Editing Man-in-the-middle attack (section)

==Types of MITM==
There are several attack types that can fall into the category of MITM. The most notable are:
#[[HTTPS]] Spoofing: The attacker tricks the victim into believing their connection is secure by substituting a fake SSL/TLS certificate.
#[[Transport Layer Security|SSL/TLS]] Stripping: Downgrades HTTPS traffic to HTTP, intercepting and reading unencrypted data.
#[[Address Resolution Protocol|ARP]] [[ARP spoofing|Spoofing]]: Sends fake ARP messages to associate the attacker’s MAC address with a target IP, intercepting local network traffic.
#[[Domain Name System|DNS]] [[DNS spoofing|Spoofing]]/Poisoning: Redirects DNS queries to malicious servers, leading victims to fake websites.
#Session Hijacking: Steals session [[HTTP cookie|cookies]] or tokens to impersonate a legitimate user in an active session.
#Man-in-the-Browser ([[Man-in-the-browser|MITB]]): Malware alters browser activity, intercepting or manipulating transactions in real-time.
#[[Wi-Fi]] MITM ([[Evil twin (wireless networks)|Evil Twin Attack]]): Creates a fake Wi-Fi hotspot to intercept communications from connected devices.
#[[Email]] Hijacking: Intercepts email exchanges to manipulate or steal sensitive information.
#[[Replay attack|Replay Attacks]]: Captures and retransmits valid data to repeat actions or disrupt communication.
#Fake [[Certificate authority|Certificate Authority]] (CA): Uses a fraudulent CA to sign fake certificates, tricking victims into trusting malicious connections.