Ettercap

Ettercap is a comprehensive man-in-the-middle attack framework for Linux that enables ARP poisoning, DNS spoofing, traffic sniffing, and content filtering on local area networks. It supports both active and passive network analysis through a plugin-based architecture.

ARP poisoning works by sending forged ARP replies to hosts on a local network, associating your MAC address with the IP address of another host (typically the gateway). This causes traffic destined for that host to flow through your machine instead, enabling interception and modification.

While Ettercap remains functional for basic MITM scenarios, Bettercap has largely superseded it with modern features, better stability, and active development. Ettercap is still valuable for training environments, legacy system testing, and situations where its specific plugin set is required.

Bettercap is the modern successor to Ettercap with active development, better performance, and support for WiFi, Bluetooth, and BLE attacks. Ettercap is simpler and more established in training materials, but Bettercap is recommended for new engagements due to its modern architecture and larger feature set.

Ettercap can attempt SSL stripping to downgrade HTTPS connections to HTTP, but modern TLS with HSTS and certificate pinning will resist this attack. Ettercap cannot decrypt properly encrypted TLS traffic without the private key or a successful downgrade attack.

Ettercap supports a range of plugins including dns_spoof for DNS spoofing, ssh劫持 for SSH interception, urlsnarf for URL logging, and various filter scripts. Plugins are loaded with the -P flag and configured in /etc/ettercap/ directory.

Enable DNS spoofing by launching Ettercap with -P dns_spoof during an ARP poisoning attack. Edit /etc/ettercap/etter.dns to define which domains resolve to which IP addresses. Use: ettercap -T -q -P dns_spoof -M arp:remote /target// /gateway//

Ettercap itself is legal software. Using it for man-in-the-middle attacks on networks you own or have explicit written authorization to test is legal. Unauthorized MITM attacks violate computer fraud laws worldwide and can result in criminal prosecution.

Ettercap can perform ARP poisoning on WiFi networks once you are connected to the network, but it cannot directly attack wireless protocols. For WiFi-specific attacks like deauthentication and handshake capture, use Bettercap or Aircrack-ng instead.

Ettercap filters are compiled scripts that define rules for modifying packets in transit. They can inject content, strip headers, replace data, or drop specific packets. Filters are written using a C-like syntax and compiled with etterfilter before loading with the -F flag.

Ettercap automatically captures credentials from unencrypted protocols like HTTP, FTP, Telnet, and POP3 during ARP poisoning attacks. Enable unified sniffing mode and the tool will display cleartext credentials as they are transmitted between intercepted hosts.

Ettercap's ARP poisoning works by manipulating the ARP cache, not by bypassing switch port security directly. However, if a switch does not implement Dynamic ARP Inspection (DAI) or ARP rate limiting, Ettercap can poison the ARP tables of connected hosts to redirect traffic.

Ettercap is pre-installed on Kali Linux. Run sudo apt install ettercap-graphical for the GUI version or sudo apt install ettercap-text-only for the CLI-only version. On other distributions, install via package manager or build from the GitHub source repository.

Ettercap can dissect HTTP, FTP, Telnet, SSH (partial), DNS, SMTP, POP3, IMAP, SMB, and many other common protocols. It automatically identifies and decodes captured traffic from these protocols to extract credentials, URLs, and session data.

Ettercap focuses on network-level MITM attacks through ARP poisoning and packet manipulation, while mitmproxy is an HTTP-specific proxy for intercepting and modifying web traffic. Use Ettercap for network-wide MITM attacks, mitmproxy for detailed web application testing.

Ettercap can attempt SSL stripping to downgrade HTTPS to HTTP, but modern TLS with HSTS resists this attack. For HTTPS credential capture, Ettercap needs a valid SSL certificate installed on the victim's browser (via social engineering) or must exploit specific TLS implementation flaws. Bettercap or mitmproxy are more effective for HTTPS interception scenarios.

Load plugins with the -P flag: ettercap -T -q -P dns_spoof -M arp /target// /gateway//. Common plugins include dns_spoof (DNS spoofing), ssh劫持 (SSH interception), and urlsnarf (URL logging). Configure plugin behavior in /etc/ettercap/etter.conf. Combine multiple plugins by specifying them comma-separated: -P dns_spoof,urlsnarf.

Dynamic ARP Inspection (DAI) on managed switches prevents ARP poisoning by validating ARP packets. Port security limits MAC addresses per port. Static ARP entries bypass ARP cache manipulation. VPN encryption protects traffic even during MITM. HTTPS with HSTS prevents SSL stripping. These defenses significantly reduce Ettercap's effectiveness on properly configured networks.

Stop Ettercap gracefully with 'q' or Ctrl+C to restore ARP tables automatically. Ettercap sends correct ARP replies to poisoned hosts when shutting down. If Ettercap crashes, manually restore with: arping -U -I <interface> <gateway_ip> to send correct ARP announcements. Leaving poisoned ARP entries causes persistent network connectivity issues for victims.

Yes, Ettercap's ARP poisoning works on switched networks by corrupting the ARP cache of target hosts, causing them to send traffic to your MAC address instead of the real gateway. This does not bypass the switch itself — it manipulates the ARP tables of end hosts. Managed switches with DAI can detect and block this technique.

Create a filter script using etterfilter syntax: define filter to modify HTTP headers or inject content. Compile with etterfilter filter.ecf -o filter.ef, then load with Ettercap's -F flag. Common filter use cases include injecting JavaScript for XSS testing, modifying User-Agent strings, and injecting HTML into HTTP responses for phishing demonstrations.

Ettercap cannot directly decrypt HTTPS traffic without SSLstrip or a compromised CA certificate. Use sslstrip plugin to downgrade HTTPS to HTTP via SSL stripping. For modern HSTS-protected sites, this technique often fails. Combine Ettercap's ARP poisoning with bettercap's sslstrip2 for improved HTTPS interception, or use mitmproxy for comprehensive TLS interception.

Start Ettercap in unified sniffing mode: ettercap -T -q -M arp:remote // // to discover all hosts on the network. Ettercap automatically identifies gateway addresses, active hosts, and running services. Use the hosts list (Shift+H) to view discovered targets. Combine with nmap for deeper service enumeration on discovered hosts before launching targeted MITM attacks.

ARP poisoning corrupts ARP caches to redirect Layer 2 traffic through your machine, working on any IP-based network. ICMP redirect is a Layer 3 technique that sends ICMP Type 5 messages telling hosts to use your machine as a router. ARP poisoning is more reliable and commonly used; ICMP redirect requires specific network configurations and is easily filtered by firewalls.

Launch Ettercap's GTK interface: ettercap -G. The GUI provides visual host mapping, real-time packet visualization, and click-to-poison target selection. Select targets from the host list, choose the ARP poisoning method, and monitor intercepted traffic in the connections view. The GUI is ideal for training and demonstrations where visual feedback helps explain MITM concepts.