Lesson 4 of 9

Man-in-the-Middle Attacks

Man-in-the-middle (MitM) attacks allow an attacker to secretly intercept and potentially modify communications between two parties who believe they are communicating directly. You will learn ARP poisoning, DNS spoofing, and SSL stripping techniques that make MitM attacks possible on local networks. Understanding these attacks is critical for designing defenses against them.

Learning Objectives — Deep Dive

Each objective below is broken down into plain English so you know exactly what you are learning, why it matters, and what you will be able to do when you are done. Mark each one complete as you work through the lesson.

0/4

In plain English

This is asking you to build a clear mental model of the concept — not just memorize a definition, but genuinely understand what it means, why it exists, and how it connects to everything else you are learning. When you can explain "how ARP poisoning enables man-in-the-middle attacks" in your own words to someone who has never heard of it, you have truly learned it.

Why this matters

Understanding how attacks actually work is what makes you effective at defending against them. You cannot build strong defenses if you do not understand what attackers are trying to do and how they do it. This knowledge is the core of offensive and defensive security alike.

Real-world analogy

Think of it like learning to drive. You do not need to understand how the engine works to drive safely, but knowing the basics helps you diagnose problems and avoid mistakes that could cause accidents. The same principle applies here — foundational knowledge prevents costly errors.

What you will be able to do

Apply this skill in a real lab environment, explain it clearly to a colleague or client, and use it as a building block for the more advanced techniques that come later in this course.

Beginner tip

Do not try to memorize everything at once. Read through the material once to get the big picture, then go back and work through the lab. The hands-on practice is what makes the concepts stick — passive reading alone will not get you there.

Man-in-the-Middle Attacks · Objective 1 of 4

VIDEO

Loading video…

Enable IP forwarding

On your Kali machine, run 'echo 1 > /proc/sys/net/ipv4/ip_forward' to enable IP forwarding at the kernel level. This is essential for a man-in-the-middle attack — without it, intercepted packets will be dropped instead of forwarded to their destination, causing the victim's connection to fail and alerting them to the attack. Verify the setting took effect by running 'cat /proc/sys/net/ipv4/ip_forward' and confirming it returns 1. Note that this setting resets to 0 on reboot; for persistence you would edit /etc/sysctl.conf, but for lab use the temporary setting is sufficient.

Start ARP poisoning

Open two terminal windows on Kali. In the first, run 'arpspoof -i eth0 -t <victim-ip> <gateway-ip>' to poison the victim's ARP cache, making it believe your Kali machine is the gateway. In the second terminal, run 'arpspoof -i eth0 -t <gateway-ip> <victim-ip>' to poison the gateway's ARP cache in the other direction. Both directions must be poisoned simultaneously for a full man-in-the-middle position — poisoning only one direction gives you a one-way intercept.

Verify you are in the middle

On the victim machine, run 'arp -n' to display the ARP cache. The gateway IP address should now resolve to your Kali machine's MAC address instead of the real gateway's MAC — this confirms the poisoning was successful. You can also verify from Kali by running 'tcpdump -i eth0 -n' and confirming you see traffic from both the victim and the gateway passing through your machine. A common pitfall is forgetting to run arpspoof in both directions, which results in one-way traffic only.

Capture intercepted traffic

Start Wireshark on your Kali machine and capture on the same interface you used for arpspoof. All traffic between the victim and the gateway is now flowing through your machine, so you will see the victim's full network activity. Apply filters such as 'http', 'ftp', or 'dns' to focus on specific protocols. In a real attack scenario, this is where an attacker would harvest credentials, session cookies, and other sensitive data — which is why ARP poisoning is so dangerous on unswitched or poorly secured networks.

Stop the attack

Press Ctrl+C in both arpspoof terminal windows to stop the poisoning. The ARP caches on the victim and gateway will gradually return to their correct state as legitimate ARP replies are received, typically within 30–60 seconds. You can speed up recovery by running 'arp -d <ip>' on the victim to flush the poisoned entry. Always stop ARP poisoning attacks cleanly in a lab environment — leaving them running can cause network disruption and may affect other VMs on the same virtual network.

Previous: Packet Analysis with Wireshark Next Lesson