Conducting Man-in-the-Middle Attack Simulation

Conducting Man-in-the-Middle Attack Simulation

When to Use

• Testing whether applications properly validate TLS certificates and enforce encrypted communications
• Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders
• Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented
• Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks
• Training incident response teams to identify and respond to MITM attack indicators

Do not use on production networks without explicit written authorization and a rollback plan, against systems you do not own or have permission to test, or for intercepting communications of uninvolved third parties.

Prerequisites

• Written authorization specifying in-scope targets and approved MITM techniques
• Bettercap 2.x, Ettercap, and mitmproxy installed on the attacker machine
• Layer 2 access to the same network segment as target hosts
• Custom CA certificate for TLS interception testing (generated specifically for the engagement)
• Wireshark or tshark for capturing and verifying intercepted traffic
• Isolated lab environment or approved production test window with rollback procedures

Workflow

Step 1: Set Up the Attack Environment

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Disable ICMP redirects
sudo sysctl -w net.ipv4.conf.all.send_redirects=0

# Generate a CA certificate for TLS interception
openssl genrsa -out mitm-ca.key 4096
openssl req -new -x509 -days 30 -key mitm-ca.key -out mitm-ca.crt \
  -subj "/CN=MITM Test CA/O=Security Assessment/C=US"

# Discover hosts on the target network
sudo bettercap -iface eth0 -eval "net.probe on; sleep 10; net.show; quit"