One utility that is used to see images captured during a man-in-the-middle attack is a program called Driftnet. There are better ways to find more interesting data; however, driftnet can be useful if you are focusing on viewing images. Driftnet does not come preinstalled on Kali Linux ARM. You can download it by using the apt-get install driftnet command.

Once installed, use the driftnet –i eth0 command to run it. This will open up a new terminal window that will be blank. Any images seen by a victim during the man-in-the-middle attack will start populating in this window. The following screenshot shows a host accessing www.cisco.com while driftnet is capturing images: