I understand that if you are typing in sensitive info on a non SSL site, you can view that info in plain text, or at best hashed when those packets are captured.
In fact, I've gone as far as to brute force the md5 hash of a password I entered into a non encrypted page and was able to retrieve the string of that hash. So, I can understand most of that.
What I cannot find information on, is how do hackers gain access to these packets in the first place? I know that in an insecure wifi, it behaves like a hub and so with the right tools, you may capture ALL packets in range. But on a wired network, it seems the attacker would have to have control over the router, put a bump on the line, or perform arp poisoning, dns exploits etc... But is there a go-to method? How would a hacker intercept your data from outside of your lan?
Can someone explain the most common methodologies? thanks