Man-in-the-middle attack
A man-in-the-middle attack is a network attack in which an adversary intercepts, relays, impersonates, or alters communication between parties.
Real-World Cryptography
A man-in-the-middle attack is an active attack in which an adversary intercepts and alters communication between two parties while impersonating each party to the other.
- How it is used
- Explains how active interception defeats unauthenticated key exchange and threatens browser, web, and device-pairing communications.
- How deep it goes
- Works through public-key substitution and defenses, stopping short of implementation-level transport details.
- Examples
- Uses Alice-and-Bob key substitution, browser HTTPS traffic, and Bluetooth phone-to-car pairing to illustrate interception and verification.
- What you can do after
- Diagnose/debug with it by distinguishing passive observation from active key substitution and checking authentication or SAS verification.
Read how Real-World Cryptography explains man-in-the-middle attack →
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
A man-in-the-middle attack is an attack in which an attacker secretly intercepts and relays communications between two parties, potentially altering the exchanged data.
- How it is used
- Classifies attacks that intercept and potentially alter communications between two parties.
- How deep it goes
- Explains the relay behavior and traces ARP poisoning from legitimate resolution through poisoned entries to intercepted frames.
- Examples
- Uses PC1, R1, spoofed ARP replies, poisoned ARP entries, and attacker-controlled MAC addresses.
- What you can do after
- Evaluate communications for interception by recognizing how ARP poisoning redirects frames through an attacker.
Grokking Web Application Security
A monster-in-the-middle attack is an attack in which an adversary positions itself between communicating parties to observe or manipulate their traffic.
- How it is used
- Frames network traffic interception as a risk HTTPS must prevent for web applications.
- How deep it goes
- Explains ARP spoofing and hostile hotspots, then gives HTTPS, HSTS, TLS, and certificate-handling defenses.
- Examples
- Uses phony ARP packets on Wi-Fi or corporate networks and an attacker-operated Wi-Fi hotspot.
- What you can do after
- Operate/configure HTTPS, HSTS, TLS requirements, certificates, and key access controls to resist traffic interception.
Read how Grokking Web Application Security explains man-in-the-middle attack →
Software Security for Developers
A man-in-the-middle attack is an attack in which an adversary intercepts and potentially alters communication between two parties while impersonating each party to the other.
- How it is used
- Uses MITM attacks to motivate TLS protection against eavesdropping, tampering, and impersonation.
- How deep it goes
- Explains interception, router impersonation, encryption, signatures, and certificate checks, but does not detail attack implementation.
- Examples
- Uses public Wi-Fi, compromised routers, DNS paths, and Cain & Abel impersonating a classroom router.
- What you can do after
- Evaluate whether TLS prevents intercepted traffic from being read, modified, or redirected to an impostor.
Read how Software Security for Developers explains man-in-the-middle attack →
Related concepts
- HTTPSaddressed by · HTTPS is HTTP carried over TLS, which provides encryption and endpoint authentication for network communication.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.