Man-In-The-Middle attack (MITM)

Man-In-The-Middle attack (MITM) :

One of the most successful vectors for gaining control of customer information and resources is through man-in-the-middle attacks. In this class of attack, the attacker situates himself between the customer and the real web-based application, and proxies all communications between the systems. From this vantage point, the attacker can observe and record all transactions. This form of attack is successful for both HTTP and HTTPS communications. For man-in-the-middle attacks to be successful, the attacker must be able to direct the customer to their proxy server instead of the real server



An attacker puts up a fake bank website and entices user to that website. User types in his password, and the attacker in turn uses it to access the bank's real website. Done right, the user will never realize that he isn't at the bank's website. Then the attacker either disconnects the user and makes any fraudulent transactions he wants, or passes along the user's banking transactions while making his own transactions at the same time.


The MITM attack could also be done over an https connection by using the same technique; the only difference consists in the establishment of two independent SSL sessions, one over each TCP connection. The browser sets a SSL connection with the attacker, and the attacker establishes another SSL connection with the web server. In general the browser warns the user that the digital certificate used is not valid, but the user may ignore the warning because he doesn’t understand the threat. In some specific contexts it’s possible that the warning doesn’t appear, as for example, when the Server certificate is compromised by the attacker or when the attacker certificate is signed by a trusted CA and the CN is the same of the original web site.

Here is a list of Different type of MITM attacks

LOCAL AREA NETWORK: -

* ARP poisoning -
* DNS spoofing
* STP mangling
* Port stealing

FROM LOCAL TO REMOTE (through a gateway):

* ARP poisoning
* DNS spoofing
* DHCP spoofing
* ICMP redirection
* IRDP spoofing - route mangling

REMOTE:

* DNS poisoning
* Traffic tunneling
* Route mangling

However with respect to Identity Theft 'Transparent proxy attack' and 'DNS poisoning attack' are the most popular amongst Hacking community.
* Transparent proxy attack


MITM is not only an attack technique, but is also usually used during the development step of a web application or is still used for Web Vulnerability assessments.