MitM means the attacker positions themselves between two communicating parties — relaying, eavesdropping on, and optionally modifying their traffic, while both sides believe they're talking directly to each other.

* Mallory sits between Alice and Bob, relaying their traffic. — Miraceti, CC BY-SA 3.0, via Wikimedia Commons. *

The structure:

Victim ←──── MitM ────→ Real server
       (sees attacker)  (sees attacker)
       
Both sides think they're talking to the other directly.

What the attacker can do:

The attacker's #1 problem — being invisible:

A successful MitM must forward traffic transparently so neither side notices delays or errors. If you simply intercept and drop, the connection breaks → user notices → switches networks. The art is being transparent while sniffing.

MitM applies at every layer:

The fundamental defense:

Mutual authentication — both sides verify each other cryptographically:

• TLS: server presents a certificate signed by a trusted CA → client verifies
• SSH: client checks server's known fingerprint
• Certificate pinning: app rejects all certs except a hardcoded one
• Mutual TLS (mTLS): both sides present certificates

Tip: "MitM" is older terminology. Modern alternatives: "Adversary-in-the-Middle (AitM)" or "On-Path Attacker." All describe the same thing.

Go deeper:

• Man-in-the-middle attack (Wikipedia) — catalogs the attack variants (HTTPS spoofing, SSL strip, ARP/DNS spoofing) and the real-world cases (DigiNotar, Comcast injection).