A man-in-the-middle (MITM) attack happens when an intermediary sits between two communicating systems. Thus, rather than direct contact, each endpoint unknowingly uses the intermediary. This MITM hacking scenario allows attackers to intercept or alter data.
[ASCII diagram block — keep as-is]
In real attacks, an intruder may try to read or alter traffic. This project avoids those harmful steps. The Pi acts as an intentionally configured router, while you inspect harmless test traffic and learn why encryption matters.
What You Will Learn
– How packets travel through an intermediary
– The difference between HTTP and HTTPS
– How DNS, routing, and TLS fit together
– Why certificate warnings matter
– How to inspect your own packets with Wireshark or tcpdump
– How network segmentation and encryption reduce MITM risk
Parts List
Prices and exact product availability change, so treat these as approximate budget ranges.
Table:
– Raspberry Pi 4, 2 GB or higher | Lab router and observer | $35-$70
– 16-32 GB microSD card | Operating system and tools | $6-$12
– USB-C 5 V/3 A power supply | Stable power | $8-$15
– USB-to-Ethernet adapter | Second isolated network interface | $10-$20
– Two Ethernet cables | Client and server connections | $6-$12
– Optional small power bank | Portable operation | $15-$30
– Optional case and heatsinks | Protection and cooling | $8-$15
You can buy these from Raspberry Pi-approved resellers, electronics suppliers such as Adafruit or SparkFun, or reputable local computer retailers. Avoid power supplies with unclear ratings; undervoltage causes unstable networking.
[Image block — keep as-is]
Wiring Diagram
Additionally, no GPIO wiring is required for MITM hacking.
[Custom HTML wiring diagram blocks — keep as-is]
Use this as a physically isolated lab. Do not connect either side to a workplace, school, hotel, public Wi-Fi, or another person’s network.
Install Raspberry Pi OS
Download Raspberry Pi Imager from the official Raspberry Pi website and install Raspberry Pi OS Lite, 64-bit, onto the microSD card.
In Imager’s settings:
1. Assign a hostname such as pi-lab.
2. Create a unique username and strong password.
3. Enable SSH only if you need remote administration.
4. Set the correct keyboard and regional settings.
5. Avoid entering credentials for a production Wi-Fi network.
Boot the Pi and update it:
[code blocks — keep as-is]
Install the safe observation tools:
[code block — keep as-is]
List the network interfaces:
[code block — keep as-is]
The built-in Ethernet interface is commonly eth0; a USB adapter may appear as eth1 or as a predictable name beginning with enx. Use the names actually shown on your Pi.
Create Two Isolated Subnets
As an illustration, suppose MITM hacking is observed.
– Built-in Ethernet: eth0
– USB Ethernet: eth1
– Test server subnet: 192.168.50.0/24
– Test client subnet: 192.168.60.0/24
Assign addresses temporarily:
[code block — keep as-is]
Configure the test server manually as: [table — translate Setting column header only]
Configure the test client manually as: [table — translate Setting column header only]
These temporary interface settings disappear after reboot, which is useful for a classroom experiment.
Enable Routing
Enable IPv4 forwarding until the next reboot:
[code blocks — keep as-is]
Confirm it:
[code block — keep as-is]
Allow only forwarding between the two isolated lab interfaces:
[code block — keep as-is]
This deliberately excludes NAT and internet sharing. Traffic is limited to the two lab subnets.
To remove the temporary firewall afterward:
[code block — keep as-is]
Create a Harmless Test Server
On the test-server computer, make a directory containing non-sensitive sample files:
[code block — keep as-is]
From the test client:
[code block — keep as-is]
The request travels through the Pi because the endpoints are on separate subnets.
Do not put passwords, tokens, private documents, or genuine personal information in this test directory.
Observe Your Own HTTP Traffic
On the Pi, watch traffic crossing the client-side interface
[code block — keep as-is]
Run the curl request again. You should see parts of the HTTP exchange, including the requested path and harmless response text.
Save a packet capture for classroom analysis:
[code block — keep as-is]
Stop it with Ctrl+C. Open the resulting capture in Wireshark on a computer you control. Useful display filters include:
[code blocks — keep as-is]
Delete the capture after the lesson because packet captures can contain information beyond what is visible on screen:
[code block — keep as-is]
Compare HTTP With HTTPS Safely
The central lesson is that being able to observe packet transport does not automatically reveal encrypted application data.
Use a local HTTPS service you intentionally create, or access a public HTTPS demonstration page from a separate, ordinary connection. When viewing HTTPS with packet-analysis software, you will generally see metadata such as IP addresses, ports, timing, packet sizes, and TLS negotiation information, but not the protected page contents.
Do not install an interception certificate, disable certificate validation, or teach users to ignore browser warnings. Those practices undermine the protection the exercise is intended to demonstrate.
Optional Python Packet-Metadata Viewer
This program reads packet metadata through tshark; it does not reconstruct content, collect credentials, or modify traffic.
[custom HTML Python code block — keep as-is]
Save it as observe_metadata.py, then run:
[code block — keep as-is]
If your USB adapter has a different interface name, substitute it.
What Real MITM Attacks Exploit
A malicious MITM setup often depends on one or more of these conditions:
– Unencrypted protocols: Plain HTTP, Telnet, FTP, and similar protocols expose content.
– Trust manipulation: The victim accepts an invalid certificate or installs an attacker’s certificate.
– Network impersonation: A system is deceived about the identity of a router, access point, or DNS service.
– Compromised infrastructure: An attacker controls a legitimate router, endpoint, or trusted service.
