Man in the middle

A man in the middle (MITM) attack is a type of attack in which an adversary secretly inserts themselves into the communication path between two parties — for example between a user's browser and a web server — in order to eavesdrop on, capture or modify the data being exchanged. The victims believe they are talking directly to each other, while all traffic actually passes through the attacker.

How a man in the middle attack works

MITM is carried out with a range of techniques: impersonating a Wi-Fi access point, poisoning ARP tables on a local network, spoofing DNS responses, or hijacking sessions. When traffic is unencrypted, the attacker reads logins, passwords, card details or session cookies in plain text. More advanced variants, such as SSL stripping, try to force a downgrade from HTTPS to unencrypted HTTP to bypass protection.

Practical application

Defending against MITM relies mainly on encryption and authentication. An SSL certificate and the TLS protocol ensure that even intercepted data stays unreadable, while the certificate verifies the server's identity. Enforcing HTTPS across the entire site, together with the HSTS header, blocks attempts to downgrade the connection to an unencrypted version.

Additional layers include DNSSEC against forged DNS responses, a VPN on untrusted networks, current cryptographic libraries, and avoiding certificates with outdated algorithms. MITM attacks are often a stage in broader campaigns and are combined with phishing, which is why user awareness and reacting to browser certificate warnings matter just as much as server configuration.

For administrators, it is important that the web server offers only modern protocol versions (TLS 1.2 and 1.3), disables outdated ciphers and has a correctly configured certificate chain. It is also worth using mechanisms such as certificate pinning in mobile apps and monitoring Certificate Transparency logs, which reveal when an unauthorized certificate is issued for a domain. A layered approach — encryption, authentication and monitoring — means that even if an attacker manages to intercept traffic, they cannot read or modify it without being detected.