36.5 Bettercap: Network Recon and MITM (Lab)
Bettercap network recon ani MITM (Man-in-the-Middle – मध्यस्थ हल्ला) lab sathi modern tool aahe. ARP spoofing ne attacker LAN var victim ani gateway madhe basun traffic baghu shakto – fakt host-only lab. Real Wi-Fi / office network var he illegal ani destructive aahe.
sudo apt install -y bettercap
sudo bettercap -iface eth1 # use your host-only interface name
# Inside bettercap console (lab only):
# net.probe on
# net.show
# set arp.spoof.targets 192.168.56.20
# arp.spoof on
# net.sniff on
Concept: ARP spoofing fake "I am the gateway" messages pathavte; victim packets attacker kade yetat. HTTP cleartext madhe passwords/cookies disu shaktat. HTTPS + HSTS he thambavto – certificate warning ignore karu naka (Chapter 2/15).
Defence:
- HTTPS everywhere + HSTS
- Network segmentation (guest / IoT alag VLAN)
- Static ARP / Dynamic ARP Inspection on managed switches (where available)
- VPN on untrusted networks
- Never click through certificate warnings
MITM only on host-only lab
Bettercap ARP spoof office, college Wi-Fi kiwa neighbour network var – cyber crime. Host-only VirtualBox/VMware lab (192.168.56.0/24) chya baher kadhihi nahi.
Ravindra Bagale's Tip
Students "HTTPS aahe mhanun 100% safe" mhantat. MITM lab madhe kalel: user ne certificate warning ignore kela tar attacker fake cert dakhavu shakto. HSTS ani certificate pinning (apps) he defence. Tumhi defender asla tar: users la warning ignore karu naka he shikva – te technical control itkech mahatvache.
Lab
Host-only network var Bettercap start kara, net.probe / net.show ne lab hosts bagha. Optional: ARP spoof fakt 192.168.56.20 target karun HTTP page (DVWA) cleartext madhe sniff hote ka te observe kara – mag spoof off kara. Note liha: HTTPS page content wadla ka nahi? HSTS defence ek line madhe explain kara.