Ravindra BagaleCourses & study guides मराठी Track your progress

36. More Essential Kali Tools

36.5 Bettercap: Network Recon and MITM (Lab)

By Last updated:

Bettercap network recon ani MITM (Man-in-the-Middle – मध्यस्थ हल्ला) lab sathi modern tool aahe. ARP spoofing ne attacker LAN var victim ani gateway madhe basun traffic baghu shakto – fakt host-only lab. Real Wi-Fi / office network var he illegal ani destructive aahe.

sudo apt install -y bettercap
sudo bettercap -iface eth1          # use your host-only interface name
# Inside bettercap console (lab only):
# net.probe on
# net.show
# set arp.spoof.targets 192.168.56.20
# arp.spoof on
# net.sniff on

Concept: ARP spoofing fake "I am the gateway" messages pathavte; victim packets attacker kade yetat. HTTP cleartext madhe passwords/cookies disu shaktat. HTTPS + HSTS he thambavto – certificate warning ignore karu naka (Chapter 2/15).

Defence:

  • HTTPS everywhere + HSTS
  • Network segmentation (guest / IoT alag VLAN)
  • Static ARP / Dynamic ARP Inspection on managed switches (where available)
  • VPN on untrusted networks
  • Never click through certificate warnings

MITM only on host-only lab

Bettercap ARP spoof office, college Wi-Fi kiwa neighbour network var – cyber crime. Host-only VirtualBox/VMware lab (192.168.56.0/24) chya baher kadhihi nahi.

Ravindra Bagale's Tip

Students say "It's HTTPS, so it's 100% safe." The MITM lab shows you: if the user ignores a certificate warning, the attacker can present a fake cert. HSTS and certificate pinning (in apps) are the defences. If you are a defender: teach users not to ignore warnings – that is just as important as the technical controls.

Lab

Host-only network var Bettercap start kara, net.probe / net.show ne lab hosts bagha. Optional: ARP spoof fakt 192.168.56.20 target karun HTTP page (DVWA) cleartext madhe sniff hote ka te observe kara – mag spoof off kara. Note liha: HTTPS page content wadla ka nahi? HSTS defence ek line madhe explain kara.

Extended teaching notes

Why this lesson matters

Kali tools are dual-use. In this course every run ends with a defensive note: what config would have blocked or detected the activity on a system you own.

Rule

Host-only lab, written scope, no bridging onto real LANs.

Mini case study

Suppose we are on a purple-team exercise for an Indian mid-size company (sample data). Red notes a technique from this lesson against a lab clone. Blue must show the control that stops it, the log that would have fired, and the ticket that hardens production. That is the standard this course trains you for.

Defender's worksheet (do this today)

  1. Write the lesson title, date and the exact lab target you are allowed to use.
  2. List three owned systems (VMs, apps, or cloud accounts) where this lesson applies.
  3. Run one safe check from the lesson on a lab system only. Paste the command and output.
  4. Write a two-sentence fix you would give a teammate.
  5. Name one related public advisory (CERT-In, CISA, NVD, or a vendor bulletin) with its date.

Indian workplace (sample data)

Suppose we are a junior analyst at Infosys, TCS, Wipro or a fintech SOC in Bengaluru/Pune. Turn this lesson into one checklist item with an owner, a due date and a place to store evidence (ticket + screenshot).

Global practice

Compare your notes with OWASP, CIS Benchmarks, NIST CSF/IR guidance or a cloud Well-Architected security question. Write five lines on what overlaps.

Everyday analogy

Explain the risk and the fix to a family member without jargon. If they can repeat the warning, you understand it well enough to teach juniors.

Key terms

  • Control: a safeguard (patch, config, process, detection).
  • Finding: a weakness backed by evidence.
  • Remediation: the fix plus how you verified it.
  • Scope: systems you have written permission to touch.
  • Least privilege: only the access the task needs.
  • Defence in depth: several layers so one failure does not end the story.

Common mistakes

  • Skipping written permission "just for a quick scan".
  • Practising on hostel, office or public targets without authorisation.
  • Collecting tool output without writing the fix.
  • Copying attack steps onto production to "verify". Defenders verify with versions, configs and patches.
  • Publishing screenshots that contain secrets, cookies or internal hostnames.

Recap

  • Evidence, fix, owner, date.
  • Own lab only.
  • Fix > spectacle.