A man-in-the-middle attack places an attacker between two communicating parties so traffic flows through them, letting them observe or alter it. On local networks, ARP spoofing is a classic way to achieve this position; SSL stripping is a technique to downgrade protection once positioned. Understanding these concepts matters chiefly for defense: modern protections like pervasive encryption and HSTS largely neutralize them, and knowing how the attacks work is what lets a tester verify those protections are actually in place.
Analogy🏏Cricket
🏏 Think of it like cricket: Active recon is the captain walking out to inspect the pitch on match morning, pressing the surface, checking the grass, watching how the ball behaves in the nets. Unlike studying old footage from afar, this inspection happens on the ground itself and is visible to everyone. Just as that inspection reveals conditions no video could, active scanning reveals live services no public record shows, and just as it happens with the ground's permission, scanning happens only within authorized scope.