Man in the Middle how to read incoming traffic for victims on the network

Question

i was just testing something about MITM i know MITM well attack is just like: gateway = 192.168.1.1 victim = 192.168.1.13 attacker = 192.168.1.6 performing mitm and enable linux kernel ip_forwarding and i see outgoing traffic for victim 192.168.1.13 i just wanted to know how to capture incoming traffic for 192.168.1.13 is that is possible ? i see in wireshark a DNS request to 8.8.8.8 from victim but i didnt see the response traffic from 8.8.8.8 to victim probably because forwarding packets contains IP src=192.168.1.13 so real gateway at 192.168.1.1 send incoming traffic for 192.168.1.13 directly how to fix this could be fixed by sending ARP saying 192.168.1.13 is at attacker_mac ?

another question:

if now 192.168.1.1 at attacker mac and 192.168.1.13 at attacker mac and attacker has ip_fowarding isnt it causing a conflict as also gateway will say that 192.168.1.1 at his gateway and also vicitm machine will say 192.168.1.13 at its mac so vicitm outgoing traffic will go to both attacker and gateway ? and attacker will forward the same traffic that already had been sent also the sameway in incoming traffic !!

,regards

Answer 1

In order to truly man in the middle them you'll need to arpspoof them. By arp poisoning the router and your target, you can make them both forward traffic to you instead of each other. Then you forward it on, after inspecting it or modifying it.

assuming you're on kali or parrot

echo 1 > /proc/sys/net/ipv4/ip_forward

arpspoof -i <your interface> -t <router ip> -r <target ip>

arpspoof -i <your interface> -t <target ip> -r <router ip>

at this point you can either start wireshark, mitmf, etc etc etc

References

What is arp spoofing

Tutorial on MiTM With kali