Man-in-the-Middle Attack Simulation

A Man-in-the-Middle (MITM) attack occurs when an unauthorized entity secretly positions themselves between two communicating parties (such as a client browser and a web server). The attacker gains the capability to eavesdrop (sniff) on the traffic, and potentially alter or inject messages without either party realizing the conversation has been compromised.

Interception can happen at several physical and logical layers of the networking stack:

• ARP Spoofing / Cache Poisoning: On local Ethernet or Wi-Fi subnets, an attacker sends falsified Address Resolution Protocol messages linking their MAC address with the default router's IP address, directing all local traffic through the attacker's machine.
• Rogue Wi-Fi Access Points (Evil Twin): An attacker broadcasts a Wi-Fi network with the exact SSID of a legitimate hotspot. When victims connect, all their uplink traffic traverses the attacker's gateway.
• DNS Spoofing / Hijacking: Malicious actors forge domain name resolution answers, redirecting users navigating to a legitimate site towards an attacker-controlled intermediate proxy.
• Packet Sniffing: In shared transmission media (such as unencrypted wireless channels or old network hubs), network interface cards in promiscuous mode can capture every broadcast frame.

Public Wi-Fi networks (cafes, airports, hotels) often lack client isolation and strong layer-2 encryption. This means:

• Any connected user shares the exact same radio broadcast medium as everyone else.
• Without WPA3-Enterprise or individual client encryption keys, raw radio packets can be sniffed by anyone nearby with a Wi-Fi adapter.
• Attackers can easily pose as the gateway router using simple tools, intercepting every HTTP transmission before forwarding it onward.

HTTPS (HTTP over TLS) provides three essential cryptographic guarantees for data in transit:

1. Confidentiality (Encryption): Traffic is encrypted with robust symmetric ciphers (e.g. AES-GCM or ChaCha20). Even if an eavesdropper captures the raw frames, they only see pseudo-random ciphertext.
2. Integrity (Tamper Resistance): Each record includes a Message Authentication Code (MAC) or AEAD tag. If a man-in-the-middle modifies even a single bit in transit, the recipient's TLS stack detects the corruption and terminates the session.
3. Authentication (Peer Identity): The server proves its identity through a digital certificate signed by a trusted Certificate Authority (CA), verifying that the client is connected to the genuine entity.

Encryption alone is not enough without authentication. If an attacker sits between Alice and Bob, the attacker could establish one TLS connection with Alice and another separate TLS connection with Bob (acting as a terminating proxy).

Digital Certificate Validation defeats this:

• The server must present an X.509 certificate issued by a trusted root CA present in the client's trust store.
• The certificate domain (Common Name / SAN) must strictly match the destination host.
• The server must prove possession of the private key corresponding to the certificate's public key.
• If an attacker tries to inject a forged or self-signed certificate, modern browsers display prominent security warnings and refuse to connect unless overridden.