I'm trying to learn some attack methods by myself and I have hit a wall where I can't find any information. I have successfully performed an ARP MiTM between 2 systems and I am able to sniff the traffic using tcpdump, driftnet, etc.

My question is: How can I actively modify the packets by injecting HTML code into the response (non SSL, of course)

  • I prefer Kali Linux, a few Alfa WiFi external-USB radios, and to `apt-get install mana-toolkit mitmf'. These last two tools provide a lot more than the MITM-focused tools I've seen in 2014 or earlier
    – atdre
    Commented Mar 10, 2015 at 18:13

2 Answers 2


Ettercap has options to inject into an html stream. You could also use proxies.


Specifically using Ettercap, you want to implement filters. You can write your own filters to identify specific types of traffic and replace it with your own data. Here is a SANS reading room paper that goes into a lot of detail about Ettercap, or you can just Google for "ettercap filters" and read up on it more.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .