The Toolkit
Sniffing & Spoofing
This category is about the wire itself. Sniffing is capturing and reading the traffic on a network — seeing what’s actually being sent, in what protocols, and often in the clear. Spoofing goes a step further: inserting yourself into the conversation, redirecting traffic through your machine so you can read, modify, or poison it — the classic man-in-the-middle. Together they turn a network you’re merely connected to into one you can observe and manipulate.
| Tool | Source | What it’s for |
|---|---|---|
| wireshark | official | The definitive graphical packet analyzer. |
| ettercap | official | Classic man-in-the-middle suite with ARP poisoning. |
| bettercap | official | The modern, modular MITM and network-attack Swiss Army knife. |
| responder | AUR | Poison LLMNR/NBT-NS/mDNS to capture Windows credentials. |
All live under Security → Sniffing & Spoofing.