Home / Knowledge hub / Man-in-the-middle attack
Knowledge hub
Man-in-the-middle attack
Someone sitting between two parties, reading or changing what passes between them.
What it means
A man-in-the-middle attack happens when someone secretly positions themselves between two parties, such as a browser and your server, and can read or change what passes between them. Both ends believe they are talking directly to each other. OWASP now also uses the term manipulator-in-the-middle.
The idea that makes it click: the attacker does not need to break the connection, only to sit on the path and pass things along. If the traffic is plain, they read it. If it is encrypted but nobody checks who is on the other end, they can still relay it.
Why it matters
Whatever crosses that path is exposed: passwords, session cookies, card details, API keys, and the pages themselves, which can be altered to ask for more. A stolen session cookie leads straight to session hijacking without the password ever being needed.
It is most likely where people join networks you do not control, such as cafe Wi-Fi, hotel networks or a compromised router, and wherever your own services call each other without encryption. Customers rarely know it happened, so you learn about it through fraud reports, not an alert.
How it shows up
The standard defence is TLS with a valid certificate, which both encrypts traffic and lets the client verify the server. In practice, apps go wrong by serving some pages or API calls over plain HTTP, by accepting invalid certificates in code, or by switching off verification to make a test pass and forgetting to switch it back.
Add HSTS so browsers refuse plain HTTP, redirect all HTTP to HTTPS, and mark session cookies as secure. Mobile apps that handle sensitive data can use certificate pinning. Check internal service-to-service calls as well, since those are often left unencrypted.
Questions people ask
Man-in-the-middle attack, answered
Does HTTPS stop man-in-the-middle attacks?
Mostly, when it is set up properly. HTTPS encrypts traffic and checks the server's certificate, so a third party on the path cannot read or change it without the browser warning the user.
It fails if the app also serves plain HTTP, ignores certificate errors or lets users click through warnings.
Is public Wi-Fi still dangerous?
Less than it used to be, because most sites use HTTPS. The risk remains for anything not using it and for users who accept certificate warnings.
A VPN adds a protected tunnel but does not replace HTTPS on your own site.
What is the difference between a MITM attack and a replay attack?
In a man-in-the-middle attack, the attacker sits on the path and can read or change live traffic. In a replay attack, they capture a valid message and send it again later.
They often work together, which is why single-use values matter.
How can we test for it?
Check that every page and API call works only over HTTPS, that HTTP redirects, that HSTS is present, and that your clients reject invalid certificates.
A test with a proxy that presents a certificate the client should not trust will show whether verification is actually on.
Can a certificate be faked?
Not easily, because browsers only trust certificates issued by trusted authorities. Risk comes from a stolen private key, a mis-issued certificate or a device that has been made to trust a rogue authority.
That is why key protection and expiry monitoring matter.
Sources
Where this comes from
Related
Terms that sit next to this one
TLS
The protocol that encrypts traffic between a browser and a server.
HSTS
A header telling browsers to use HTTPS only for your site, every time.
Encryption in transit
Protecting data while it travels between a browser and your servers.
Certificate pinning
An app accepting only one expected certificate, so a fake one is refused.
Session hijacking
Stealing the token that tells your application a browser is logged in.
Is anything still sent in plain?
We check that traffic and cookies are protected the way your app claims, and each finding carries the request and response that showed it. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.