I'm trying to learn some attack methods by myself and I have hit a wall where I can't find any information. I have successfully performed an ARP MiTM between 2 systems and I am able to sniff the traffic using tcpdump, driftnet, etc.

My question is: How can I actively modify the packets by injecting HTML code into the response (non SSL, of course)

  • I prefer Kali Linux, a few Alfa WiFi external-USB radios, and to `apt-get install mana-toolkit mitmf'. These last two tools provide a lot more than the MITM-focused tools I've seen in 2014 or earlier – atdre Mar 10 '15 at 18:13

Ettercap has options to inject into an html stream. You could also use proxies.


Specifically using Ettercap, you want to implement filters. You can write your own filters to identify specific types of traffic and replace it with your own data. Here is a SANS reading room paper that goes into a lot of detail about Ettercap, or you can just Google for "ettercap filters" and read up on it more.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.