Man-in-the-Middle Attack

هجوم الرجل في المنتصف

IntermediateSecurity1 min read

man-in-the-middle-attackmitmnetwork-interception

Definition

An attack where a malicious actor secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other.

هجوم يعترض فيه جهة خبيثة سراً وقد تُغيّر الاتصالات بين طرفين يعتقدان أنهما يتواصلان مباشرةً مع بعضهما البعض.

Why It Matters

HSTS prevents SSL stripping by forcing the browser to only connect via HTTPS after the first visit — even if the attacker redirects to HTTP.

يمنع HSTS نزع SSL بإجبار المتصفح على الاتصال عبر HTTPS فقط بعد الزيارة الأولى — حتى لو حاول المهاجم إعادة التوجيه إلى HTTP.

Full Definition

In a MITM attack, the attacker positions themselves between a client and server, relaying and potentially modifying traffic. The client thinks it's communicating with the legitimate server; the server thinks it's communicating with the legitimate client — both are wrong. MITM can intercept credentials and session tokens, inject malicious content, or decrypt traffic by impersonating the server's certificate. Common scenarios: public Wi-Fi, DNS spoofing, ARP poisoning. Defenses: TLS with proper certificate validation, HSTS, certificate pinning (mobile apps).

في هجوم MITM، يضع المهاجم نفسه بين العميل والخادم ويُحيل حركة المرور. يمكنه اعتراض بيانات الاعتماد وحقن محتوى خبيث. الدفاعات: TLS مع التحقق الصحيح من الشهادة وHSTS وتثبيت الشهادة.

Example Usage

“HSTS prevents SSL stripping by forcing the browser to only connect via HTTPS after the first visit — even if the attacker redirects to HTTP.”

“يمنع HSTS نزع SSL بإجبار المتصفح على الاتصال عبر HTTPS فقط بعد الزيارة الأولى — حتى لو حاول المهاجم إعادة التوجيه إلى HTTP.”

Knowledge Graph

AI Builder Tips

Avoid these mistakes when using Man-in-the-Middle Attack:

Using `NODE_TLS_REJECT_UNAUTHORIZED=0` in any environment other than localhost → This disables certificate validation entirely. Configure the CA certificate instead of bypassing validation.

Deploying apps that accept self-signed certificates without proper trust anchors → Configure the CA certificate instead — don't disable validation.

Assuming HTTPS prevents all MITM → If the user is tricked into accepting a rogue certificate, HTTPS provides no protection. Use HSTS and certificate pinning.

Generate a Prompt

Copy this prompt and use it directly with any AI model — no setup needed.

Ready-to-Use Prompt

Help me build a project using Man-in-the-Middle Attack.

Explain:
1. What is Man-in-the-Middle Attack and why it matters
2. The core architecture and required tools
3. Step-by-step implementation plan
4. Common mistakes to avoid: Using `NODE_TLS_REJECT_UNAUTHORIZED=0` in any environment other than localhost → This disables certificate validation entirely. Configure the CA certificate instead of bypassing validation., Deploying apps that accept self-signed certificates without proper trust anchors → Configure the CA certificate instead — don't disable validation., Assuming HTTPS prevents all MITM → If the user is tricked into accepting a rogue certificate, HTTPS provides no protection. Use HSTS and certificate pinning.
5. Best practices and production tips

Official Resources

No official documentation link on file for Man-in-the-Middle Attack yet.

Browse all AI terms Create free account