A man in the middle attack is when someone secretly places themselves between two parties who think they are talking directly, so they can read, record or change what passes between them. The victim sees a normal login page or a normal Wi-Fi connection. The attacker sees the passwords, session cookies and payments going past. OWASP, which now calls it a manipulator-in-the-middle attack, describes the attacker splitting one connection into two and acting as a proxy for both sides.
This guide covers how a man in the middle attack works, the main types, what it costs a business, and the controls that stop it. It is written for IT managers and business owners, not specialists.
Table of Contents
How does a man in the middle attack work?
Every interception has two stages: getting into the path, then handling the traffic.
First, the attacker has to get between the user and the service. On a local network that might mean tricking devices about where the router is. On public Wi-Fi it might mean offering a rogue hotspot. Online it might mean corrupting a DNS answer so a real address points at a fake server.
Second, the attacker deals with encryption. Over plain HTTP, OWASP notes that headers and payloads are visible in cleartext, so the attacker can read and edit them freely. Over HTTPS, the attacker has to run two separate TLS sessions, one with each side. Then they hope the user clicks through a certificate warning. That is much harder, so encryption matters a great deal.
What are the main types of MITM attack?
The techniques differ, but the goal is always the same: get into the path.
- ARP spoofing. The attacker sends forged ARP messages on a local network so that traffic meant for the gateway lands on their machine. ARP has no built-in authentication, so this works well on flat networks without switch protections.
- DNS spoofing. A resolver is fed false answers. Staff type a genuine web address and land on a copy of the site that harvests what they enter.
- Evil twin Wi-Fi. A rogue access point copies a trusted network name. Devices that join send everything through the attacker.
- SSL stripping. The attacker quietly downgrades a secure connection to plain HTTP, so the user never reaches the encrypted version of the page.
- Fraudulent certificates. The attacker presents a forged or wrongly issued certificate and relies on the user, or a poorly configured app, accepting it.
Phishing kits now use a related trick at scale. Reverse-proxy toolkits sit between the victim and the real login page. They steal the session once the user finishes multi-factor authentication. We covered one example in our piece on MFA bypass phishing.
What can an attacker do during a man in the middle attack?
The damage depends on what crosses the connection. OWASP lists several examples: capturing a session cookie from HTTP headers, and changing the amount in a money transfer inside an application’s traffic.
For a business, the realistic outcomes are:
- stolen credentials for email, VPN or cloud consoles;
- hijacked sessions that skip the login altogether;
- altered invoices or bank details in transit;
- a foothold for moving further into the network.
How do you prevent a man in the middle attack?
No single control covers every variant, so layer them. Start with encryption. Then harden the network. Then deal with people and devices.
Use HTTPS everywhere and enable HSTS
MDN’s TLS guidance names HTTPS as the defence against this class of attack, because TLS encrypts traffic and lets the browser confirm the server’s identity through its certificate. It also recommends redirecting HTTP to HTTPS and setting the Strict-Transport-Security header, which tells browsers to use HTTPS even when a user types an HTTP address. That blocks SSL stripping. MDN suggests a max-age of two years, and advises testing includeSubDomains first because any subdomain without HTTPS will break.
Retire old TLS versions
The National Cyber Security Centre says TLS 1.3 is the current version. TLS 1.2 is still strong when configured to its recommended profiles, while TLS 1.0 and 1.1 are deprecated and should be disabled. On SSL, its advice is blunt: “You must disable all versions of SSL.” Check your web servers, load balancers and VPN gateways, because legacy settings often survive for years.
Protect the local network
Switch features such as Dynamic ARP Inspection stop forged ARP replies. Segment the network so one bad device cannot see everyone’s traffic. Give staff their own authenticated Wi-Fi and keep guests on an isolated network. WPA3 or certificate-based WPA2-Enterprise makes an evil twin far less convincing, since devices check who they join.
Protect DNS
Use trusted resolvers and keep them patched. Consider DNSSEC validation if your provider supports it. Watch for unexpected changes to your own DNS records, because a hijacked record sends customers to the attacker.
Train people on the warning signs
Certificate warnings are not an annoyance to dismiss. Staff should treat them as a stop sign, especially on a login page. They should also avoid sensitive logins on public Wi-Fi, or use a company VPN when they must.
Use phishing-resistant authentication
Passkeys and FIDO2 security keys bind a login to the real website, so a reverse-proxy phishing page cannot replay them. SMS codes and push approvals do not give you that.
How do you find MITM weaknesses before attackers do?
Most interception risks are configuration problems. They stay invisible until someone looks. A scan can flag an old TLS version. It cannot tell you if a flat network lets one laptop poison ARP for the whole floor, or if your staff Wi-Fi accepts a lookalike access point.
That is where hands-on testing helps. An internal network penetration test tries the same interception techniques an attacker would use inside your offices, and a WiFi penetration test checks for rogue access points and weak wireless settings. If you want a scoped test, you can get in touch with Aardwolf Security and we will talk through what makes sense for your environment. Our guide to internal vs external penetration testing explains where each fits.
Frequently asked questions
Is a man in the middle attack the same as eavesdropping?
Not quite. Eavesdropping only listens. A man in the middle attack can also change messages, inject content and impersonate either side.
Does HTTPS make you immune?
No, but it raises the bar a lot. Attacks then depend on a user accepting a bad certificate, a compromised certificate, or a downgrade that HSTS should have prevented.
Is a VPN enough on public Wi-Fi?
A trusted VPN encrypts traffic between the device and the VPN endpoint, which covers the risky hotspot. It does not fix a phishing page you walk into willingly, so keep the other controls too.
Why do security teams run MITM techniques on purpose?
OWASP points out that these methods are widely used legitimately during application development and vulnerability assessments. Testers need to see what an attacker would see.
How common are these attacks?
Exact figures vary by source and method, so treat any single statistic with care. The techniques themselves are well documented and easy to run with free tools, which is reason enough to test for them.
Subscribe to our newsletter
Honest updates, straight to your inbox. Unsubscribe any time.
