Security Operations · Foundational

On-Path Attack

An attack in which the adversary positions themselves between two communicating parties to intercept or alter traffic.

Definition

Formerly called man-in-the-middle, on-path attacks are achieved via ARP poisoning, rogue access points, DNS spoofing, malicious proxies or compromised routers. The attacker can eavesdrop, modify data or hijack sessions. Strong encryption with certificate validation, mutual authentication and HSTS mitigate it.

Related terms