Detect Man In The Middle Attack in your network

In this post we are going to see a simple and easy way to detect a network sniffer or Man In The Middle who is intercepting our network and can sniff our password over the network. This is a basic and simple way to do a basic check for any intercept inside your network. However this is not enough to check these types of network attack but this can come handy when you are dealing with some script kiddie who is just using some script and don't know anything about what is he doing .

What You Need To Know 

You need to know about basics of networking. And apart from this i will tell you every step and will give you info about the command we are going to use.

Steps For Detecting MITM Attack

Before checking for the network intercept i am going to start capture plaintext password to show you that we are intercepting the network so that we can see that this method actually work or not.

1. So first i will start intercepting my network as shown below.

2. Now i will capture some plaintext password this will tell us that our network is being watched.

As we can see above we got some plaintext password of our victim. Now suppose you are a victim and don't know if someone is inside your network and capturing your credentials and you want to make sure your network is secure so we will do a quick check to detect the sniffer.

Detecting The Sniffer

1. I will use a simple technique to detect the sniffer to do this open your terminal and type nmap -sn --script=sniffer-detect 192.168.0.102

Command We Used Above 

"sn"  This command is for "ping" scan, but it will not necessarily do a ICMP request.

"--script" This will tell nmap to run a script in this case it was "sniffer-detect".

"sniffer-detect" This was the script name which we used for detecting the sniffer.

"192.168.0.108" This is the target network which may be compromised in this case, this may not always work so you can also scan the whole network by adding /24 after the gateway address for example in this case it would be 192.168.0.1/24.

2. Now nmap will do the scan and will report you if your network is in promiscuous mode as we can see below nmap has found sniffer inside our network.

Final Words

As i said above this is not enough to check these types of network attack but this can come handy when you are dealing with some script kiddie who just using some script and don't know anything about what is he doing so in our upcoming post i will cover some other way to detect network sniffer.

For more stuff you can follow us on : Facebook

And you can also follow our Page