MITM Attack using router

Knowing how attacks work is key to defending against them, Almost all good security people know exactly how to perform a attack.

You average consumer router is too stupid to do most things...they are not really router they are best called gateways because they pretty much translate 1 lan subnet to a single wan ip and not much else.

Still control the device all traffic is passing though you in effect own that traffic. You can make copies or change anything that is passing though the device. This is why you should never connect to a open unsecured wireless network and do anything that you really care if is attacked. You never really know who is running the device so you must assume it can be compromised by the owner of the device. This can easily be prevented by VPN or even HTTPS as long as you do not ignore the any certificate warnings.

Even if you do not own the device it is many times possible to attack the network if you have authorized access. There are a number of ways to do things like ARP poisons or mac table flooding to access data you should not have access to. Few if any home router prevent these types of attack because they are rare. Its not like you have a huge number of people you have given trusted access to your network that can attack it. Commercial stuff solves this with things like DHCP snooping and mac address limitation on the ports.

Secure wireless is only as secure as your passwords...and always disabling WPS. If you use good passwords and you tell few people the password you are likely very safe from any attack. Someone could use the same SSID as you and try to trick you into connecting to their AP instead but since they never have your password you will never connect. This is highly unlikely in the first place because end device will always connect to the strongest signal. Still if you really want to prevent it all you do is use the 802.1x feature in enterprise mode which uses certificates to validate both the client and the router wireless identities.

There is not magic command you can issue that will allow you "manually" do any of this. All involve some form of software even if it is just simple wireshark to be able to see data.

This is a very old and well known issue which is why most commercial equipment has features to prevent it. Simpler networks are subject to attack but in those cases you just use good end to end encryption techniques and they can attack it all they want.