The Post-Connection Kill Chain

Free lesson 1 of 10 from Man-in-the-Middle & Post-Exploitation — Own the LAN after you're in — intercept traffic, land a payload, persist and pivot deep. No account, no card.

You're on the network. Now what?

Getting a foothold — cracking the WiFi, plugging into the LAN, landing on one box — is only the opening move. Real impact comes after: intercepting other people's traffic, planting a payload on a victim, surviving reboots, and stepping deeper toward the crown jewels. This course is the post-connection half of an engagement, taught the Mobile Security Lab way: read it, do it, prove it.

The classic ethical-hacking arc has four moves once you're on the wire:

  1. Man-in-the-Middle (MITM) — position yourself between a victim and their gateway (ARP spoofing), then read and rewrite their traffic (sniffing, DNS spoofing).
  2. Client-side delivery — when the server has no bug, attack the human: hand them a backdoor disguised as a file or a fake update.
  3. Post-exploitation — turn one shell into lasting control: persistence, keylogging, screenshots, credential loot.
  4. Pivoting — use the box you own as a springboard to networks you can't reach directly.

Every lesson ends with a defence section, because the point of learning the attack is to shut it down.

🧪 Your lab

Open the Live-Lab for this course. You land on an isolated Linux box on the 10.0.0.0/24 MegaCorp network with three neighbours you'll be attacking:

10.0.0.2   web01    intranet + admin panel (basic auth)
10.0.0.3   ssh01    SSH, weak credentials
10.0.0.4   cache01  Redis, password in a backup file

No internet reaches this net — everything you need is inside it. Installed and ready: nmap, tcpdump, tshark, dig/nslookup, sshpass, hydra, redis-cli, python3, ip/arp.

⚖️ Rules of engagement: MITM, backdoors and pivoting are only legal against systems you own or are explicitly authorised to test. The lab is your sandbox. Doing any of this on a network you don't have written permission for is a crime in every country that matters. Learn the technique here; use it only under a signed scope.
🎯 Challenge: From your lab box, confirm the three neighbours are alive and note which one answers on port 80. One command sweeps the whole subnet.
Show solution 
nmap -sn 10.0.0.0/24            # who's up
nmap -p80,22,6379 10.0.0.2-4   # what's listening
# web01(.2)=80 open, ssh01(.3)=22 open, cache01(.4)=6379 open

You now have the map. The rest of the course is about abusing what sits on those ports — starting by getting between the hosts.

Liked it? 9 more lessons are waiting.

10 lessons · knowledge checks · final exam · verifiable certificate · in-browser Live-Lab

Unlock all courses · CHF 9/month Buy only this course · CHF 19

What's in Man-in-the-Middle & Post-Exploitation

Continue in the interactive course reader →