Cybersecurity glossary
What is a Man-in-the-Middle (MITM) Attack?
Learn what a man-in-the-middle (MITM) attack is, how attackers intercept or alter communications, common network and TLS scenarios, and which defenses—HTTPS, HSTS, and certificate checks—reduce risk.
Definition
A man-in-the-middle (MITM) attack is a threat model in which an adversary positions between communicating parties to intercept, relay, modify, or impersonate traffic so that one or both sides believe they are talking directly to each other.
Why MITM matters
Communication security assumes the other party is who they claim to be and that the path cannot silently rewrite messages. A man-in-the-middle (MITM)—also called an on-path attacker—breaks that assumption by inserting themselves into the conversation.
MITM is a position as much as a technique. From that position, adversaries can steal credentials, inject malware into downloads, downgrade encryption, or alter financial transactions. Defenses focus on making interception detectable and cleartext impossible.
How MITM attacks work
Gain an on-path position
Compromise Wi-Fi, route traffic through a malicious gateway, poison DNS, or control a proxy.
Intercept or relay connections
Victim traffic passes through attacker infrastructure that forwards to the real destination—or impersonates it.
Defeat or avoid authentication
Abuse cleartext protocols, trick users past cert warnings, or present certificates trusted by the victim device.
Read or modify data
Credentials, cookies, downloads, and API calls become visible or alterable.
Maintain stealth
The attacker relays responses so both sides believe the session is normal.
Monetize access
Account takeover, fraud, malware delivery, or long-term espionage follows.
Common MITM scenarios
Hostile Wi-Fi
Evil twin access points and ARP spoofing on local networks redirect traffic through attacker devices.
SSL stripping
Users stay on HTTP while attackers speak HTTPS upstream, capturing secrets in cleartext.
DNS redirection
Poisoned or hijacked resolution sends victims to attacker IPs that mimic services.
Broken TLS validation
Apps that ignore certificate errors make MITM certificates trivial to accept.
Defenses by layer
| Layer | Controls |
|---|---|
| Transport | HTTPS/TLS everywhere, modern protocol versions, valid certificates |
| Browser policy | HSTS, certificate error blocking, secure cookie flags |
| DNS integrity | DNSSEC where useful, protected registrars, resolver security |
| Endpoint | Patching, no user-installed rogue CAs, malware prevention |
| Identity | MFA so intercepted passwords alone are insufficient |
Practical checklist
- Serve HTTPS on all public endpoints and redirect HTTP with HSTS after HTTPS is solid.
- Never ship clients that disable certificate validation for convenience.
- Treat certificate warnings as stop signs in user education—especially on public Wi-Fi.
- Inventory enterprise TLS interception proxies; limit scope and protect their CA keys.
- Use phishing-resistant MFA for sensitive accounts.
- Monitor for unexpected certificates via Certificate Transparency.
- Prefer modern TLS (1.2+/1.3) and disable obsolete protocols that enable downgrade stories.
- Assume local networks are hostile when designing mobile and API clients.
The practical takeaway
A man-in-the-middle (MITM) attack places an adversary between parties to intercept or alter communications. Encryption with authenticated TLS, HSTS, intact certificate validation, and strong identity controls make that position far less useful.
If traffic is cleartext—or TLS is “verified” by ignoring errors—MITM is not theoretical. It is an expected failure mode on untrusted networks.
Related security terms
HTTPS
Encrypted HTTP that authenticates servers and frustrates casual MITM eavesdropping.
HTTP Strict Transport Security (HSTS)
Browser policy that blocks SSL-stripping downgrades to cleartext HTTP.
DNS Spoofing / Cache Poisoning
A technique often used to steer victims toward attacker-controlled paths.
Certificate Authority (CA)
Trust anchors clients use when deciding whether a TLS endpoint is authentic.
Frequently asked questions
What is a MITM attack in simple terms?
A MITM attacker sits between you and the service you think you are contacting. They can read or change messages, or pretend to be the other side, if the connection is not properly authenticated and protected.
Does HTTPS stop all MITM attacks?
HTTPS greatly raises the bar by encrypting traffic and authenticating the server certificate. MITM can still succeed if users ignore warnings, trust rogue CAs, or use cleartext protocols.
What is SSL stripping?
SSL stripping is a MITM technique that keeps the victim on HTTP while the attacker speaks HTTPS to the real server, exposing the user’s side as cleartext. HSTS helps prevent it for known HTTPS sites.
Where do MITM attackers position themselves?
Common positions include compromised Wi-Fi, malicious hotspots, ISP/path attackers, compromised routers, corporate proxies, and malware on the endpoint itself.
Is a corporate TLS inspection proxy a MITM?
Technically it performs TLS interception using an enterprise-trusted CA. It can be legitimate with consent and controls, but it concentrates risk and must be tightly governed.
How can users reduce MITM risk?
Prefer HTTPS, heed certificate warnings, avoid untrusted networks for sensitive tasks, use VPN carefully, keep devices patched, and enable MFA so stolen sessions are harder to reuse.
How should developers defend against MITM?
Enforce TLS with valid certificates, enable HSTS, pin sparingly where appropriate, validate certificates in mobile apps, and never ship apps that disable TLS verification.
References
Explore authoritative guidance and frameworks related to man-in-the-middle (mitm).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.