In which type of attack does the attacker insert their machine between two hosts that are communicating with each other?

LDAP injection is a web application vulnerability that exploits improper input validation to inject malicious queries into an application's LDAP statements, typically used for authentication bypass or data extraction, not inserting a machine between hosts.

Cross-site scripting (XSS) is a type of injection attack where malicious scripts are injected into otherwise trusted websites, primarily impacting end-user browsers, not involving an attacker's machine directly between communicating hosts.

A man-in-the-middle (MITM) attack is a form of eavesdropping where the attacker intercepts the communication between two systems without their knowledge, often by impersonating one or both parties. The attacker's machine is logically or physically positioned to intercept, read, and potentially modify traffic between the two communicating hosts.

An insecure API refers to vulnerabilities in an application programming interface that can be exploited, but it describes a vulnerability type, not a specific attack method where an attacker's machine is placed between two communicating hosts.