– Weak application design: An app fails to validate certificates or sends secrets outside an encrypted channel.
This lab demonstrates routing and observation without reproducing the impersonation, coercion, or credential-interception steps.
Defenses Against MITM Attacks
– Use HTTPS and modern TLS everywhere.
– Never bypass unexpected certificate warnings.
– Keep operating systems, browsers, routers, and applications updated.
– Avoid transmitting sensitive information over unknown public networks.
– Use an authenticated VPN when required by your organization.
– Prefer encrypted DNS where appropriate, while remembering that it does not replace HTTPS.
– Use SSH rather than Telnet and SFTP rather than FTP.
– Enable multi-factor authentication so a stolen password is less useful.
– On managed networks, use protections such as client isolation, DHCP snooping, dynamic ARP inspection, authenticated Wi-Fi, and network monitoring.
Legal and Ethical Boundary
Only capture traffic when every device is yours or every participant has given explicit, informed permission. Keep the lab physically isolated, use synthetic data, define a time limit and scope, and erase packet captures afterward. Being able to reach a network is not the same as having authorization to inspect or alter it.
Examples of MITM attacks used IRL
Major documented cases
1. UNC2891 (aka LightBasin) bank ATM attack (discovered/reported 2025; activity in Q1 2024)
Hackers physically planted a 4G-enabled Raspberry Pi connected directly to the same network switch as a bank’s ATM systems. The cellular modem provided outbound remote access that bypassed perimeter firewalls. The goal was to reach the ATM switching server, deploy a custom rootkit (CAKETAP), and spoof transaction authorizations for fraudulent cash withdrawals. Group-IB detected unusual activity, found the device, and disrupted the operation before significant financial damage. The group is a known financially motivated actor previously linked to ATM fraud campaigns. Sources include Group-IB reporting covered by Ars Technica, BleepingComputer, The Register, The Hacker News, and others.
2. DarkVishnya campaign against Eastern European banks (reported 2018 by Kaspersky)
Attackers targeted at least eight banks, stealing tens of millions. They gained physical access (posing as job seekers, couriers, or inspectors) and planted small devices including Raspberry Pis (alongside netbooks and Bash Bunny tools) in places such as meeting rooms. The devices were left connected to the network and controlled remotely over mobile data (GPRS/3G/LTE). This allowed data exfiltration from inside the corporate networks. Kaspersky noted the approach could work against any large organization with physical access opportunities.
3. Attempted compromise of a ferry (reported late 2025)
A Raspberry Pi paired with a cellular modem was plugged into the onboard network of a ferry in the port of Sète, France (preparing to sail to Algeria). The device enabled potential remote access to the vessel’s internal systems. Network segmentation between office and operational systems, plus lack of remote access to critical controls, prevented lateral movement or sabotage. The ferry was temporarily immobilized while the incident was investigated. Analysts highlighted it as a wake-up call for physical security and the risk of “new perimeter from inside.”
Other related notes
– A 2024 incident at security firm KnowBe4 involved a North Korean operative (using a stolen U.S. identity) who, after being hired, used a Raspberry Pi in connection with attempted malware activity. This was more of an insider/remote-access scenario than a classic public MITM.
– Security researchers and red-team papers have demonstrated Raspberry Pi Zero or similar boards used as USB Ethernet gadgets or inline bridges for credential interception (e.g., NTLM hashes) or MITM-style positioning in lab/organizational tests. These are proofs-of-concept or forensic discussions rather than confirmed large-scale public criminal campaigns.
– Academic and conference material also covers Raspberry Pi-based rogue access points or network implants for interception, but these are typically research or authorized testing contexts.
These incidents underscore that small, inexpensive single-board computers like the Raspberry Pi are attractive for attackers who can obtain brief physical access: they are easy to hide, can run full Linux toolsets, and (with a modem) create an independent outbound channel that avoids traditional network monitoring.
Active design system:
Colors: black #000000, cyan-bluish-gray #abb8c3, white #ffffff, pale-pink #f78da7, vivid-red #cf2e2e, luminous-vivid-orange #ff6900, luminous-vivid-amber #fcb900, light-green-cyan #7bdcb5, vivid-green-cyan #00d084, pale-cyan-blue #8ed1fc, vivid-cyan-blue #0693e3, vivid-purple #9b51e0, primary #00E49A, secondary #FB6500, tertiary #FBC300, inactive #3B3B3B, white #ffffff
Fonts: Albert Sans, Alegreya, Arvo, Bodoni Moda, Bricolage Grotesque, Cabin, Chivo, Commissioner, Cormorant, Courier Prime, Crimson Pro, DM Mono, DM Sans, DM Serif Display, Domine, EB Garamond, Epilogue, Fahkwang, Figtree, Fira Sans, Fjalla One, Fraunces, Gabarito, IBM Plex Mono, IBM Plex Sans, Ibarra Real Nova, Instrument Serif, Inter, Josefin Sans, Jost, Libre Baskerville, Libre Franklin, Literata, Lora, Merriweather, Montserrat, Newsreader, Noto Sans Mono, Nunito, Open Sans, Overpass, PT Serif, Petrona, Piazzolla, Playfair Display, Plus Jakarta Sans, Poppins, Raleway, Roboto, Roboto Slab, Rubik, Rufina, Sora, Source Sans 3, Source Serif 4, Space Mono, Syne, Texturina, Urbanist, Work Sans
Element styles: button (color: var(–wp–preset–color–background), bg: #2f2f2f, font: inherit, weight: inherit); caption (color: #8B9399); heading (weight: 400); link (color: #00E49A)