When I search for MITM in the google most of the results say an unauthorized person positions himself in a conversation between two authentic users for malicious reasons, and there are several types in MITM.

But what I couldn't understand is, do these two authentic users have to be in a local network (LAN) or they can be anywhere on the internet for someone to perform MITM attack?.
Which types are limited to LAN and which MITM types can be performed on the users across the Internet.

  • It doesn't matter whether it is LAN or WAN, electronic or paper , as long as the peer to peer communication between two party intercepted and manipulated by a third party, it is a MiTM.
    – mootmoot
    Mar 22 '19 at 15:24

Technically, they can be anywhere in the network. But a lot depends on the attacker, their capabilities, and their goals.

Some of the easiest Person In The Middle (PITM) attacks can be done with a fake WiFi hotspot, such as at a coffee shop or airport. These usually require physical proximity to the victim. They are good if an attacker wants to target a specific victim, and doesn’t have the resources for a more advanced attack. They are also effective at pulling in a few random victims. But they generally don’t scale well, and they expose the attackers to the risk of getting caught.

An attack can be launched against a single computer or browser by reconfiguring it to use the attacker’s proxy. This can be persistent, surviving reboots, VPNs, and relocated portable devices. But it requires some kind of access to the victim’s device to change its settings.

An attack on a server’s infrastructure can PITM many victims indiscriminately. These can harvest credentials or credit card data. Lately the technique has evolved into replacing JavaScript libraries to make copies of payment data that pass through them.

Attackers have been known to subvert Tor exit nodes to intercept traffic. It is claimed that law enforcement agencies have used this technique to target criminals on the dark web.

The most sophisticated attacks that have been published have come from national cyberwarfare organizations. These use attacks such as network-infrastructure-located servers that hijack the SYN/ACK TCP handshake with a more rapid reply than the legitimate server (google for FOXACID for a better description.)


It is like a conman trying to impersonate an authorized person. For example, in public wifi where the attacker is trying to impersonate the gateway and then read all the traffic. Not only that, the attacker can also inject packets depending on the wifi adapter.

Try first on LAN so you know what it really likes to do MITM. Try using wireshark for now.

  • This doesn't answer the question about where the mitm is. All you talk about is local network, but can it happen on the wider Internet, too?
    – schroeder
    Mar 22 '19 at 14:58
  • yes off course in many possible ways, but just to for him to get the picture I think it is better to start on LAN Mar 22 '19 at 15:06
  • The OP is not asking how to implement, but asking what the different types of implementation are.
    – schroeder
    Mar 22 '19 at 16:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.