NOTE
1.11 Man-in-the-Middle Attack
Definition and mechanics of man-in-the-middle attacks and certificate validation.
This is a historical learning note and may contain outdated or incomplete understanding.
1. What Is a Man-in-the-Middle Attack
A man-in-the-middle attack places an attacker between two communicating parties. The attacker may relay, inspect, or modify traffic while each endpoint believes it is communicating directly with the other.
2. How It Works
- Local traffic may first be redirected or intercepted, for example through DNS or network manipulation.
- The attacker attempts to present its own certificate or otherwise impersonate the target to the client.
- The attacker establishes one protected connection with the client and another with the legitimate server.
- It can then decrypt data on one side, inspect or alter it, and encrypt it again for the other side.
This succeeds against HTTPS only when certificate authentication is bypassed, misconfigured, or the attacker controls a certificate trusted by the client. A correctly configured HTTPS client validates the certificate chain and hostname, preventing an ordinary attacker from silently substituting its own certificate.
