What is an on-path attack?
An on-path attack places an attacker's device or code in the route between two parties, such as a laptop and its default gateway or a browser and a bank's web server. Each side believes it is talking straight to the other, but every packet passes through the attacker, who forwards it so nothing seems broken. From that position the attacker can watch the conversation, collect passwords and session cookies, alter data in flight or insert messages of their own.
CompTIA uses the name on-path attack. Older books and tools call it a man-in-the-middle (MITM) attack, and some vendors say machine-in-the-middle. A related variant, man-in-the-browser, is malware or a malicious extension that alters transactions inside the browser after decryption.
How attackers get into the path
Most methods abuse a protocol that believes whatever it is told:
- ARP poisoning: forged ARP replies map the gateway's IP to the attacker's MAC in the victim's cache, and often do the reverse in the gateway's cache.
- Rogue DHCP server: answers DHCP requests first and hands out the attacker's address as gateway or DNS server.
- Evil twin: an access point broadcasting a trusted SSID, so devices join the attacker's wireless network instead of the real one.
- DNS spoofing: forged DNS answers or a tampered hosts file send the victim to the attacker's server for a legitimate domain.
- SSL stripping: the attacker keeps an HTTPS session with the server but speaks plain HTTP to the victim, a form of downgrade attack.
ARP poisoning and rogue DHCP work only inside one broadcast domain, so they imply an attacker or infected host on the same LAN or Wi-Fi. An evil twin needs only radio range, and DNS manipulation can happen far from the victim.
What an on-path attack looks like
A guest on hotel Wi-Fi gets a certificate warning from a webmail site that always loads cleanly and clicks Continue. That click completes the attack: the attacker presented its own certificate, the browser could not validate it, and the user trusted it anyway. On an office LAN the evidence is often in the ARP cache. Running arp -a on a slow workstation shows the gateway, 192.168.10.1, and a desktop, 192.168.10.73, with the same physical address. When the gateway's IP maps to another host's MAC, that host is poisoning the cache.
Other clues include rising latency, an unfamiliar certificate issuer and an SSH host key warning for a server nobody rebuilt.
How to defend against on-path attacks
- Encrypt and authenticate: TLS 1.2 or 1.3 with certificate validation, SSH with verified host keys, and mutual TLS between services. The attacker may still sit in the path, but sees only ciphertext.
- Use HSTS so browsers refuse plain HTTP for a site, which defeats SSL stripping after the first visit, or from the start for preloaded domains.
- Enable switch protections: DHCP snooping accepts DHCP offers only from trusted ports, and Dynamic ARP Inspection drops ARP replies that do not match the snooping table.
- Use 802.1X with WPA2-Enterprise or WPA3-Enterprise and set clients to validate the authentication server's certificate, so they will not finish a login to an evil twin.
- Use DNSSEC validation or encrypted DNS, and a VPN on networks you do not control.
On-path attack vs. related attacks
- Sniffing is passive capture. An on-path attacker can sniff, but can also modify and inject traffic.
- A replay attack resends a captured message, such as a token, later; an on-path attacker works on the live session.
- Session hijacking takes over an authenticated session, often with a stolen cookie. Being on-path is one way to get the cookie; cross-site scripting and malware are others.
- Adversary-in-the-middle phishing proxies a real sign-in page so the attacker captures the session cookie after the user completes MFA. It is the same idea delivered by a phishing link instead of a network position.
On-path attack on the CompTIA Security+ exam
On-path attacks are among the network attacks in SY0-801 objective 2.5, where a scenario gives you the indicators and you name the activity. Wording that points here: an attacker intercepting or modifying traffic between two hosts, a certificate warning on a normally trusted site, or one MAC address answering for two IP addresses. Some questions ask for the overall attack and others for the method that put the attacker in position (ARP poisoning, rogue DHCP, evil twin, DNS spoofing), so check which one is asked. Typical distractors are a replay attack, which resends captured data later; MAC flooding, which overloads a switch's address table; and a rogue access point, which is an unapproved AP plugged into the company network rather than an imitation of its SSID. On-path attacks also appear in A+ Core 2 (220-1202) objective 2.5.