# What Is a Man-in-the-Middle (MITM) Attack? How It Works and How to Prevent It

> A plain-English explainer on man-in-the-middle attacks: what they are, how they work (ARP spoofing, rogue Wi-Fi, DNS spoofing, SSL stripping, adversary-in-the-middle phishing kits), the main attack classes, and the defenses that actually stop them — TLS and HSTS, certificate validation, VPNs on untrusted networks, phishing-resistant MFA, mutual TLS and DNSSEC.

Source: https://playciso.com/blog/man-in-the-middle-attack-explained · Published: 2026-10-23 · Publisher: PlayCISO (https://playciso.com)

---

A man-in-the-middle (MITM) attack is one where an attacker quietly inserts themselves between two parties who believe they are talking directly to each other. From that position the attacker can read the traffic, and often change it, without either side noticing. It is one of the oldest ideas in network security and, thanks to modern phishing kits, one of the most relevant again today. ## What a man-in-the-middle attack actually is The defining feature is interception of a communication channel. Instead of breaking into a laptop or a server, the attacker gets onto the path the data travels and relays messages between the two ends. Because they relay the conversation faithfully, both sides keep working normally — which is exactly why MITM attacks are so hard to spot. The attacker becomes a silent proxy that can eavesdrop on credentials, session tokens and sensitive data, and can tamper with content such as redirecting a payment or injecting malicious code. MITM attacks matter because they undermine confidentiality and integrity at the same time. Everything that flows through the attacker is exposed, and anything they alter is trusted by the recipient. The underlying cause is almost always the same: the channel was not properly encrypted, the encryption was not enforced, or the identity of the other end was never verified. ## How it works: the main techniques - ARP spoofing. On a local network, devices use ARP to map IP addresses to hardware addresses. An attacker sends forged ARP replies so that victim machines believe the attacker's machine is the gateway, routing their traffic through it first. - Rogue Wi-Fi and evil twins. The attacker stands up a wireless access point with the same or a plausible name as a legitimate one. Devices that connect send all their traffic through attacker-controlled hardware. - DNS spoofing. By tampering with name resolution, the attacker makes a legitimate hostname resolve to a server they control, so the victim connects to the attacker while thinking they reached the real site. - SSL stripping. Many sessions start over plaintext HTTP before upgrading to HTTPS. An attacker on the path can intercept that first request and keep the victim on unencrypted HTTP while talking HTTPS to the real server, reading everything in the clear. - Adversary-in-the-middle phishing kits. The modern, high-impact variant. A reverse-proxy toolkit hosts a pixel-perfect copy of a login page on a look-alike domain. When the victim logs in, the kit relays the password and the multi-factor step to the real service in real time and steals the authenticated session cookie, defeating many forms of MFA. ## The classes of attack to recognise It helps to group MITM by where the interception happens. **Network-layer** attacks (ARP and DNS spoofing, rogue access points) put the attacker on the traffic path. **Transport-layer** attacks (SSL stripping, downgrade attacks, forged or mis-issued certificates) defeat or avoid the encryption that should protect the channel. **Application-layer** attacks (adversary-in-the-middle phishing) fool the human into connecting through the attacker in the first place. Mapping an attack to its layer tells you which control is the right answer — a useful habit you can build with a structured [threat-modeling exercise](/tools/threat-model). ## How to prevent man-in-the-middle attacks No single control stops every variant, so defense is layered. The goal is a channel that verifies both encryption and identity, end to end. - Enforce TLS everywhere, with HSTS. Serve everything over HTTPS and send the HTTP Strict Transport Security header so browsers refuse to talk plaintext to your domain. This closes the SSL-stripping and downgrade paths. Review your configuration with a TLS hardening walk-through. - Validate certificates — and pin where it counts. Clients must reject invalid, expired or untrusted certificates rather than click through warnings. For sensitive machine-to-machine links, certificate pinning and mutual TLS (where both ends present and verify certificates) make impersonation far harder. - Use a VPN on untrusted networks. On any public or unmanaged Wi-Fi, tunnel traffic through a reputable VPN so a local attacker sees only encrypted VPN traffic, neutralising ARP spoofing and rogue access points. - Deploy phishing-resistant MFA. FIDO2 passkeys and hardware security keys bind authentication to the real site's origin, so a credential presented to a proxy domain fails — defeating adversary-in-the-middle kits that relay one-time codes and push approvals. If you are still on codes or push, this is the upgrade that matters most; see our guide to FIDO2 passkeys for the workforce. - Protect name resolution. Use DNSSEC and trusted, validating resolvers so responses cannot be silently forged, and monitor for unexpected changes to your DNS records. - Harden the endpoints and the humans. Keep devices patched, disable auto-connect to open networks, and train people never to dismiss certificate or security warnings. ## The takeaway A man-in-the-middle attack is a failure of either encryption or identity verification on the path between two parties. The defenses line up against those two weaknesses: encrypt and enforce it (TLS, HSTS, VPN), and verify who is on the other end (certificate validation, mutual TLS, phishing-resistant MFA, DNSSEC). Put them together and the middle of your connections stops being a place an attacker can profitably sit. ## Frequently asked questions **What is a man-in-the-middle attack?** It is an attack where someone secretly sits between two parties who think they are talking directly, relaying and potentially altering everything that passes between them. It targets the communication channel rather than the endpoints. **How do attackers get into the middle?** By getting onto the traffic path: ARP spoofing on a LAN, rogue or evil-twin Wi-Fi, DNS spoofing, SSL stripping, or an adversary-in-the-middle phishing proxy. **Does HTTPS stop it?** Properly enforced TLS with HSTS and validated certificates stops classic MITM, because it both encrypts the channel and verifies the server. It does not help if downgrades are allowed or users click through warnings. **How is MFA bypassed, and what stops that?** Phishing kits relay one-time codes and steal session cookies in real time. Phishing-resistant MFA such as FIDO2 passkeys, which is bound to the real site's origin, defeats this. **What should I do on public Wi-Fi?** Use HTTPS only, never dismiss certificate warnings, tunnel through a reputable VPN, keep devices patched, and use phishing-resistant MFA on important accounts.