I want to carry out a MITM attack to modify traffic, so I can strip out/modify things in the request.

For example:
When I receive a request on port 25, I want to be able to intercept all the requests, modify it (e.g. stripping out STARTTLS) and send it to it's destination on port 25.

  • Do you want to program the filtering part yourself, or are you looking for a tool with builtin filtering rules? – curiousguy Jun 27 '12 at 22:02

I would recommend taking a look at netsed, there is some information on it at http://securitytube-tools.net/index.php?title=NetSed

It allows you to modify contents of traffic going through your machine in realtime through sed style regular expressions.

If you can't get your machine into the flow of traffic through wiring, your could set your machine as the gateway and set its route up to send traffic to the proper location.

If this doesn't work for you could always use something like ettercap, or another tool that would allow you to do some ARP poisoning, effectively making your machine the gateway.

Scapy is very nice as well, as mentioned by servarevitas3.

|improve this answer|||||

Look into SSLStrip. It strips off the HTTPS request headers during MITM attack. If web server uses HSTS and browser supports it, then this tool won't be able to strip HTTPS. The code may give you some ideas.

Another option is scapy, which is a packet manipulation program that may be able to do what you are asking.

|improve this answer|||||
  • 1
    "It does not work with browsers that use HSTS" sslstrip could be used to avoid the HSTS in the first place! – curiousguy Jun 27 '12 at 22:01
  • 1
    @curiousguy Google Chrome actually hard-codes a list of HSTS sites, so it wouldn't work there with most common sites. Stripping the HSTS header would also only work if it was the first visit to the site. I had thought a while ago about adding that functionality (the source is on github). – servarevitas3 Jun 28 '12 at 13:08

Ettercap is pretty good one for Linux.

Ettercap is a comprehensive suite for man in the middle attacks. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols and includes many features for network and host analysis.


It's a pretty well known tool, so doing a simple ettercap tutorial google search gives plenty of entry level examples, which will walk you through performing ARP poisoning, intercepting traffic, and then create filters to modify data as it goes through your computer.

|improve this answer|||||
  • While this may technically answer part of the question, would you care to flesh it out with some more details on the why, and possibly how? – Scott Pack Jul 6 '12 at 13:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.