I think you got something fundamelntally wrong. A MitM attack is an attack whichs goal it is to redirect traffic over the attackers host. The attacker then acts as a proxy but he will not be able to install an additional certificate on your host without having root/administrative access to that host.
How to perform a MitM attack
MitM Attacks are mostly performed by abusing protocol weaknesses but its sometimes also possible due to logic fails "comitted" by the developer. There are several ways to carry out these attacks. I will only list the common ones on the LAN:
- Port-Stealing (Layer 2)
- MAC-Floogin (Layer 2)
- ARP-Spoofing (Layer 3)
- Rouge-DHCP-Server (Layer 7)
- WPAD-Redirection (Layer 7 - Based on nbns, LLMNR or mDNS spoofing)
When you are in posession of the PSK you can also passivly capture all the traffic an then decrypt all the traffic using
airdecap-ng which will be sucessful when you fit the folliwing requirements:
- WEP = Know the PSK it will use the PSk to encrypt the traffic
- WPA2 = Know the PSK and capture the 4-Way-Handshake. There will be a session specific key which can be obtained when you fit both requirements
This will only work on non enterprise networks that use a user unspecific PSK.
An attacker won't be able to get around SSL without access to the victims host. But there are ways to prevent the useage of SSL:
- SSLStrip - Will remove all https links from unencrypted webpages passed trough the MitM Host. The basic idea is that users use https only because they are redirected to https not because they type it in their browesers
- Deloreon - Will get you around HSTS by manipulating the system time using fake NTP responses.
- DNS-Spoofing and Application Proxy - Will like SSLStrip only work on connections that aren't already encrypted