TechKnowSurge

VideoSecurityFree

Adversary-in-the-Middle (AitM)

An adversary-in-the-middle (AiTM) attack occurs when a threat actor secretly positions themselves between two communicating parties, gaining the ability to intercept, alter, or block transmitted data. This class of attack poses risks to confidentiality, integrity, and availability, often without either party detecting the intrusion.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

An adversary-in-the-middle (AiTM) attack is a class of network-based attack in which a threat actor covertly positions themselves between two communicating parties, intercepting traffic that each endpoint believes is traveling directly to the other. By sitting in this position, the attacker gains full visibility and control over the data in transit, making it one of the more impactful attack categories in terms of potential damage and stealth. Because neither party is aware of the interception, the attack can persist undetected for extended periods, compounding the harm to the targeted organization. The attack carries implications across all three pillars of the CIA triad. Confidentiality is threatened through passive eavesdropping, where the attacker silently captures transmitted data. Integrity is at risk because the attacker can modify data in transit, either before it reaches the destination server or as responses return to the client. Availability can also be affected if the attacker chooses to delay, selectively drop, or block packets altogether rather than forwarding them. This degree of control over the communication flow gives the attacker significant leverage over the affected systems. The technique goes by several names in the security industry, including man-in-the-middle, machine-in-the-middle, manipulator-in-the-middle, and on-path attack, reflecting an ongoing shift toward gender-neutral terminology. MITRE ATT&CK formally classifies it as adversary-in-the-middle and lists it under both credential access and collection tactics. Specific sub-techniques include ARP cache poisoning, DHCP spoofing, and evil twin attacks, each representing a distinct method of achieving the same fundamental goal of intercepting network communications.

What you'll learn

Explain how an adversary-in-the-middle (AitM) attack intercepts communications between two parties and the potential impacts on confidentiality, integrity, and availability
Identify common names and sub-techniques associated with adversary-in-the-middle attacks, including ARP cache poisoning, DHCP spoofing, and evil twin attacks

What's covered

Adversary in the Middle Attack

Alternative Names
- Man in the Middle
- Machine in the Middle
- On Path Attack
- Man in the Browser
How the Attack Works
- Attacker Intercepts Traffic
- Client Sends to Adversary
- Adversary Controls Packets
CIA Triad Impact
- Confidentiality: Eavesdropping
- Integrity: Data Alteration
- Availability: Blocking or Delaying
MITRE ATT&CK Sub-Techniques
- ARP Cache Poisoning
- DHCP Spoofing
- Evil Twin

Key terms

Man-in-the-Middle Attack: An attack where an adversary secretly intercepts and potentially alters communications between two parties.
Confidentiality: The principle that information is accessible only to those authorized to access it.
Integrity: The assurance that data has not been tampered with and remains accurate and complete.
Availability: The assurance that systems and data are accessible and operational when needed by authorized users.
Address Resolution Protocol: A protocol used to map an IP address to a physical MAC address on a local network.
Dynamic Host Configuration Protocol: A network protocol that automatically assigns IP addresses and other configuration parameters to devices on a network.
ARP Cache Poisoning: A sub-technique of adversary-in-the-middle attacks where an attacker sends forged ARP messages to link their MAC address with a legitimate IP address, redirecting traffic through the attacker.
DHCP Spoofing: An attack technique in which a threat actor emulates a legitimate DHCP server to intercept and respond to client requests, enabling denial-of-service or adversary-in-the-middle attacks.
Evil Twin: A wireless attack in which an attacker sets up a rogue access point that broadcasts the same SSID as a legitimate network, tricking clients into connecting so the attacker can intercept or manipulate their traffic.

Topics

Adversary In The Middle Arp Cache Poisoning Dhcp Spoofing Evil Twin Network Security Cybersecurity Attacks

Transcript

An adversary attack can be one of the most devastating attacks there is. When somebody carries out an adversary attack, they can cause a lot of damage, and there's a lot of potential for a breach in confidentiality, a change in integrity, or loss of availability. And the thing is, some of this can be done all without anybody knowing about it. So it can be very devastating to a company when they have an adversary in the middle.

The Many Names for This Attack

One thing to note about an adversary-in-the-middle attack is that it can go by many different names. We have adversary in the middle, man in the middle, machine in the middle, manipulator in the middle, on-path attack, and man-in-the-browser attack. Man in the browser is a type of adversary-in-the-middle attack.

The idea behind this is that they can go by many different names, and one of the reasons is that we've gone through a bit of a name change. It used to always be called man-in-the-middle attack, but because of the term man in here, there's been a movement away from that and on to a more gender-neutral name. For that reason there are many different people who have kept the M in the name, like machine in the middle and manipulator in the middle. You see some people that have gone way off the tracks and call it an on-path attack, and we see CompTIA who does this. But one thing we see is that MITRE calls it an adversary in the middle. I think adversary in the middle is probably one of the more legitimate ways that we can go with this, so I'm going to be calling it an adversary in the middle for most of the time.

What the Attack Looks Like

In an adversary in the middle, an attacker relays and possibly alters communication between two parties. They're in between, they're in the middle.

Here we have a client machine. That client machine wants to talk to a server. But the key to what an adversary in the middle is, is that the adversary is in the middle of these two devices. So this client, instead of sending messages directly to the server, instead sends it directly to the adversary, and the adversary intercepts this and then can choose what to do with it before it sends it off to the server.

What the Adversary Can Do

There are several different things that this adversary can do when they sit in between this communication.

One, this could be an attack on confidentiality. If somebody is sitting in between this communication, they could be eavesdropping, and this could be an eavesdropping attack. Therefore they see all the communication and then can use that information for whatever purposes it is.

Another thing they could do is they could attack the integrity. Since the information is going through this adversary, they could either change it on the way to the server or on the way back to the client. And so we have an integrity issue, because things could get changed.

The other thing is it could possibly be an availability issue, that this adversary could choose to cut off any communication to the server whenever they wanted. Maybe they are responding directly back to the client instead, if that's what they choose to do. Or they could be just delaying the message, so it gets to the adversary, the adversary holds on to it for a little time and then sends it to the server.

So what has happened is that this adversary has complete control over whether those packets get forwarded as is, whether they get changed, or whether they get delayed, or stop it from happening altogether.

Adversary in the Middle in MITRE ATT&CK

Here I'm on the MITRE ATT&CK site. It gives us some perspective of some of the things that we can do when it comes to the adversary in the middle. It's under actually a couple different tactics: under credential access we've got adversary in the middle, and also collection we've got adversary in the middle.

If we were to open up these techniques here of adversary in the middle, we see that there's sub-techniques to it. So for instance, ARP cache poisoning - ARP cache poisoning is a sub-technique to adversary in the middle. DHCP spoofing, same thing. An evil twin, it's a type of adversary in the middle. All of which we'll have lessons on.

Let's go ahead and click on this adversary in the middle and it gives us some more perspective on it. An adversary attempts to position themselves between two or more network devices using adversary-in-the-middle techniques to support the following behavior, such as network sniffing, transmitted data manipulation, or replay attacks.

So here's the attack card on that. This is the adversary in the middle, and it just means that the adversary is sitting in the middle of the communication, able to carry out all sorts of attacks.

Read the full transcript Show less

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →