A man-in-the-middle (MITM) attack occurs when an attacker secretly positions themselves between two communicating parties — reading, altering, or injecting messages without either side knowing. At GCSE, understanding MITM attacks helps explain why encrypted connections such as HTTPS are essential for any sensitive communication on the internet.
What does "man-in-the-middle" mean?
Picture two friends passing notes through a courier. If the courier secretly opens every note, reads it, possibly changes the message, and seals it again before delivery, neither friend realises anything is wrong. That courier is the "man in the middle".
In computing, the attacker intercepts traffic between two systems — often a user and a web server — while both sides believe they are communicating directly. The attacker can:
- Eavesdrop — passively read all data, including passwords and payment details
- Alter data — modify requests or responses before forwarding them
- Inject content — insert malicious code, links, or instructions into the stream
- Replay attacks — capture and retransmit legitimate messages to repeat actions
What are common methods attackers use to position themselves?
Attackers must first intercept the traffic. Common techniques include:
| Technique | How it works |
|---|---|
| ARP spoofing | Sends fake ARP (Address Resolution Protocol) replies on a local network, associating the attacker's MAC address with a legitimate IP address, so traffic meant for a router or server arrives at the attacker's machine instead |
| Rogue Wi-Fi hotspot | Attacker sets up a fake Wi-Fi network (e.g. "Coffee Shop Free WiFi") — victims connect and all their traffic flows through the attacker |
| DNS spoofing | Poisons the DNS cache with false records, directing users to a fake site the attacker controls |
| SSL stripping | Downgrades an HTTPS connection to HTTP by intercepting the initial redirect, so data travels in plaintext |
Rogue Wi-Fi hotspots are particularly dangerous in public places such as airports, cafés, and libraries, where users routinely connect to unfamiliar networks without verifying their authenticity.
How does a MITM attack flow, step by step?
Scenario: a user logs in to their bank on a café's rogue Wi-Fi.
- User's device connects to the attacker's fake access point.
- User types
https://mybank.com— the attacker's device forwards the request to the real bank. - The bank responds. The attacker receives the response, strips the HTTPS encryption (SSL stripping), and forwards it to the user as plain HTTP.
- User's browser shows
http://mybank.com(unencrypted) — user does not notice. - User enters username and password. These travel to the attacker's machine in plaintext.
- Attacker captures the credentials and may forward them to the real bank to avoid suspicion.
- The user's login appears to succeed — they have no idea their credentials were stolen.
How does HTTPS protect against MITM attacks?
HTTPS (Hypertext Transfer Protocol Secure) uses TLS (Transport Layer Security) to encrypt the connection. TLS relies on digital certificates issued by trusted Certificate Authorities (CAs) to prove that a server is genuinely who it claims to be.
When a user connects to https://mybank.com:
- The server presents its TLS certificate, which contains its public key and is signed by a trusted CA.
- The browser checks the certificate against its built-in list of trusted CAs.
- If the certificate is valid, the browser uses the public key to establish an encrypted session (only the server can decrypt the initial exchange because only it holds the matching private key).
- All subsequent data is encrypted — an interceptor sees only ciphertext.
A MITM attacker cannot forge a valid certificate for mybank.com without access to the CA's private key or the server's private key. This is why browsers display a padlock and why visiting a site with an untrusted or mismatched certificate triggers a security warning.
What are the signs that a MITM attack might be occurring?
- Browser certificate warning — "Your connection is not private" or "Certificate error"
- HTTP instead of HTTPS on a site that should be secure
- Unexpected certificate issuer — the padlock details show an unfamiliar CA
- Sudden network slowness — traffic routing via an extra hop adds latency
- Unexpected pop-ups or unusual page content — injected content from the attacker
How can MITM attacks be prevented?
| Defence | How it helps |
|---|---|
| HTTPS everywhere | Encrypts traffic and authenticates the server via certificates |
| HSTS (HTTP Strict Transport Security) | Tells browsers to always use HTTPS for a domain, preventing SSL stripping |
| VPN on public networks | Encrypts all traffic between your device and the VPN server before it hits the public internet |
| Avoid unverified Wi-Fi | Do not connect to public hotspots without verifying the network name with staff |
| Certificate pinning | Apps hard-code the expected certificate, rejecting any other — even if a CA is compromised |
| Two-factor authentication (2FA) | Even if an attacker captures a password, a stolen credential alone is insufficient |
Frequently asked questions
How is a MITM attack different from a phishing attack?
Phishing tricks the user into visiting a fake website and entering their credentials voluntarily. A MITM attack intercepts the actual connection to a real website — the user types the correct URL, believes they are on the genuine site, but their data is captured in transit. Both attacks aim to steal credentials, but MITM is harder to spot because the user may reach the real service.
Can HTTPS be broken by a MITM attacker?
Not when properly implemented. A MITM attacker cannot decrypt HTTPS traffic without the server's private key or a fraudulently issued certificate. However, if the user ignores certificate warnings, if software has a vulnerability, or if an organisation's own network proxy has installed a root CA on employee devices (a technique used by some corporate monitoring tools), the attacker may successfully intercept traffic. Keeping software updated and never clicking past certificate warnings are key defences.
Is MITM only a threat on public Wi-Fi?
No — MITM attacks can also occur on home networks if a router is compromised, or through malware installed on a device that redirects DNS queries. Within corporate networks, misconfigured equipment can accidentally create interception scenarios. Public Wi-Fi increases the risk significantly, but the threat is not limited to it.
What is SSL stripping and why is HSTS the counter-measure?
SSL stripping exploits the moment before HTTPS is established. When a user types mybank.com (without https://), the browser first makes an HTTP request, which is then redirected to HTTPS. An attacker intercepts that initial HTTP request and never lets the upgrade happen, keeping the connection unencrypted. HSTS prevents this by instructing browsers that a domain must only ever be contacted over HTTPS — so even the initial request uses HTTPS, eliminating the window of vulnerability.
Need help understanding cybersecurity topics for your GCSE exam? Professor Turing at aitutors.me explains every concept step by step.