You can also easily run an ARP spoofing attack, and not just to sniff but also to manipulate. Done that quite often back in my school time, oh the glorious days when web traffic was mostly plain HTTP.

There were entire command lists going around specifying what exactly one needed to replace, say, the logo of an online newspaper with a picture of a dong.