Ethical Hacking Sniffing and MITM
Network sniffing means capturing and reading data that travels across a network. A man-in-the-middle attack, shortened to MITM, places an attacker between two communicating parties. Ethical hackers study both to show how unprotected traffic leaks private information and to prove why encryption matters.
How Data Travels
Every message on a network breaks into small pieces called packets. Each packet carries a sender address, a receiver address, and a piece of content. Devices read the packets addressed to them and ignore the rest.
What Sniffing Means
A sniffer listens to packets that pass by. Think of a postal worker who reads postcards while sorting mail. Postcards show their message to anyone who handles them. Sealed envelopes protect the message. Unencrypted traffic behaves like a postcard, and encrypted traffic behaves like a sealed envelope.
Passive and Active Sniffing
| Type | Meaning | Where It Works |
|---|---|---|
| Passive | Only listens to traffic that already reaches the device | Open Wi-Fi, old hub networks |
| Active | Interferes with the network to pull traffic toward the tester | Switched networks |
Common Sniffing Tools
- Wireshark: a graphical tool that captures and displays packets in detail.
- tcpdump: a command-line capture tool.
- Ettercap and Bettercap: tools for studying MITM behavior in labs.
The MITM Idea
Normal path:
[Your Laptop] ----------------------> [Website]
MITM path:
[Your Laptop] ---> [Attacker] ---> [Website]
|
reads or alters
the data
Neither side notices the extra stop. The attacker passes messages along while copying them.
ARP Spoofing in Simple Words
Computers on a local network use ARP to match an IP address with a hardware address. ARP trusts every answer it hears. An attacker sends false answers that say "send traffic for the router to me". Victims believe the lie and route their data through the attacker. Security teams test this weakness in labs to confirm that their network switches can detect and block it.
Other MITM Methods
- Fake Wi-Fi hotspots that copy a real network name.
- DNS spoofing, which sends users to a wrong website address.
- Fake security certificates that trick weak applications.
- Rogue devices plugged into open network ports.
Lab Example
A learner builds three virtual machines on a private network: a client, a server, and a tester machine. The server runs an old login page without HTTPS. The tester captures the client's login and sees the username in plain text. The learner enables HTTPS on the server and captures again. The capture now shows scrambled data. The exercise proves the value of encryption in a visible way.
Before HTTPS: user=maya&pass=hello123 After HTTPS: 8f3a9c1e77b2d4... (unreadable)
Reading a Capture
Wireshark filters narrow the view. Typing http shows only web traffic, and ip.addr == 192.168.1.5 shows packets for one device. Analysts follow a full conversation with the Follow Stream option.
Defense Methods
- Use HTTPS, SSH, and VPN connections for all sensitive traffic.
- Enable dynamic ARP inspection and port security on switches.
- Avoid public Wi-Fi for banking and work tasks, or use a trusted VPN.
- Check certificate warnings carefully and never click past them.
- Use DNSSEC and trusted DNS services.
- Monitor networks for duplicate addresses and unusual ARP replies.
Legal Boundary
Capturing other people's traffic without approval breaks wiretapping and computer misuse laws. Practice only on your own lab network or on a client network under a signed agreement.