or certificate changes.

What is the impact of MITM on encrypted communications?

While properly implemented TLS prevents passive eavesdropping, MITM attackers can compromise encrypted communications through certificate authority compromise, exploiting trust store vulnerabilities, leveraging trusted but malicious certificates from corporate inspection proxies, or targeting implementation flaws like improper certificate validation. Certificate pinning and transparency logs provide additional protection layers against these attack vectors.