Sudo Grizzly Gents

A man-in-the-middle (MITM) attack happens when an intermediary sits between two communicating systems. Thus, rather than direct contact, each endpoint unknowingly uses the intermediary. This MITM hacking scenario allows attackers to intercept or alter data.

      ┌─────────┐                      ┌─────────┐
      │ Client  │                      │ Server  │
      └────┬────┘                      └────┬────┘
           │                                │
           │  1. Client thinks it is        │
           │     talking directly to        │
           │     the Server                 │
           │                                │
           ▼                                │
      ┌─────────┐                           │
      │Attacker │◄──────────────────────────┘
      │ (MITM)  │  2. Attacker intercepts
      └────┬────┘     and can:
           │           - Read traffic
           │           - Modify data
           │           - Inject content
           │
           └───────────────────────────────┐
                                           │
                                           ▼
                                      ┌─────────┐
                                      │ Server  │
                                      └─────────┘

In real attacks, an intruder may try to read or alter traffic. This project avoids those harmful steps. The Pi acts as an intentionally configured router, while you inspect harmless test traffic and learn why encryption matters.

What You Will Learn

• How packets travel through an intermediary
• The difference between HTTP and HTTPS
• How DNS, routing, and TLS fit together
• Why certificate warnings matter
• How to inspect your own packets with Wireshark or tcpdump
• How network segmentation and encryption reduce MITM risk

Parts List

Prices and exact product availability change, so treat these as approximate budget ranges.

You can buy these from Raspberry Pi-approved resellers, electronics suppliers such as Adafruit or SparkFun, or reputable local computer retailers. Avoid power supplies with unclear ratings; undervoltage causes unstable networking.

Wiring Diagram

Additionally, no GPIO wiring is required for MITM hacking.

                         ┌─────────────────────────────┐
                         │  USB-C Power Supply         │
                         │  or Power Bank              │
                         └──────────────┬──────────────┘
                                        │
                                        ▼
┌──────────────────┐     ┌──────────────────┐     ┌──────────────────────────┐
│ Laptop / Test    │     │                  │     │                          │
│ Client           │────►│ USB Ethernet     │────►│     Raspberry Pi 4       │
│ (Ethernet port)  │     │ Adapter          │     │                          │
└──────────────────┘     └──────────────────┘     │  Built-in Ethernet ──────┼───► Second Laptop /
                                                  │                          │     Local Test Server
                                                  └──────────────────────────┘

flowchart LR
    C["Laptop / Test Client
(Ethernet port)"]
    U["USB Ethernet Adapter"]
    P["Raspberry Pi 4"]
    E["Built-in Ethernet"]
    S["Second Laptop / Local Test Server"]
    B["USB-C Power Supply
or Power Bank"]

    C --- U
    U --- P
    P --- E
    E --- S
    B --> P

    style C fill:#BBDEFB,stroke:#1976D2
    style S fill:#C8E6C9,stroke:#388E3C
    style P fill:#FFE0B2,stroke:#F57C00
    style U fill:#E1BEE7,stroke:#7B1FA2
    style E fill:#E1BEE7,stroke:#7B1FA2
    style B fill:#F8BBD9,stroke:#C2185B

Use this as a physically isolated lab. Do not connect either side to a workplace, school, hotel, public Wi-Fi, or another person’s network.

Install Raspberry Pi OS

Download Raspberry Pi Imager from the official Raspberry Pi website and install Raspberry Pi OS Lite, 64-bit, onto the microSD card.

In Imager’s settings:

1. Assign a hostname such as pi-lab.
2. Create a unique username and strong password.
3. Enable SSH only if you need remote administration.
4. Set the correct keyboard and regional settings.
5. Avoid entering credentials for a production Wi-Fi network.

Boot the Pi and update it:

bash

sudo apt update
sudo apt full-upgrade -y
sudo reboot

Install the safe observation tools:

sudo apt install -y tcpdump tshark python3 python3-venv curl

List the network interfaces:

ip -brief address

The built-in Ethernet interface is commonly eth0; a USB adapter may appear as eth1 or as a predictable name beginning with enx. Use the names actually shown on your Pi.

