For educational purposes, I want to conduct a demo for a Man In The Middle attack. The attack scenario is:

1) The client request aaa.com 2) The MITM changes the client request to bbb.com 3) The client get response for bbb.com

Notes: 1) bbb.com is not owned by the attacker. It is just another website

2) I know that with normal user can identify and detect that the new website is bbb.com if the user can see different URL or different interface. But this is off topic. I still need to do this scenario.

How to coduct this attack? What are the tools? Please, I do not need general statements like (MITM redirect traffic, DNS spoofing, etc.). I need a guide on how to implement it including the required tools or SW.


If you have windows operating system you can use "cain & able" in http://www.oxid.it/cain.html you can do dns spoof with this tool and no need for any URL redirection in your scenario i cant help you right now with this tool because i don't have windows os. but if you use gnu/linux operating system you can use many tools like ettercap. actually ettercap is one of the bests tools you can find out there. install and use ettercap with following instructions in debian based gnu/linux:

apt-get install ettercap-common ettercap-graphical

after installation get completed. edit dns-spoof plugin for your scenario. by editing this file

nano /etc/ettercap/etter.dns

run GUI interface with:

ettercap -G

if you have single network interface use unified sniffing ctrl+u and if you have two interface connected to same LAN press ctrl+b for bridged sniffing and get better performance. after that select your interface for example eth0.

now you must select your targets, you can do that manually by pressing ctrl+shift+t or select them from host list, for using host list you must first scan your network by pressing ctrl+s after that you will see all alive devices on host list by pressing ctrl+h, now add your target by selecting them for target1 or target2 if you don't select any target ettercap will arp spoof any device to any device.

in this step you can select dns_spoof plugin by pressing ctrl+p

now use ctrl+shift+w for start sniffing

you must select MITM attack type. find Mitm button in tools bar, you can use arp spoof in most cases, and select sniff remote connection check box, spoofing and sniffing will start after that.

if you want to know more about MITM types use following link



The hard way of doing this is by implementing a PROXy. You may create just a socket to which you will connect and then create a socket to the destination server. You analyze the traffic of HTTP header and if it requests aaa.html you change request to the bbb.html or different domain.

The more sophisticated way of doing that would be for example using libpcap. You just listen on the interfaces and pass them or redirect them. The same thing you may accomplish with the firewall. All depends on the scenario you have.

But in general you want to have something like:

      --------        ----------------------------------          --------
-----| client |----> | your interface/process/something |------->|server|
      --------        ----------------------------------         -------

Please remember that you may get encrypted traffic. In that scenario, you need somehow to generate a trusted cert. In most cases, you have to somehow install your own CA in the client.

If you are controlling DNS server you also may just return different records to the different clients.

Those this answare your question?

Not the answer you're looking for? Browse other questions tagged or ask your own question.