conducting-man-in-the-middle-attack-simulation

name	conducting-man-in-the-middle-attack-simulation
description	Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities. . Use when working with conducting man in the middle attack simulation.
domain	cybersecurity
tags	["network-security","mitm","bettercap","ettercap","mitmproxy"]
subdomain	network-security
version	1.0
author	oyi77
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Conducting Man In The Middle Attack Simulation

Overview

Cybersecurity skill for conducting man in the middle attack simulation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "conducting man in the middle attack simulation"

• "Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in "

• Testing whether applications properly validate TLS certificates and enforce encrypted communications

• Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders

• Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented

• Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks

• Training incident response teams to identify and respond to MITM attack indicators

Do not use on production networks without explicit written authorization and a rollback plan, against systems you do not own or have permission to test, or for intercepting communications of uninvolved third parties.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Written authorization specifying in-scope targets and approved MITM techniques
• Bettercap 2.x, Ettercap, and mitmproxy installed on the attacker machine
• Layer 2 access to the same network segment as target hosts
• Custom CA certificate for TLS interception testing (generated specifically for the engagement)
• Wireshark or tshark for capturing and verifying intercepted traffic
• Isolated lab environment or approved production test window with rollback procedures

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}