Man-in-the-Middle Attacks
Understand how attackers intercept and alter communication between two parties.
Man-in-the-Middle Attacks is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.
What is a MitM Attack?
In a Man-in-the-Middle (MitM) attack, an adversary secretly intercepts and relays communication between two parties who believe they are communicating directly with each other. The attacker can read, modify, or inject data.
ARP Spoofing
ARP (Address Resolution Protocol) spoofing sends fake ARP messages on a local network, associating the attacker's MAC address with a legitimate IP address. This redirects traffic through the attacker's machine.
Effective on unsegmented Layer 2 networks — this is why network segmentation matters.
DNS Spoofing
DNS spoofing returns forged DNS responses that redirect targets to attacker-controlled servers. Combined with a fake login page, this harvests credentials. DNSSEC prevents this by verifying DNS responses cryptographically.
SSL Stripping
SSL stripping downgrades HTTPS connections to HTTP. The attacker sits between client and server, maintaining HTTPS to the server while serving HTTP to the victim. HSTS (HTTP Strict Transport Security) headers prevent this when properly configured.
Rogue Wi-Fi Access Points
An attacker creates a Wi-Fi hotspot with a trusted name (e.g., "Airport_Free_WiFi"). Victims connect and all traffic passes through the attacker's device. Common in coffee shops and airports — always use a VPN on untrusted networks.
BGP Hijacking
BGP (Border Gateway Protocol) hijacking is a large-scale MitM where attackers (often nation-states or rogue ISPs) announce false BGP routes, redirecting internet traffic through their infrastructure. Affects millions of users at once.
Email MitM: SMTP Interception
Attackers can intercept email when servers don't enforce TLS for SMTP. STARTTLS downgrade attacks strip encryption from email in transit. SMTP MTA-STS and DANE policies enforce encrypted mail delivery.
HTTPS Certificate Attacks
Attackers can present forged TLS certificates if a victim's device trusts a rogue CA. This enables decrypting HTTPS traffic. Certificate Transparency logs and browser pin-ning (HPKP, though deprecated) reduce this risk.
Detection Techniques
Detecting MitM:
- ARP table anomalies — duplicate MAC addresses
- Unexpected certificate changes
- Latency increases (traffic routing through extra hop)
- Network monitoring and IDS alerts on ARP poisoning
Prevention Strategies
Preventing MitM:
- HTTPS everywhere with HSTS
- DNSSEC for DNS integrity
- Certificate pinning in mobile apps
- VPNs on untrusted networks
- Network segmentation and Dynamic ARP Inspection (DAI)
MitM in Penetration Testing
Pentesters use tools like:
arpspooforbettercapfor ARP poisoningmitmproxyor Burp Suite for HTTP interceptionettercapfor protocol dissection
Always requires written authorization.
bettercap -iface eth0
# then in bettercap:
arp.spoof on
net.sniff onQuick Check: MitM
Which attack intercepts HTTPS connections and serves HTTP to the victim, potentially exposing their traffic in plaintext?
Lesson Recap
MitM attacks intercept communication between two parties. Techniques include ARP spoofing, DNS spoofing, SSL stripping, and rogue Wi-Fi. Prevention requires HTTPS with HSTS, DNSSEC, certificate transparency, and network controls like Dynamic ARP Inspection. VPNs protect traffic on untrusted networks.
Frequently asked questions
Is the “Man-in-the-Middle Attacks” lesson free?
Yes — the full text of “Man-in-the-Middle Attacks” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.
What will I learn in “Man-in-the-Middle Attacks”?
Understand how attackers intercept and alter communication between two parties. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.
Do I need any experience to start Cyber Security Academy?
No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.
How long does the “Man-in-the-Middle Attacks” lesson take?
Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.
Can I write and run code in this Cyber Security Academy lesson?
Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.
All lessons in this course
- Phishing and Spear Phishing
- Malware: Viruses, Worms, Trojans, Ransomware
- Man-in-the-Middle Attacks
- Denial of Service and DDoS