Ravindra BagaleCourses & study guides

36. More Essential Kali Tools

36.5 Bettercap: Network Recon and MITM (Lab)

Bettercap network recon ani MITM (Man-in-the-Middle – मध्यस्थ हल्ला) lab sathi modern tool aahe. ARP spoofing ne attacker LAN var victim ani gateway madhe basun traffic baghu shakto – fakt host-only lab. Real Wi-Fi / office network var he illegal ani destructive aahe.

sudo apt install -y bettercap
sudo bettercap -iface eth1          # use your host-only interface name
# Inside bettercap console (lab only):
# net.probe on
# net.show
# set arp.spoof.targets 192.168.56.20
# arp.spoof on
# net.sniff on

Concept: ARP spoofing fake "I am the gateway" messages pathavte; victim packets attacker kade yetat. HTTP cleartext madhe passwords/cookies disu shaktat. HTTPS + HSTS he thambavto – certificate warning ignore karu naka (Chapter 2/15).

Defence:

  • HTTPS everywhere + HSTS
  • Network segmentation (guest / IoT alag VLAN)
  • Static ARP / Dynamic ARP Inspection on managed switches (where available)
  • VPN on untrusted networks
  • Never click through certificate warnings

MITM only on host-only lab

Bettercap ARP spoof office, college Wi-Fi kiwa neighbour network var – cyber crime. Host-only VirtualBox/VMware lab (192.168.56.0/24) chya baher kadhihi nahi.

Ravindra Bagale's Tip

Students say "It's HTTPS, so it's 100% safe." The MITM lab shows you: if the user ignores a certificate warning, the attacker can present a fake cert. HSTS and certificate pinning (in apps) are the defences. If you are a defender: teach users not to ignore warnings – that is just as important as the technical controls.

Lab

Host-only network var Bettercap start kara, net.probe / net.show ne lab hosts bagha. Optional: ARP spoof fakt 192.168.56.20 target karun HTTP page (DVWA) cleartext madhe sniff hote ka te observe kara – mag spoof off kara. Note liha: HTTPS page content wadla ka nahi? HSTS defence ek line madhe explain kara.