Man-in-the-Middle Attacks: Intercepting Network Communications

In our previous articles, we explored network discovery and wireless security. Today, we'll dive into one of the most powerful attack vectors in ethical hacking: Man-in-the-Middle (MITM) attacks. These attacks allow us to intercept and potentially manipulate communications between two devices.

MITM attacks are particularly dangerous because they can compromise the confidentiality and integrity of network communications, allowing attackers to eavesdrop on sensitive data, inject malicious content, or impersonate legitimate services.

Understanding Man-in-the-Middle Attacks

A Man-in-the-Middle attack occurs when an attacker secretly intercepts and relays communications between two parties who believe they are directly communicating with each other. The attacker can:

• Eavesdrop on sensitive information (passwords, personal data)
• Modify communications in transit
• Impersonate either party in the communication
• Inject malicious content into legitimate communications

ARP Spoofing: The Foundation of MITM Attacks

ARP (Address Resolution Protocol)A protocol used to map IP addresses to MAC addresses on a local network is the mechanism that allows devices on a local network to find each other's MAC addresses. This protocol has a fundamental security flaw: it's stateless and doesn't verify the authenticity of ARP responses.

How ARP Works

When a device wants to communicate with another device on the same network:

1. It broadcasts an ARP request: "Who has IP address X.X.X.X?"
2. The device with that IP responds: "I have that IP! My MAC address is XX:XX:XX:XX:XX:XX"
3. The requesting device stores this mapping in its ARP cache
4. All future communications to that IP are sent to the MAC address in the ARP cache

Viewing ARP Cache

We can examine the current ARP cache to see IP-to-MAC mappings:

This shows the router's IP (192.168.1.1) and its corresponding MAC address.

Exploiting ARP: The Spoofing Attack

ARP spoofing works by sending forged ARP responses to both the target device and the router:

• We tell the target: "I am the router! Send all your traffic to my MAC address"
• We tell the router: "I am the target! Send all responses to my MAC address"

This creates a situation where all communications between the target and router flow through our machine.

Step-by-Step ARP Spoofing Attack

Step 1: Manual ARP Spoofing with arpspoof

We'll use the arpspoof tool to perform the attack:

After running these commands, the target's ARP cache changes:

The target now believes the router's MAC address has changed to the attacker's MAC address.

Step 2: Enable IP Forwarding

By default, our Kali machine won't forward packets. We need to enable IP forwarding so traffic can flow between the target and router:

Now the target can access the internet normally, but all their traffic flows through our machine!

Using Bettercap for Advanced MITM Attacks

Bettercap is a powerful, modular framework for MITM attacks that provides many advanced features beyond basic ARP spoofing.

Initial Setup and Network Discovery

We can view all discovered devices:

Configuring and Starting ARP Spoofing

Bettercap provides comprehensive ARP spoofing capabilities:

Capturing and Analyzing Network Traffic

Network Sniffing with Bettercap

Once we've established the MITM position, we can start capturing network traffic:

Bettercap will now display all intercepted HTTP traffic:

In this example, we successfully captured login credentials sent over HTTP.

Using Caplets for Automated Attacks

Bettercap allows us to create "caplets" - script files that automate complex attack sequences. Create a file called spoof.cap:

Run the caplet:

The attack is now running automatically with all configured parameters.

DNS Spoofing: Redirecting Traffic

DNS spoofing allows us to redirect domain name resolutions to IP addresses we control, enabling phishing attacks and content injection.

Setting Up DNS Spoofing

First, ensure our web server is running:

Configure DNS spoofing in Bettercap:

Now when the target visits example-website.tech, they'll be redirected to our machine (192.168.222.140) instead of the real website.

Advanced DNS Spoofing with Multiple Domains

We can target multiple domains by modifying the hstshijack caplet:

Code Injection: Manipulating Web Content

Once we're intercepting traffic, we can inject malicious JavaScript code into web pages the target visits.

Creating JavaScript Payloads

Create a JavaScript file (e.g., keylogger.js) with your malicious code:

Configuring Code Injection

Modify the hstshijack caplet to include our payload:

Run the enhanced attack:

Now our JavaScript code will be injected into every page the target visits.

Packet Analysis with Wireshark

Wireshark is a powerful network protocol analyzer that allows detailed inspection of captured packets.

Using Wireshark for Traffic Analysis

1. Open Wireshark and select your network interface
2. Start capturing packets
3. Use filters to focus on specific traffic (e.g., http, tcp.port == 80)
4. Analyze individual packets to extract sensitive information

Protection Against MITM Attacks

Understanding these attacks helps us implement effective defenses:

Legal and Ethical Considerations

Conclusion

Man-in-the-Middle attacks represent one of the most significant threats to network security. By understanding how ARP spoofing, DNS spoofing, and code injection work, security professionals can better defend against these attacks.

The techniques demonstrated in this article—from basic ARP spoofing to advanced Bettercap caplets—show the sophistication of modern MITM attacks. However, they also highlight the importance of proper network security measures like encryption, monitoring, and segmentation.

By mastering both the offensive techniques and defensive strategies, security professionals can build more resilient networks and better protect against real-world attacks.