An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML code to embed a malicious applet in all HTTP connections. When users accessed any page, the applet ran and…

Wireshark is a passive read-only packet analyzer and cannot intercept, modify, or inject data into live network traffic.

Ettercap is a full-featured MITM framework that supports real-time traffic interception and content filtering via its plugin and filter system (etterfilter). An attacker can write custom filters to match HTTP responses and inject arbitrary HTML or JavaScript - such as a malicious applet tag - into every page served over unencrypted HTTP connections, making it the standard tool for this attack type.

Aircrack-ng is a wireless auditing suite focused on capturing handshakes and cracking WEP/WPA keys, with no capability to inject HTML into HTTP sessions.

Tcpdump is a command-line packet capture tool used for traffic analysis only and has no functionality to alter or inject content into packets.