What term describes the process of sniffing traffic between a user and server, then redirecting the traffic to the attacker's machine, where malicious traffic can be forwarded to the user or server?

What term describes the process of sniffing traffic between a user and server, then redirecting the traffic to the attacker's machine, where malicious traffic can be forwarded to the user or server?

• A. DNS hijacking
• B. Man-in-the-middle
• C. ARP poisoning
• D. Packet sniffing

Answer: (B)

Intercepting and relaying traffic between two endpoints so the attacker sits in the middle is a man-in-the-middle attack. In this scenario, the attacker first sniffs the communication between the user and the server to observe the data. By redirecting that traffic to the attacker's machine, the attacker can forward it on to the intended recipient, making the flow appear normal while still allowing eavesdropping, tampering, or credential theft. This setup specifically describes the attacker placing themselves between the two parties and handling the traffic as it moves, which is the defining behavior of a MITM attack. This differs from DNS hijacking, which changes domain name resolutions to point to a malicious server, and from packet sniffing, which is only about listening to traffic without relaying it. ARP poisoning is a technique that can enable a MITM on a local network by corrupting the address-resolution process, but the core concept described is the attacker positioning themselves in the communication path to intercept and potentially modify traffic.

Intercepting and relaying traffic between two endpoints so the attacker sits in the middle is a man-in-the-middle attack. In this scenario, the attacker first sniffs the communication between the user and the server to observe the data. By redirecting that traffic to the attacker's machine, the attacker can forward it on to the intended recipient, making the flow appear normal while still allowing eavesdropping, tampering, or credential theft. This setup specifically describes the attacker placing themselves between the two parties and handling the traffic as it moves, which is the defining behavior of a MITM attack.

This differs from DNS hijacking, which changes domain name resolutions to point to a malicious server, and from packet sniffing, which is only about listening to traffic without relaying it. ARP poisoning is a technique that can enable a MITM on a local network by corrupting the address-resolution process, but the core concept described is the attacker positioning themselves in the communication path to intercept and potentially modify traffic.