Man-in-the-Middle Attack

Ghost the wire. Read, modify, inject. They will never know you were there. Intercept and manipulate traffic in real-time.

IntermediatePhase 1: Network AttacksInteractive Dual Perspective

What is Man-in-the-Middle Attack?

A Man-in-the-Middle (MITM) attack occurs when an attacker secretly intercepts and relays communication between two parties who believe they're communicating directly. The attacker can eavesdrop, modify, or inject data without either party knowing.

Attack Types:

•ARP Spoofing: Poison ARP cache to redirect traffic through attacker
•DNS Spoofing: Return fake DNS responses to redirect to malicious sites
•SSL Stripping: Downgrade HTTPS to HTTP, intercept plaintext
•Rogue WiFi AP: Create fake access point to capture all traffic

Classic MITM Scenario

👤 Victim→ Thinks talking to →🌐 Bank Website

↕ ACTUALLY ↕

👤 Victim↓ sends credentials ↓🦹 ATTACKER (intercepts)↓ forwards request ↓🌐 Real Bank Website

Attacker sees login credentials, session cookies, personal data - all while the victim thinks they're secure!

MITM Attack Tools

Attack Frameworks:

• Bettercap: Modern MITM framework (ARP, DNS, SSL)
• Ettercap: Comprehensive network sniffer and MITM suite
• mitmproxy: Interactive HTTPS proxy for traffic inspection

Specific Techniques:

• SSLstrip: Downgrade HTTPS to HTTP
• dnsspoof: Forge DNS responses
• arpspoof: Poison ARP tables

Defense Against MITM

Use HTTPS Everywhere: Enforce encrypted connections

Certificate Pinning: Apps validate specific SSL certificates

VPN: Encrypt all traffic through trusted tunnel

HSTS: HTTP Strict Transport Security forces HTTPS

Public WiFi Caution: Never login to sensitive sites on untrusted networks

Monitor ARP Tables: Detect ARP poisoning attempts

Signs You're Under MITM Attack

Browser shows SSL certificate warnings
Unexpected HTTP instead of HTTPS on secure sites
Sudden slow network performance
Strange redirects or unexpected login pages
Duplicate gateway MAC addresses in arp -a

MITM Attack Simulator

Intercept, Decrypt, and Modify Secure Traffic

NETWORK FLOW

Valid Certificate

Victim

MITM Proxy

Bank Server

mitmproxy - transparent

Kali Linux Rolling (kernel 6.5.0-kali3-amd64)

mitmproxy tool ready.

MITM Workflow:

1. Start Proxy & Forge Cert

2. Intercept & Decrypt Traffic

3. Modify Payload & Re-encrypt