MITM — Man in the Middle Attack

Attacker secretly intercepts communication between two parties, each thinking they're talking directly to the other.

Alice ─────── [Attacker] ─────── Bob
 thinks it's Bob      thinks it's Alice

How It Works

1. Alice sends message to Bob
2. Attacker intercepts it
3. Attacker can read, modify, or inject data
4. Forwards (possibly altered) message to Bob
5. Neither side knows

Common MITM Techniques

Technique	How
ARP Spoofing	Attacker sends fake ARP replies, maps their MAC to victim's IP on local network
DNS Spoofing	Fake DNS response → victim goes to attacker's server
SSL Stripping	Downgrade HTTPS to HTTP so traffic is unencrypted
Rogue WiFi	Fake hotspot, all traffic flows through attacker
BGP Hijacking	Attacker announces fake routes, redirects internet traffic

ARP Spoofing (Most Classic on LAN)

Normal:
Alice --- "Who has 192.168.1.1?" --- Router replies with its MAC

ARP Spoofed:
Alice --- "Who has 192.168.1.1?" --- Attacker replies "It's my MAC!"
Now Alice sends all traffic to attacker

SSL Stripping

Alice --- https://bank.com ---> Attacker intercepts
Attacker --- https://bank.com ---> Bank (real HTTPS)
Attacker --- http://bank.com ---> Alice (downgraded to HTTP)

Alice thinks she's secure, but attacker sees everything

Defenses

Defense	Protects Against
TLS/HTTPS	Encrypts traffic, hard to read even if intercepted
HSTS	Forces HTTPS, prevents SSL stripping
Certificate Pinning	App only trusts specific cert, rejects fake ones
ARP inspection (DAI)	Switch validates ARP replies
MFA	Stolen credentials alone aren't enough
VPN	Encrypts all traffic on untrusted networks

Why TLS stops MITM: Attacker can intercept the connection but can't forge the server's certificate — browser throws a warning. Unless attacker has a trusted CA cert (rare, nation-state level).