network-attack
Network Attack covers layer-2 and layer-3 poisoning (LLMNR, ARP, DHCPv6), NTLM relay with coercion, traffic interception, and network-service exploitation for lateral movement. It includes TUN-based pivoting with tools like Ligolo-ng and Chisel, plus wireless assessment for WPA2/WPA3. Hand off AD-specific relay work and Kerberos attacks to the active-directory-attack skill.
Network Attack executes lateral movement, credential capture, and pivoting across internal networks using L2/L3 poisoning, relay attacks, and tunneling.
AI-generated summary based on this skill's SKILL.md
Install
hypnguyen1209/offensive-claude/network-attack · repository language: Python
git clone https://github.com/hypnguyen1209/offensive-claude
cp -r offensive-claude/skills/network-attack ~/.claude/skills/network-attacknpx skillfed install hypnguyen1209/offensive-claude/network-attackFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What network attack lateral movement tools does network-attack cover?
Network Attack provides layer-2 and layer-3 poisoning techniques (LLMNR, ARP, DHCPv6), NTLM relay with coercion-based exploitation, and traffic interception methods. It includes TUN-based pivoting tools like Ligolo-ng and Chisel for establishing pivots across network segments, plus wireless assessment capabilities for WPA2/WPA3 credential capture. For Active Directory–specific relay work and Kerberos attacks, refer to the active-directory-attack skill.
How does network-attack perform NTLM relay and SMB exploitation?
Network Attack executes NTLM relay and coercion-based exploitation on internal networks through responder-based LLMNR poisoning, ntlmrelayx relay chains, and coercion techniques like PetitPotam and PrinterBug. These methods capture credentials and relay them across SMB and other protocols to achieve lateral movement and remote code execution on target systems within the network segment.
What pivoting and tunneling capabilities are in network-attack?
Network Attack establishes pivots and tunnels across network segments using tools like Ligolo-ng (TUN-based), Chisel (SSH reverse proxy), and DNS tunneling (iodine, dnscat2). These enable traffic forwarding through compromised hosts to reach isolated network zones and maintain persistent access across segmented infrastructure.
Can network-attack exploit wireless networks and capture WPA2/WPA3?
Network Attack includes wireless assessment for WPA2/WPA3 credential capture and exploitation. It covers evil twin attacks, 802.1X attacks, and WPA-Enterprise assessment. For comprehensive wireless penetration testing, network-attack provides the tools and techniques to identify and exploit wireless network vulnerabilities.
How does network-attack identify and exploit network service vulnerabilities?
Network Attack identifies and exploits network service vulnerabilities for remote code execution through techniques targeting MSSQL (xp_cmdshell), WinRM abuse, RDP/SSH downgrade attacks, and known CVEs like EternalBlue (MS17-010). It enables reconnaissance of internal network services and systematic exploitation for lateral movement and privilege escalation.
What does network-attack cover for ARP spoofing and MitM attacks?
Network Attack covers ARP spoofing, VLAN hopping (DTP, 802.1Q), and man-in-the-middle interception using tools like bettercap and sslstrip. These layer-2 techniques enable traffic capture, credential harvesting, and session hijacking across network segments for internal network penetration testing.
SKILL.md
rendered from the published skill — quoted content, verbatim
name: network-attack description: Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless metadata: type: offensive phase: exploitation tools: responder, mitm6, impacket, ntlmrelayx, netexec, bettercap, ligolo-ng, chisel, scapy, hcxdumptool, eaphammer, hashcat, certipy mitre: TA0008 kill_chain: phase: [recon, exploit, actions] step: [1, 4, 7] attck_tactics: [TA0043, TA0008, TA0007, TA0006, TA0011] attck_techniques: [T1557, T1557.001, T1557.003, T1187, T1040, T1210, T1090, T1090.001, T1090.002, T1572, T1071.004, T1021.006, T1599, T1110, T1556] depends_on: [recon-osint] feeds_into: [active-directory-attack, privesc-linux, privesc-windows, advanced-redteam] inputs: [network_map, service_list, foothold_position] outputs: [lateral_movement_path, compromised_hosts, captured_hashes, relay_targets, pivot_routes] references: - references/l2-attacks.md - references/coercion-relay-network.md - references/pivoting-tunneling.md - references/mitm-interception.md -
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 15 files
skills/network-attack/SKILL.md
skills/network-attack/references/coercion-relay-network.md
skills/network-attack/references/l2-attacks.md
skills/network-attack/references/mitm-interception.md
skills/network-attack/references/pivoting-tunneling.md
skills/network-attack/references/protocol-rce.md
skills/network-attack/references/wireless-attacks.md
skills/network-attack/scripts/bettercap_mitm.sh
skills/network-attack/scripts/mitm6_relay_launcher.sh
skills/network-attack/scripts/net_service_scan.py
skills/network-attack/scripts/pivot_autoroute.sh
skills/network-attack/scripts/relay_target_finder.py
skills/network-attack/scripts/responder_loot_parser.py
skills/network-attack/scripts/vlan_hop.py
skills/network-attack/scripts/wifi_attack.sh