Skip to content
Irregularpedia Logo Irregularpedia

Network MitM

Network MitM

Section titled “Network MitM”

Man-in-the-Middle attacks: the adversary controls the network path between you and the service you’re talking to. TLS defeats most of these — but plenty of attacks (cert pinning bypass on rooted devices, downgrade attacks, captive-portal abuse, IMSI catchers on cellular) still work in 2026.

Sub-vectors (planned)

Section titled “Sub-vectors (planned)”
  • Rogue WiFi / Evil twin — attacker stands up an AP with your home/office SSID, captures traffic from clients that auto-connect.
  • IMSI catcher / Stingray — fake cellular tower; downgrades to 2G; intercepts SMS and voice. Used at protests, near embassies, by law enforcement, and increasingly by criminal actors.
  • ARP poisoning — on a LAN you don’t trust (conference, hotel, coffee shop), adversary redirects your traffic through their machine.
  • Captive-portal abuse — fake captive portal harvesting credentials.
  • TLS downgrade / SSL stripping — increasingly mitigated by HSTS but still works against legacy HTTP origins.
Section titled “Related”