Man-in-the-middle attacks (MITM): how they work, limits, and practical checks

What a man-in-the-middle attack is

A man-in-the-middle (MITM) attack happens when an attacker inserts themselves between two parties who believe they are communicating directly (for example, a browser and a website, or an app and an API). The attacker may try to read the traffic (eavesdropping), change the data in transit (tampering), or redirect the connection to another destination (impersonation).

The key idea is not just “someone can see traffic,” but “someone can intercept the path and influence what each side thinks it is talking to.” When the attacker can’t affect the communication, the attack usually becomes limited to passive observation.

How MITM attacks typically work

MITM typically involves three steps:

Positioning or intercepting traffic: The attacker gains the ability to observe and/or reroute communications. This can occur on shared or compromised networks, through malicious routing, or via compromised network infrastructure.
Controlling the connection: The attacker attempts to establish separate connections—one between themselves and the client, and another between themselves and the real server. Each side may then believe it has a secure session with the other party.
Maintaining deception over time: The attacker may keep the session alive while relaying data, altering selected messages, or substituting content.

Where encryption matters: If the connection uses strong, properly implemented cryptography with correct certificate validation, a MITM attacker usually cannot convincingly impersonate the real endpoint without being detected. Where validation is weak or broken, the attacker’s ability to succeed increases.

Limitations and why MITM is not “automatic”

MITM attacks succeed only when the attacker can influence the communication and when the security controls in place can be bypassed. Common limitations include:

Certificate verification: Modern HTTPS/TLS relies on clients verifying server certificates. If the client properly checks trust chains and certificate names, impersonation becomes much harder.
End-to-end protections: Many applications use additional security checks on top of transport encryption (for example, message authentication or signature verification). These can reduce the value of tampering.
User and client warnings: If a browser or operating system detects certificate mismatches or invalid trust settings, it may warn the user or block the connection.
Attacker reach: Without the ability to intercept or reroute traffic, the attacker may only observe metadata (or fail entirely).

Because of these constraints, the “headline” technique varies in effectiveness: some attackers perform mostly passive interception, while others attempt active modification or redirection.

Practical checks to spot or reduce MITM risk

You can’t eliminate MITM risk entirely, but you can apply practical verification behaviors that make attacks harder to carry out and easier to detect.

Check HTTPS and certificate details Look for correct HTTPS behavior and ensure the certificate is valid for the site you intended to reach. If you see repeated warnings about certificate errors, do not continue as if nothing happened.
Notice unexpected prompts and connection changes Be cautious when a login page or certificate prompt appears that you didn’t expect. MITM attempts often surface as unusual warnings, redirects, or mismatched domain names.
Be alert to network context If you’re on a public or untrusted network, reduce exposure by limiting sensitive actions and using well-secured connections. Your risk may rise when network controls are weak or when devices share insecure settings.
Confirm destination integrity in the app you use For applications that support it, verify that they are using secure connections and that they correctly validate server identity. If an app silently accepts invalid certificates, that is a meaningful limitation.

MITM is closely related to other threat patterns:

Eavesdropping: observing traffic without altering it.
Impersonation: presenting as a legitimate endpoint.
TLS stripping (downgrade): trying to force a connection into a less secure mode.
DNS manipulation: steering users to attacker-controlled destinations.

These ideas overlap: a single campaign might combine traffic interception with certificate- and routing-related tactics.

Uncertainty note

Exact success conditions depend on the environment (client behavior, certificate validation, network controls, and application design). Treat any single check as a signal, not a guarantee.