network-attack

Featured

Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless

AI & Automation 382 stars 66 forks Updated 5 days ago MIT

Install

View on GitHub

Quality Score: 95/100

Stars 20%
86
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
80
License 10%
100
Description 5%
100

Skill Content

# Network Attack & Lateral Movement ## When to Activate - Internal network pentest from an unauthenticated wire position or initial foothold - Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6) - Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2025-33073 reflection) - Pivoting / tunneling across segments (Ligolo-ng, Chisel, SSH, DNS tunneling) - Traffic interception / MitM (bettercap, RDP/SSH/STARTTLS downgrade, cookie theft) - Network-service exploitation (SMB/RDP/RDL/NEGOEX RCE, MSSQL/WinRM/LDAP abuse) - Wireless assessment (WPA2 capture/crack, WPA3-Transition downgrade, evil-twin 802.1X) - For AD-specific relay targets (LDAP RBCD/shadow-creds, ADCS ESC8, Kerberos relay) and ticket/DCSync work, hand off to `active-directory-attack`. ## Technique Map | Technique | ATT&CK | CWE | Reference | Script | |-----------|--------|-----|-----------|--------| | LLMNR/NBT-NS/mDNS poisoning (Responder) | T1557.001 | CWE-300 | references/l2-attacks.md | scripts/responder_loot_parser.py | | ARP spoofing MitM | T1557.002 | CWE-300 | references/l2-attacks.md | scripts/bettercap_mitm.sh | | DHCP starvation / rogue DHCP | T1557.003 | CWE-300 | references/l2-attacks.md | - | | IPv6 takeover (mitm6 DHCPv6/DNS → relay) | T1557.001 | CWE-300 | references/l2-attacks.md | scripts/mitm6_relay_launcher.sh | | STP root hijack / VLAN hopping (DTP, 802.1Q) | T1599 | CWE-284 | references/l2-attacks.md | scripts/vlan_hop.py | | Coercion (PetitPotam/P...

Details

Author
hypnguyen1209
Repository
hypnguyen1209/offensive-claude
Created
4 months ago
Last Updated
5 days ago
Language
Python
License
MIT

Bundled in these plugins

offensive-claude

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Listed

network-protocol-attacks

Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.

12 Updated today
SecurityTalent
AI & Automation Featured

offensive-network-attacks

Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing Layer 2/3 attack surface.

6,950 Updated 6 days ago
SnailSploit
Testing & QA Featured

offensive-lateral-movement

Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.

6,950 Updated 6 days ago
SnailSploit