36.5 Bettercap: Network Recon and MITM (Lab)
Bettercap network recon ani MITM (Man-in-the-Middle – मध्यस्थ हल्ला) lab sathi modern tool aahe. ARP spoofing ne attacker LAN var victim ani gateway madhe basun traffic baghu shakto – fakt host-only lab. Real Wi-Fi / office network var he illegal ani destructive aahe.
sudo apt install -y bettercap
sudo bettercap -iface eth1 # use your host-only interface name
# Inside bettercap console (lab only):
# net.probe on
# net.show
# set arp.spoof.targets 192.168.56.20
# arp.spoof on
# net.sniff on
Concept: ARP spoofing fake "I am the gateway" messages pathavte; victim packets attacker kade yetat. HTTP cleartext madhe passwords/cookies disu shaktat. HTTPS + HSTS he thambavto – certificate warning ignore karu naka (Chapter 2/15).
Defence:
- HTTPS everywhere + HSTS
- Network segmentation (guest / IoT alag VLAN)
- Static ARP / Dynamic ARP Inspection on managed switches (where available)
- VPN on untrusted networks
- Never click through certificate warnings
MITM only on host-only lab
Bettercap ARP spoof office, college Wi-Fi kiwa neighbour network var – cyber crime. Host-only VirtualBox/VMware lab (192.168.56.0/24) chya baher kadhihi nahi.
Ravindra Bagale's Tip
Students say "It's HTTPS, so it's 100% safe." The MITM lab shows you: if the user ignores a certificate warning, the attacker can present a fake cert. HSTS and certificate pinning (in apps) are the defences. If you are a defender: teach users not to ignore warnings – that is just as important as the technical controls.
Ravindra Bagale's Tip – मराठी
Students "HTTPS आहे म्हणून 100% safe" म्हणतात. MITM lab मध्ये कळेल: user ने certificate warning ignore केली तर attacker fake cert दाखवू शकतो. HSTS आणि certificate pinning (apps) हे defence. तुम्ही defender असाल तर: users ना warning ignore करू नका हे शिकवा – ते technical control इतकेच महत्त्वाचे.
Ravindra Bagale's Tip – हिंदी
Students कहते हैं "HTTPS है इसलिए 100% safe". MITM lab में समझ आएगा: user ने certificate warning ignore की तो attacker fake cert दिखा सकता है. HSTS और certificate pinning (apps) ये defence हैं. आप defender हो तो: users को warning ignore न करना सिखाओ – यह technical control जितना ही ज़रूरी है.
Lab
Host-only network var Bettercap start kara, net.probe / net.show ne lab hosts bagha. Optional: ARP spoof fakt 192.168.56.20 target karun HTTP page (DVWA) cleartext madhe sniff hote ka te observe kara – mag spoof off kara. Note liha: HTTPS page content wadla ka nahi? HSTS defence ek line madhe explain kara.