Common Attacks: MITM, Replay, and Downgrade
Medium Priority29 min readUpdated August 14, 2026
TLS is designed for a hostile network. It assumes that an attacker may observe packets, delay them, drop them, reorder them, modify them, or inject new traffic.
Modern TLS can resist those capabilities, but only within the security boundary that the system actually establishes. Authentication must be enforced, weak fallback paths must be closed, and applications must not assume that transport protection gives every request one-time semantics.
Three attack classes expose these boundaries:
- A man-in-the-middle (MITM) attack places an active endpoint between two parties and attempts to impersonate each side to the other.
- A replay attack sends previously valid data again so that the receiver accepts an action more than once or at the wrong time.
- A downgrade attack interferes with negotiation or connection setup to force weaker security than the endpoints would otherwise use.
These attacks can overlap. A MITM position gives an attacker the network control needed to attempt a downgrade, while a successful downgrade may expose data that can later be replayed.