0

i was just testing something about MITM i know MITM well attack is just like: gateway = 192.168.1.1 victim = 192.168.1.13 attacker = 192.168.1.6 performing mitm and enable linux kernel ip_forwarding and i see outgoing traffic for victim 192.168.1.13 i just wanted to know how to capture incoming traffic for 192.168.1.13 is that is possible ? i see in wireshark a DNS request to 8.8.8.8 from victim but i didnt see the response traffic from 8.8.8.8 to victim probably because forwarding packets contains IP src=192.168.1.13 so real gateway at 192.168.1.1 send incoming traffic for 192.168.1.13 directly how to fix this could be fixed by sending ARP saying 192.168.1.13 is at attacker_mac ?

another question:

if now 192.168.1.1 at attacker mac and 192.168.1.13 at attacker mac and attacker has ip_fowarding isnt it causing a conflict as also gateway will say that 192.168.1.1 at his gateway and also vicitm machine will say 192.168.1.13 at its mac so vicitm outgoing traffic will go to both attacker and gateway ? and attacker will forward the same traffic that already had been sent also the sameway in incoming traffic !!

,regards

  • It's really hard to read your "another question". Please consider using puncuation and short sentences, making clear what your actual question is. As of now, I can only guess what you want to know. – GxTruth Jul 9 '18 at 14:05
2

In order to truly man in the middle them you'll need to arpspoof them. By arp poisoning the router and your target, you can make them both forward traffic to you instead of each other. Then you forward it on, after inspecting it or modifying it.

assuming you're on kali or parrot

echo 1 > /proc/sys/net/ipv4/ip_forward

arpspoof -i <your interface> -t <router ip> -r <target ip>

arpspoof -i <your interface> -t <target ip> -r <router ip>

at this point you can either start wireshark, mitmf, etc etc etc

References

What is arp spoofing

Tutorial on MiTM With kali

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.