Man-in-the-Middle (MitM)

How Attackers Use It

Attack Summary

Attacker positions themselves between a client and server — via ARP spoofing, rogue Wi-Fi, or DNS poisoning — to intercept, read, or modify traffic in real time.

• Attacker gains network position through rogue APs or spoofing.
• Traffic is intercepted and optionally downgraded or modified.
• Credentials, session tokens, and sensitive payloads are harvested.
• Manipulated responses deliver malware or force malicious redirects.

Defensive Strategy

Defense Summary

TLS everywhere with HSTS and certificate pinning. Network-level detection of ARP anomalies. 802.1X port authentication on wired networks. VPN on untrusted networks.

• Enforce HTTPS with HSTS and disable weak TLS versions.
• Use certificate pinning for high-trust mobile/native clients.
• Deploy network monitoring for ARP and DHCP anomalies.
• Require VPN on untrusted or public networks.

Detection Signals

• Certificate warnings and unexpected TLS handshake failures.
• ARP table changes and duplicate gateway MAC addresses.
• DNS responses with unusual TTLs or mismatched records.

Internal Resources

• General Knowledge
• Repositories
• How-To Guides