Network › Module 5 › Lesson 1
What MITM Means on a Path
A middle box can read or change a hop — then stay on YOUR /:8794 path.
Visual · mitm_path_meaning
MITM = an unexpected participant on a path. Literacy only; Original Cyberlium.
Opening
Man-in-the-middle is not a movie hack. It is anyone sitting on a hop you did not intend.
Path integrity means the bytes you sent are the bytes the dest accepted, via hops you agreed to. A man-in-the-middle (MITM) is an extra participant: they can observe, delay, or alter if the path is cleartext or if trust is broken. The idea is older than Wi-Fi — operators, broken proxies, hostile networks, malware on YOUR PC. This module teaches literacy, not a cookbook for becoming the extra participant on a stranger’s LAN. ORIGINAL Cyberlium. as YOUR lab app.
1. A path is a list of hops, not a feeling of privacy
Client, maybe a proxy you configured, maybe a CDN, then the server. Each hop that can read cleartext is a potential extra participant. NAT boxes forward; they are not automatically readers of HTTP bodies, but a proxy that terminates HTTP is. Home routers are hops too — which is why GATE exists: if 192.168.0.1 is Router Admin, you do not “practice MITM” on it.
Write three hops for the teaching cartoon: curl → (optional YOUR loopback proxy :8784) → YOUR toy :8794. If the middle hop is missing, curl talks to 8794 directly. That list is the whole definition you need before TLS.
2. What an extra participant can do to cleartext
On HTTP without TLS, a hop that sees the bytes can log URLs, cookies, bodies, and can change them. That is the scary story. On YOUR loopback, the only extra participant you will ever start is a logger you wrote, fed by curl -x to YOUR dest. That is not “hacking the LAN.” It is watching your own homework.
Do not skip to tools that poison ARP so a roommate’s phone uses you as a gateway. That is the out-of-scope crime-shaped version of the same sentence. Literacy names the sentence; the lab uses 127.0.0.1.
Command guide
What an extra participant can do to cleartext
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Built-in (PowerShell: Invoke-WebRequest) Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
python3 - << 'PY'
import socket
for name, port in (("proxy_cartoon", 8784), ("toy", 8794)):
s = socket.socket(); s.settimeout(0.4)
r = s.connect_ex(("127.0.0.1", port))
s.close()
print(name, "127.0.0.1:%s" % port, "up" if r == 0 else "down")
print("cleartext hop can log if it sees HTTP; we only log OUR curl later")
PYCommand — copy this
curl -sS -m 2 -I "http://127.0.0.1:8794/" | head -n 10
3. Integrity is agreement, not invisibility
You will never make the internet have zero hops. You can make extra participants fail closed: TLS so they cannot read, pinning/trust so they cannot easily impersonate, and not installing stranger root CAs. Next lesson is TLS. This lesson is only the path cartoon and the ethics wall.
Never: ettercap, arpspoof, bettercap, hping3, nmap /24, 0.0.0.0 bind, café “research.” Notes chmod 600.
Command guide
Integrity is agreement, not invisibility
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Download https://python.org/downloads/
═══ COMMANDS ═══
Command — copy this
grep -i "never" "$HOME/cyberlium-lab/t11-m05-hops.txt"
python3 - << 'PY'
for ip in ("127.0.0.1", "127.0.0.1"):
if ip != "127.0.0.1":
raise SystemExit("refusing non-loopback path dest")
print("path dests ok 127.0.0.1:8784 -> 127.0.0.1:8794")
print("integrity: agreed hops, not zero hops")
PY4. What you ship: a hop list and an ethics wall, not a LAN impersonation kit
t11-m05-hops.txt names curl, optional 8784, toy 8794. DEMO GATE. ettercap/arpspoof refused in writing. No 0.0.0.0. No café research.
5. What you record before the next lesson
Date. MITM = extra participant. Path /:8794. DEMO identified/STOP. NEVER ettercap/arpspoof/nmap/0.0.0.0. File t11-m05-l01-what-mitm.txt chmod 600.
6. Wrong vs right: stranger networks vs literacy on systems you own
Worked failure — same network word, opposite target. Right never needs a café or campus LAN.
Wrong
ettercap the café. arpspoof a roommate. nmap /24 to find victims for “MITM class.” Bind a transparent proxy to 0.0.0.0.
Right
Name hops on loopback dests you own. Leave stranger paths. Next: Why TLS Changes the Story.
Mission: name YOUR hops without becoming someone else’s middle
1) / STOP if router. 2) Write curl → 8784 → 8794 as the cartoon path. 3) Write NEVER ettercap/arpspoof. Do not intercept a LAN. Do not bind 0.0.0.0.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor what “extra participant” means on a three-hop list — not how to ARP-spoof a dorm.
Knowledge Check
APPLY: curl http://192.168.0.1/ is Huawei Router Admin during “MITM class.” You:
Multiple choice
Knowledge Check
APPLY: True or False: MITM always requires a special attack tool; ordinary HTTP proxies cannot be extra participants.
True or False
Knowledge Check
APPLY: Which path is in scope for Cyberlium’s later proxy lab?
Multiple choice