For training purposes, I need some pointers on the tools and tips to implement an active Man-In-The-Middle attack.
The attack scenario that I want to do is a toy example (which has countermeasures by server authentication) is the following:
1) The user request a.com
2) The MITM changes the user request to b.com
3) The user sees b.com in his agent (e.g., browser)
I looked in the web. There is ARPP spoofing, which seems will allow me to sniff on users requests but no manipulate.
What is the easiest way to manipulate the user's requested address through a MITM attacker who does not have access to the user's device, but only the communication channel?
As I said, this question is for learning. It is also worth nothing that this is detectable by modern client agents or browsers, and I do not intend to implement it in any ways other than lab learning environment.
mitmproxy
or maybebettercap
would be pretty quick for scripting this sort of thing up.