Man-in-the-Middle Attack (MITM)
Summary
- Attacker secretly intercepts and possibly alters communication between two parties
- Both parties believe they are communicating directly with each other
- HTTPS and certificate validation are the primary defenses
- Common on unsecured Wi-Fi networks and compromised routers
- HSTS preloading prevents the initial unencrypted request that enables interception
The Importance of MITM
MITM attacks are a fundamental threat to web communication. On unencrypted HTTP connections, any network intermediary (the Wi-Fi access point operator, the ISP, a compromised router) can read and modify all traffic. This means they can steal login credentials, inject malware, redirect traffic, or modify page content.
HTTPS with properly configured TLS is the primary defense against MITM. The TLS handshake authenticates the server (proving it is the real server, not an impostor) and encrypts all traffic (preventing eavesdropping and tampering). HSTS strengthens this by preventing SSL stripping attacks where the attacker downgrades the connection to HTTP.
MITM attacks remain relevant even with HTTPS in specific scenarios: compromised CA certificates, corporate TLS inspection proxies, malicious browser extensions, or devices with attacker-installed root certificates. Certificate Transparency, HSTS preloading, and certificate pinning (for mobile apps) provide additional layers of defense.
How to Check
An SSL checker verifies your TLS configuration is strong enough to resist MITM attacks. Check for proper certificate chain, strong cipher suites, HSTS header, and no support for deprecated TLS versions that have known vulnerabilities.
Check SSL Certificate