To make a man in the middle attacker with a Raspberry Pi 3B(+) or 4B is very simple. You will use an additional USB/ethernet dongle so you have a second wired interface eth1 available. Now just bridge eth0 and eth1 and you have a complete transparent and stealth device.
Start with a fresh flashed image Raspberry Pi OS Lite and use systemd-networkd to set it up. Just follow to Use systemd-networkd for general networking. You can use section "♦ Quick Step". Then come back here.
Create these three files to configure the interfaces and the bridge:
rpi ~$ sudo -Es # if not already done
rpi ~# cat > /etc/systemd/network/02-br0.netdev << EOF
rpi ~# cat > /etc/systemd/network/04-br0_add-eth.network << EOF
rpi ~# cat > /etc/systemd/network/12-br0_up.network << EOF
# to use static IP uncomment following and comment DHCP=yes
The [Network] section in the last file is all commented. This ensures that the device does not get an ip address and is completely invisible on the network. The bridge will do its work without ip addresses.
Just to get updates or to install software you can temporary uncomment
or the static ip address and do
rpi ~$ sudo systemctl daemon-reload
rpi ~$ sudo systemctl restart systemd-networkd.service
First you should install
rpi ~$ sudo apt install tcpdump
Comment the Network, daemon-reload and restart as shown above.
Now you can sniff the traffic on the line. Here just a short snippet from visiting google.com assuming your sniffed device has ip address 192.168.10.113:
rpi ~$ sudo tcpdump -N -A -i eth1 host 192.168.10.113
21:11:25.080976 IP wq-in-f102.http > titan.46152: Flags [.], ack 75, win 244, options [nop,nop,TS val 1247970405 ecr 10499619], length 0
21:11:25.083929 IP wq-in-f102.http > titan.46152: Flags [P.], seq 1:529, ack 75, win 244, options [nop,nop,TS val 1247970409 ecr 10499619], length 528: HTTP: HTTP/1.1 301 Moved Permanently
Jb.i..6#HTTP/1.1 301 Moved Permanently
Content-Type: text/html; charset=UTF-8
Date: Wed, 10 Jul 2019 20:11:25 GMT
Expires: Fri, 09 Aug 2019 20:11:25 GMT
Cache-Control: public, max-age=2592000
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
The document has moved
21:11:25.084225 IP titan.46152 > wq-in-f102.http: Flags [.], ack 529, win 237, options [nop,nop,TS val 10499624 ecr 1247970409], length 0
You can use nftables to mangle the passing traffic or any other tool. I haven't tried it. That's your exercise :-)
The alphabetical order of the file names is important for execution. In
man systemd.network in the second paragraph you will find:
All configuration files are collectively sorted and processed in lexical order, regardless of the directories in which they live. However, files with identical filenames replace each other.
You can use what names you want but you must ensure that a
.netdev file is executed before using the bridge name in
.network files (ok, systemd will execute it always before .network files). And
.network files must have an order. The interfaces must be added to the bridge before bringing up the bridge. I like to use the old style SysV naming for init files with preceded numbers. For me I have reserved 00 to 03 for .netdev, 04 to 07 for wired interfaces, 08 to 11 for wifi interfaces and the rest for others where I use a gap of four numbers to be able to insert additional configuration files.