logo

Man-in-the-Middle (MITM) Attacks

Category:

Network

Summary:

How man-in-the-middle attacks intercept and alter network traffic, how to detect them, and how encryption and network hardening prevent them.

A man-in-the-middle (MITM) attack is one where an attacker secretly positions themselves between two communicating parties to read — and sometimes alter — the traffic passing between them. On a local network this usually means poisoning the path traffic takes so it flows through the attacker first. MITM is the umbrella for techniques like ARP spoofing, DNS spoofing, and rogue access points, and it’s a common route to credential theft and relay into Active Directory.

How It Works

Most MITM attacks abuse trust in unauthenticated network protocols. ARP has no authentication, so an attacker can claim to be the gateway and reroute a victim’s traffic through their own machine. Spoofed DNS on port 53 responses send victims to attacker-controlled hosts. Once in the middle, the attacker can capture credentials, downgrade encryption, or relay authentication to other services.

How to Detect It

  • Monitor for ARP anomalies — several IPs mapping to one MAC, or a gateway MAC that suddenly changes.
  • Watch for unexpected DNS answers and rogue DHCP, LLMNR, or NBT-NS responders on the LAN.
  • Alert on internal services being downgraded from HTTPS to HTTP or on unexpected certificate changes.

Want to save time on reporting?

Let PentestPad generate, track, and export your reports - automatically.

logo-cta

How to Defend Against It

  • Enforce encryption everywhere (TLS, HTTPS, SSH) so intercepted traffic is useless, and use HSTS to prevent downgrades.
  • Disable legacy name-resolution protocols (LLMNR, NBT-NS) that responders abuse, and enable SMB signing and LDAP channel binding to stop relay.
  • Use Dynamic ARP Inspection and DHCP snooping on managed switches, and 802.1X for network access control.

Validating Your Defenses

An authorized internal penetration test reveals whether an attacker on the LAN can still intercept traffic or relay authentication, and which systems are exposed. Capture every intercepted credential and relay path so the evidence lands in the pentest report instead of a scratch terminal you’ll lose.