MITM attack using Ettercap

Fri, 17 Apr 2026 00:00:00 +0000

Ettercap is a MITM (Man-in-the-Middle) attack suite with a wide range of plugins supporting different attack techniques. This article focuses on a simple ARP poisoning and DNS hijacking attack. For this to work, the involved devices must share Layer 2 connectivity.

Credit: The Ettercap Project

Warning

This article is for educational purposes only. Performing MITM attacks on networks without explicit authorization is illegal and unethical. Only practice these techniques in controlled lab environments that you own or have permission to test.

The Man-in-the-Middle attack

The principle of a MITM attack is to insert an attacker into a network or communication path and make the targets believe that it is part of the regular communication relay. There are several different methods to achieve this “trusted imposter” status, many of which are available as plugins in ettercap. This article focuses on two such methods: ARP poisoning and DNS highjacking.

Arp on kubelize

MITM attack using Ettercap

The Man-in-the-Middle attack