Create Two Isolated Subnets

As an illustration, suppose MITM hacking is observed.

• Built-in Ethernet: eth0
• USB Ethernet: eth1
• Test server subnet: 192.168.50.0/24
• Test client subnet: 192.168.60.0/24

Assign addresses temporarily:

sudo ip address flush dev eth0
sudo ip address flush dev eth1
sudo ip address add 192.168.50.1/24 dev eth0
sudo ip address add 192.168.60.1/24 dev eth1
sudo ip link set eth0 up
sudo ip link set eth1 up

Configure the test server manually as:

Configure the test client manually as:

These temporary interface settings disappear after reboot, which is useful for a classroom experiment.

Enable Routing

Enable IPv4 forwarding until the next reboot:
Bash

sudo sysctl -w net.ipv4.ip_forward=1

Confirm it:
BASH

sysctl net.ipv4.ip_forward

Allow only forwarding between the two isolated lab interfaces:

sudo nft add table inet pi_lab
sudo nft 'add chain inet pi_lab forward { type filter hook forward priority 0; policy drop; }'
sudo nft add rule inet pi_lab forward iifname "eth1" oifname "eth0" ip saddr 192.168.60.0/24 ip daddr 192.168.50.0/24 accept
sudo nft add rule inet pi_lab forward iifname "eth0" oifname "eth1" ip saddr 192.168.50.0/24 ip daddr 192.168.60.0/24 ct state established,related accept

This deliberately excludes NAT and internet sharing. Traffic is limited to the two lab subnets.

bash

To remove the temporary firewall afterward:

sudo nft delete table inet pi_lab
sudo sysctl -w net.ipv4.ip_forward=0

Create a Harmless Test Server

On the test-server computer, make a directory containing non-sensitive sample files:
bash

mkdir -p ~/mitm-lab
cd ~/mitm-lab
printf '%s\n' 'This is harmless classroom test data.' > lesson.txt
python3 -m http.server 8080 --bind 192.168.50.2

From the test client:
bash

curl [192.168.50.2](http://192.168.50.2:8080/lesson.txt)

The request travels through the Pi because the endpoints are on separate subnets.

Do not put passwords, tokens, private documents, or genuine personal information in this test directory.

Observe Your Own HTTP Traffic
bash

On the Pi, watch traffic crossing the client-side interface

sudo tcpdump -i eth1 -nn -A 'host 192.168.50.2 and tcp port 8080'

Run the curl request again. You should see parts of the HTTP exchange, including the requested path and harmless response text.

Save a packet capture for classroom analysis:

sudo tcpdump -i eth1 -nn -s 0 -w ~/http-lab.pcap \
  'host 192.168.50.2 and tcp port 8080'

Stop it with Ctrl+C. Open the resulting capture in Wireshark on a computer you control. Useful display filters include:

text

http

text

ip.addr == 192.168.50.2

text

tcp.port == 8080

Delete the capture after the lesson because packet captures can contain information beyond what is visible on screen:

bash

rm -f ~/http-lab.pcap

Compare HTTP With HTTPS Safely

The central lesson is that being able to observe packet transport does not automatically reveal encrypted application data.

Use a local HTTPS service you intentionally create, or access a public HTTPS demonstration page from a separate, ordinary connection. When viewing HTTPS with packet-analysis software, you will generally see metadata such as IP addresses, ports, timing, packet sizes, and TLS negotiation information, but not the protected page contents.

Do not install an interception certificate, disable certificate validation, or teach users to ignore browser warnings. Those practices undermine the protection the exercise is intended to demonstrate.

Optional Python Packet-Metadata Viewer

This program reads packet metadata through tshark; it does not reconstruct content, collect credentials, or modify traffic.

python

Save it as observe_metadata.py, then run:

sudo python3 observe_metadata.py eth1

f your USB adapter has a different interface name, substitute it.

