An attacker, using a rogue wireless AP, performed an MITM attack and injected an HTML code to embed a malicious applet in all HTTP connections. When users accessed any page, the applet ran and…

Wireshark is a passive packet capture and analysis tool; it cannot inject or modify traffic.

Ettercap supports content filtering plugins that allow an attacker to intercept HTTP sessions and inject or replace HTML content on the fly, making it the tool of choice for this type of MITM HTTP injection attack. When combined with a rogue AP to position the attacker in the traffic path, Ettercap can rewrite response bodies before they reach the victim's browser. This makes it uniquely suited for embedding malicious Java applets or scripts into otherwise legitimate web pages.

Aircrack-ng is a wireless network security auditing suite focused on cracking WEP/WPA keys, not on injecting content into HTTP sessions.

Tcpdump is a command-line packet capture tool used for traffic inspection only; it has no capability to modify or inject data into network streams.