How to Build a Man-in-the-Middle Tool with Scapy and Python « Null Byte :: WonderHowTo

Man-in-the-Middle attacks can prove to be very useful, they allow us to do many things, such as monitoring, injection, and recon.What Is a Man-in-the-Middle Attack?Essentially, a man-in-the-middle attack is when an attacker places them self between two parties. This passes all data through the attacking system which allows the attacker to view the victims activity and perform some useful recon.Before we can do anything with a man-in-the-middle, we have to establish one. That is what we'll build here today, so, let's get started!Just a Heads UpWe'll be defining functions throughout this script in order to use them later, the order in which we define the functions is NOT the order in which their events take place. I just wanted to clarify that before it caused confusion.Step 1: Importing Modules & Getting InputThe first thing we'll do in this script is import all our needed modules...Of these modules, the most important is scapy. This lets us craft and send custom packets, which is what enables us to send the ARP responses. After we import these, we'll get some simple input form the user...Here we've asked the user for an interface, the victim IP address, and the router IP address. We've added an exception just in case the user doesn't want to continue. We've also enabled IP forwarding for the user so they don't have to do it.Step 2: Getting MAC AddressesIn order to properly create our ARP responses, we'll need the victim and router MAC addresses. We can do this by making ARP requests and returning the result...In the above snippet of code we send an ARP request with the destination of the user's choice, we'll use this function later in our script.Step 3: Re-ARPing the TargetsOnce our attack is over, we need to re-assign the target's addresses so they know where to send their information properly. If we don't do this than it will be very obvious that something has happened.In this function, we call our get-mac() function that we created earlier to find the MAC addresses. Once we have those it'll send replies out telling the systems where the other system is. We'll send each reply seven times for good measure. Once we've done that we'll disable IP forwarding for the user.Step 4: Tricking the TargetsThe next function is the simplest one, yet the most important.This function simply sends a single ARP reply to each of the targets telling them that we are the other target, placing ourselves in between them.Step 5: Putting It All TogetherFinally, we put it all together for the main function of our script...Here, wetryto get the victim and router MAC addresses, this is in case of failure. We don't want to send packets to one and not the other, so in the case that we can't find one of them, we disable IP forwarding and shut down the script. If we are able to get the MAC address then we can start sending our replies. We do this by making awhileloop and sending another set of replies every 1.5 seconds. Once the user gives a keyboard interrupt (Control + C), we call the reARP() function to re-assign the targets and shut the script down.Step 6: Testing It OutNow that have our script (Pastebin Here) we have to give it a test run to make sure it works.Navigate to your script and fire it up! I'll be entering "wlan0" as my desired interface, 10.0.0.7 as the victim IP, and 10.0.0.1 as my router IP.We can see above that we've begun to send out our replies. Let's open up wireshark and take a look at them!We can see here that we are successfully sending our replies, we've officially established our man-in-the-middle! Now we just have to shut it down and make sure the shut down function works...We can see that the script went off without a hitch! We we're able to place ourselves between the targets and re-assign them once we were done.Step 7: Testing the ExceptionsIn a script like this, it is very import that it knows when to stop, we need to test the exceptions to make sure they work in order to insure that no packets get sent out by mistake. Let's test the input exception first...Now let's test the MAC address resolution exception...We can give the script a faulty victim IP so it wont be able to find a MAC address. Let's make sure it works for a faulty router IP as well...So, there we have it. Our exceptions work like a charm!Step 8: Using Our MitMNow that we have an established man-in-the-middle, we can run other tools on it. Such as urlsnarf to sniff the victims activity...We can see in the above urlsnarf result that our victim is actually browsing on none other than Null-Byte! That confirms that our script works as intended, we did it!Step 9: Feedback!Let me know what you think in the comments below, if you have any questions ask away! I'm sure they'll answered one way or another. For any of you that missed the Pastebin link earlier,here it is.Thank you for reading!-DefaltWant to start making money as a white hat hacker?Jump-start your hacking career with our2020 Premium Ethical Hacking Certification Training Bundlefrom the newNull Byte Shopand get over 60 hours of training from cybersecurity professionals.Buy Now (90% off) >Other worthwhile deals to check out:97% off The Ultimate 2021 White Hat Hacker Certification Bundle99% off The 2021 All-in-One Data Scientist Mega Bundle98% off The 2021 Premium Learn To Code Certification Bundle62% off MindMaster Mind Mapping Software: Perpetual LicenseRelatedHow To:Build a DNS Packet Sniffer with Scapy and PythonHow To:Build an ARP Scanner Using Scapy and PythonHow to Train Your Python:Part 1, IntroductionHow To:Create Packets from Scratch with Scapy for Scanning & DoSingHow To:Hack WPA WiFi Passwords by Cracking the WPS PINHow To:Use variables and strings when programming in Python 2How To:Turbo Ping Sweeping with PythonHow To:Here's Why You Need to Add Python to Your Hacking & Programming ArsenalHow To:Build an Evasive Shell in Python, Part 3: Building the Attacker ScriptHow To:Build an FTP Password Sniffer with Scapy and PythonHow To:Use WebTech to Discover What Technologies a Website UsesHow To:Get Fastboot Flashable Factory Images for Any OnePlus PhoneNews:And the Winner of the White Hat Award for Technical Excellence Is...How To:Null Byte & Null Space Labs Present: Wi-Fi Hacking, MITM Attacks & the USB Rubber DuckyHow To:Master Python, Django, Git & GitHub with This BundleHow To:How One Man's Python Script Got Him Over 20,000 Karma on Reddit—Without CheatingNews:Learning Python 3.x as I go (Last Updated 6/72012)News:Learn to Code in Python, Part One: Variables, Input and OutputCommunity Byte:Coding a Web-Based Password Cracker in PythonNews:Ball PythonsHow To:Make a Gmail Notifier in PythonHow To:Enable Code Syntax Highlighting for Python in the Nano Text EditorNews:Monty Python's World Cup - In case you haven't seen itHow To:Make a Change-of-IP Notifier in PythonHow To:Generate Word-Lists with Python for Dictionary AttacksPet Portrait Challenge:FranklinIPsec Tools of the Trade:Don't Bring a Knife to a GunfightPygame:All You Need to Start Making Games in PythonHow To:Send SMS Messages with PythonGoodnight Byte:Coding a Web-Based Password Cracker in PythonCommunity Byte:Coding an IRC Bot in Python (For Beginners)