Man-in-the-Middle & Post-Exploitation

On a LAN, machines map IP addresses to hardware addresses using ARP, which has no authentication. An attacker sends unsolicited ARP replies telling the victim that the gateway is at the attacker's hardware address and vice versa. Both sides update their caches and route traffic through the attacker, who enables forwarding so the traffic still reaches its destination unnoticed.

Without forwarding, traffic the attacker intercepts would stop at their machine and the victim would lose connectivity, revealing the attack instantly. Enabling IP forwarding relays the packets on to their real destination, so interception is transparent and the victim keeps working normally while the attacker reads or alters the traffic in transit.

A man-in-the-middle attack is about position: inserting yourself on the path between a victim and the gateway to read or redirect traffic. Post-exploitation is what you do after gaining control of a host: establishing persistence, logging keystrokes, collecting credentials and loot, and preparing to pivot. MITM often provides the foothold; post-exploitation turns it into lasting impact.

Because ARP itself cannot be authenticated, defences sit higher up: Dynamic ARP Inspection with DHCP snooping on managed switches drops forged replies, ARP monitoring tools alert when an IP suddenly maps to a new hardware address, and static entries protect critical gateways. The strongest layer is encrypting all internal traffic, so an interceptor sees only ciphertext.

Only against systems you own or are explicitly authorised in writing to test. ARP spoofing, DNS spoofing, payload delivery and pivoting on a network you do not have permission for are crimes in essentially every jurisdiction. This course uses an isolated lab so you can practise the techniques legally and safely.

Baseline the gateway's legitimate IP-to-MAC mapping while the network is known-good, then watch the neighbour table. Two clear signs point to a spoof: one hardware address claiming several IPs, or the gateway's MAC changing away from the baseline. A MAC that rapidly flaps between two values is the fingerprint of an active spoof competing with the real gateway.