What Real MITM Attacks Exploit

A malicious MITM setup often depends on one or more of these conditions:

• Unencrypted protocols: Plain HTTP, Telnet, FTP, and similar protocols expose content.
• Trust manipulation: The victim accepts an invalid certificate or installs an attacker’s certificate.
• Network impersonation: A system is deceived about the identity of a router, access point, or DNS service.
• Compromised infrastructure: An attacker controls a legitimate router, endpoint, or trusted service.
• Weak application design: An app fails to validate certificates or sends secrets outside an encrypted channel.

This lab demonstrates routing and observation without reproducing the impersonation, coercion, or credential-interception steps.

Defenses Against MITM Attacks

• Use HTTPS and modern TLS everywhere.
• Never bypass unexpected certificate warnings.
• Keep operating systems, browsers, routers, and applications updated.
• Avoid transmitting sensitive information over unknown public networks.
• Use an authenticated VPN when required by your organization.
• Prefer encrypted DNS where appropriate, while remembering that it does not replace HTTPS.
• Use SSH rather than Telnet and SFTP rather than FTP.
• Enable multi-factor authentication so a stolen password is less useful.
• On managed networks, use protections such as client isolation, DHCP snooping, dynamic ARP inspection, authenticated Wi-Fi, and network monitoring.

Legal and Ethical Boundary

Only capture traffic when every device is yours or every participant has given explicit, informed permission. Keep the lab physically isolated, use synthetic data, define a time limit and scope, and erase packet captures afterward. Being able to reach a network is not the same as having authorization to inspect or alter it.

Examples of MITM attacks used IRL

Major documented cases

1. UNC2891 (aka LightBasin) bank ATM attack (discovered/reported 2025; activity in Q1 2024)
Hackers physically planted a 4G-enabled Raspberry Pi connected directly to the same network switch as a bank’s ATM systems. The cellular modem provided outbound remote access that bypassed perimeter firewalls. The goal was to reach the ATM switching server, deploy a custom rootkit (CAKETAP), and spoof transaction authorizations for fraudulent cash withdrawals.
Group-IB detected unusual activity, found the device, and disrupted the operation before significant financial damage. The group is a known financially motivated actor previously linked to ATM fraud campaigns.
Sources include Group-IB reporting covered by Ars Technica, BleepingComputer, The Register, The Hacker News, and others.

2. DarkVishnya campaign against Eastern European banks (reported 2018 by Kaspersky)
Attackers targeted at least eight banks, stealing tens of millions. They gained physical access (posing as job seekers, couriers, or inspectors) and planted small devices including Raspberry Pis (alongside netbooks and Bash Bunny tools) in places such as meeting rooms. The devices were left connected to the network and controlled remotely over mobile data (GPRS/3G/LTE). This allowed data exfiltration from inside the corporate networks. Kaspersky noted the approach could work against any large organization with physical access opportunities.

3. Attempted compromise of a ferry (reported late 2025)
A Raspberry Pi paired with a cellular modem was plugged into the onboard network of a ferry in the port of Sète, France (preparing to sail to Algeria). The device enabled potential remote access to the vessel’s internal systems. Network segmentation between office and operational systems, plus lack of remote access to critical controls, prevented lateral movement or sabotage. The ferry was temporarily immobilized while the incident was investigated. Analysts highlighted it as a wake-up call for physical security and the risk of “new perimeter from inside.”

Other related notes

• A 2024 incident at security firm KnowBe4 involved a North Korean operative (using a stolen U.S. identity) who, after being hired, used a Raspberry Pi in connection with attempted malware activity. This was more of an insider/remote-access scenario than a classic public MITM.
• Security researchers and red-team papers have demonstrated Raspberry Pi Zero or similar boards used as USB Ethernet gadgets or inline bridges for credential interception (e.g., NTLM hashes) or MITM-style positioning in lab/organizational tests. These are proofs-of-concept or forensic discussions rather than confirmed large-scale public criminal campaigns.
• Academic and conference material also covers Raspberry Pi-based rogue access points or network implants for interception, but these are typically research or authorized testing contexts.

These incidents underscore that small, inexpensive single-board computers like the Raspberry Pi are attractive for attackers who can obtain brief physical access: they are easy to hide, can run full Linux toolsets, and (with a modem) create an independent outbound channel that avoids traditional network monitoring.