A MitM attacker secretly positions themselves between two communicating parties. Both the victim and the server believe they are communicating directly - while the attacker reads, records, and optionally alters every byte passing through their invisible relay.
The attacker physically locates near a public hotspot - a coffee shop, airport, hotel lobby - and creates a rogue access point broadcasting an identical or more powerful SSID. Victims' devices automatically connect to the strongest signal, placing the attacker in complete control of the network layer before any data flows.
On a wired corporate LAN or internal WiFi network, the attacker uses ARP poisoning to insert themselves between the victim and the default gateway. By continuously broadcasting false ARP replies, the attacker keeps their MAC address mapped to the gateway's IP in every nearby device's ARP cache - silently redirecting all internet-bound traffic.
With traffic flowing through the attacker's machine, sslstrip intercepts the victim's initial HTTP request (before any HTTPS redirect) and proxies the secure connection to the server - while serving the victim HTTP. The victim gets a valid page, the server thinks it's a normal HTTPS client, and every credential is in cleartext.
With the attacker positioned as a transparent relay, all authentication material flowing across the connection is automatically logged. The attacker doesn't need to actively probe anything - the victim delivers every credential, session token, and sensitive form field directly to them through normal browsing.
Beyond passive eavesdropping, the MitM attacker can actively alter data in transit. Responses from the server pass through the attacker before reaching the victim - allowing injection of malicious JavaScript into web pages, modification of file downloads, or alteration of bank transfer amounts before the victim confirms them.
Since the attacker controls the Evil Twin AP's DNS, they can intercept DNS queries and respond with attacker-controlled IP addresses. The victim's browser navigates to "bank.com" - but the DNS answer points to the attacker's server, which presents a convincing phishing page with a valid TLS certificate for extra credibility.
MitM attacks introduce detectable anomalies: ARP tables with duplicate MAC addresses, unexpected certificate changes, slight latency increases from the relay hop, and HTTP where HTTPS is expected. Network monitoring tools, endpoint agents, and careful users can all surface these signals - though most attacks go undetected.
| Protocol / Scenario | MitM Visibility | Protected By | Attack Result |
|---|---|---|---|
| HTTP (port 80) | Full plaintext - everything visible | Nothing - no protection | Every credential, form field, cookie, and body captured in cleartext. No effort required. |
| HTTPS without HSTS | Cleartext if SSL-stripped | TLS only if victim forces HTTPS | SSL strip downgrades to HTTP on first visit. Subsequent visits may be HTTP. Credentials exposed. |
| HTTPS + HSTS preload | Ciphertext only - unreadable | Browser enforces HTTPS - strips fail | SSL strip fails. Attacker sees encrypted TLS tunnel only. Credentials protected from eavesdrop. |
| HTTPS + Weak cert / self-signed | Cleartext after warning bypass | Browser warning - user may click through | Attacker presents fraudulent cert. Users who ignore certificate warnings expose all traffic. |
| FTP / Telnet / SMTP (plain) | Full plaintext - passwords in clear | No encryption by design | Credentials, commands, and file transfers all captured. Legacy protocols should be eliminated. |
| DNS (port 53, unencrypted) | All queries visible and spoofable | No authentication on standard DNS | Attacker intercepts queries and returns false responses. Redirect any domain to any server. |
| DNS over HTTPS / TLS (DoH/DoT) | Encrypted - queries not readable | TLS + server certificate validation | DNS queries are encrypted and authenticated. Spoofing not possible - responses integrity-protected. |
| WPA3 Enterprise WiFi | Per-session keys - cannot decrypt | PMF + 192-bit encryption + mutual auth | Even if attacker captures packets, per-session encryption prevents decryption. Evil twin requires valid cert. |