📖 What is Man-in-the-Middle (MitM)?
A Man-in-the-Middle (MitM) attack occurs when a malicious actor secretly relays and possibly alters the communications between two parties who believe they are directly communicating with each other. This allows the attacker to intercept sensitive data, steal session cookies, or inject payloads.
"While ARP poisoning is a way to achieve MitM on a local network, MitM is the overall objective. Other methods include DNS spoofing and rogue access points."
📚 Certification: CompTIA PenTest+ (PT0-002)
🔑 What are the Key Concepts of Man-in-the-Middle (MitM)?
- ▸ ARP Poisoning involves sending fake ARP messages to link an attacker's MAC address with a legitimate IP, intercepting traffic on local networks.
- ▸ DNS Spoofing redirects users to malicious websites by corrupting DNS cache or responses, making the victim believe they are on a trusted site.
- ▸ SSL/TLS Stripping forces a browser to communicate over unencrypted HTTP instead of HTTPS, allowing the attacker to capture plaintext credentials and cookies.
- ▸ Session Hijacking uses intercepted session tokens to impersonate a user, bypassing authentication by taking over an already established, valid communication session.
- ▸ Rogue Access Points act as fake wireless gateways, tricking devices into connecting so the attacker can monitor and modify all wireless traffic.
🎯 How does Man-in-the-Middle (MitM) appear on the PT0-002 Exam?
You may be asked to identify the correct tool, such as Bettercap or Ettercap, when a scenario describes intercepting traffic on a local network using ARP spoofing to capture credentials.
A scenario might describe a user being redirected to a fraudulent login page despite entering the correct URL, requiring you to identify DNS spoofing as the method used to divert traffic.
Expect questions about analyzing packet captures where a secure HTTPS connection is downgraded to HTTP, which is a primary indicator of an SSL stripping attack used to steal data.
❓ Frequently Asked Questions
How does HSTS mitigate the risk of SSL stripping?
HTTP Strict Transport Security (HSTS) tells the browser to only communicate with a website using HTTPS. This prevents the browser from ever attempting an unencrypted HTTP connection, effectively blocking SSL stripping.
What is the difference between ARP poisoning and DNS spoofing?
ARP poisoning targets the Data Link layer (Layer 2) to redirect traffic within a local network, while DNS spoofing targets the Application layer to redirect traffic globally.
Can MitM attacks occur over a wireless connection without a rogue AP?
Yes, attackers can use techniques like 'Evil Twin' attacks or exploit vulnerabilities in WPA2/WPA3 to intercept traffic between a legitimate client and a real access point.