After an attacker has successfully implemented a man-in-the-middle attack, they can sniff all the traffic being transmitted to and from the client. Most modern traffic is encrypted so the attacker needs to use a downgrade attack to make the client transmit traffic less securely. Once this is accomplished an attacker can sniff credentials and other important information.