Man-in-the-Middle attacks let attackers intercept and modify traffic between two parties. Both sides think they communicate directly.
ARP spoofing redirects local traffic through the attacker.
DNS spoofing returns false responses to redirect users to malicious servers.
SSL stripping downgrades HTTPS to HTTP.
Defenses include:
- TLS everywhere
- HSTS headers forcing HTTPS
- Certificate pinning for high-security apps
- Port security and DHCP snooping on switches