Which tool did the hacker probably use to inject HTML code in the MITM attack?

• A. Wireshark
• B. Burp Suite
• C. Ettercap
• D. Nmap

Answer: (C)

When you’re talking about a MITM on a local network, the attacker places themselves between the victim and the destination so traffic can be seen and changed in transit. To inject HTML into the pages as they travel, you need a tool that can both position the attacker in the path and actively rewrite the intercepted traffic.

Ettercap is built for this kind of scenario on local networks. It can perform ARP poisoning (and other methods) to intercept traffic and then apply content filtering to modify the payloads, such as injecting HTML into HTTP responses as they pass through. This combination of network-positioning and in-flight traffic modification makes it the most suitable choice for HTML injection in a MITM attack.

Wireshark, by contrast, is a packet sniffer that captures traffic but does not alter it. Nmap is a network scanner used for discovery and enumeration. Burp Suite is a web proxy toolkit used for testing and modifying web app traffic, but it operates as a proxy rather than a network-wide MITM on the LAN, and it isn’t inherently used for injecting content across all traffic in the same broad MITM context.