It comes up on almost every internal engagement scoping call eventually: "we don't really need man-in-the-middle testing, everything internal runs over HTTPS." It's said with confidence, and it's usually true at the application layer. It's also the wrong reason to skip the test, because ARP spoofing doesn't care what's happening at layer 7.
ARP spoofing works at layer 2. Send out forged ARP replies telling the switch and the target that your machine's MAC address is the gateway's, and traffic starts routing through you regardless of what protocol the application thinks it's speaking. HTTPS being correctly configured on the main web app has nothing to say about the printer on the same subnet still authenticating over plaintext SNMP, the internal admin panel that was set up in a hurry and never got a real certificate so everyone just clicks through the browser warning, or the legacy service two teams forgot still exists that happily serves an HTTP fallback if the client doesn't force a redirect.
Once traffic is actually flowing through the attacker's machine, the interesting part isn't intercepting the HTTPS traffic itself, it's everything HTTPS was never protecting in the first place: DNS queries, which are still plaintext by default on most internal networks and can be spoofed to point a legitimate-looking login page at a clone; NTLM or Kerberos traffic if there's a captive portal or legacy auth flow in the mix; and the handful of internal tools that "everyone knows" aren't public-facing so nobody ever got around to putting a real cert on them.
None of this requires breaking TLS. It requires being on the same segment as the target and asking the network layer to lie, which most internal networks will still do without complaint because ARP has no built-in authentication. That's the actual finding worth writing up: not "we cracked HTTPS," but "here is the cleartext traffic and the unpinned certs an attacker on this network segment would have caught within an hour, and here is what the client's own scoping call assumed away."
This is exactly the gap Codelivly's Man-in-the-Middle Attack Book is built to close: ARP and DNS spoofing, evil-twin setups, and SSL interception, hands-on, the layer-2 and layer-3 attacks that "we use HTTPS" was never actually an answer to.
