MITM: tools for intercepting and modifying traffic?

Question

I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request.

For example:
When I receive a request on port 25, I want to be able to intercept all the requests, modify it (e.g. stripping out STARTTLS) and send it to it's destination on port 25.

Answer 1

I would recommend taking a look at netsed, there is some information on it at http://securitytube-tools.net/index.php?title=NetSed

It allows you to modify contents of traffic going through your machine in realtime through sed style regular expressions.

If you can't get your machine into the flow of traffic through wiring, your could set your machine as the gateway and set its route up to send traffic to the proper location.

If this doesn't work for you could always use something like ettercap, or another tool that would allow you to do some ARP poisoning, effectively making your machine the gateway.

Scapy is very nice as well, as mentioned by servarevitas3.

Answer 2

Look into SSLStrip. It strips off the HTTPS request headers during MITM attack. If web server uses HSTS and browser supports it, then this tool won't be able to strip HTTPS. The code may give you some ideas.

Another option is scapy, which is a packet manipulation program that may be able to do what you are asking.

Answer 3

Ettercap is pretty good one for Linux.

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.

http://ettercap.sourceforge.net/

It's a pretty well known tool, so doing a simple ettercap tutorial google search gives plenty of entry level examples, which will walk you through performing ARP poisoning, intercepting traffic, and then create filters to modify data as it goes through your computer.