network-attack
Network Attack covers layer-2 and layer-3 poisoning (LLMNR, ARP, DHCPv6), NTLM relay with coercion, traffic interception, and network-service exploitation for lateral movement. It includes TUN-based pivoting with tools like Ligolo-ng and Chisel, plus wireless assessment for WPA2/WPA3. Hand off AD-specific relay work and Kerberos attacks to the active-directory-attack skill.
Network Attack executes lateral movement, credential capture, and pivoting across internal networks using L2/L3 poisoning, relay attacks, and tunneling.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-03
Network Attack executes lateral movement, credential capture, and pivoting across internal networks using L2/L3 poisoning, relay attacks, and tunneling. Network Attack covers layer-2 and layer-3 poisoning (LLMNR, ARP, DHCPv6), NTLM relay with coercion, traffic interception, and network-service exploitation for lateral movement. It includes TUN-based pivoting with tools like Ligolo-ng and Chisel, plus wireless assessment for WPA2/WPA3. Hand off AD-specific relay work and Kerberos attacks to the active-directory-attack skill.
Use it when
- Network Attack executes NTLM relay and coercion-based exploitation on internal networks through responder-based LLMNR poisoning.
- Network Attack establishes pivots and tunnels across network segments using tools like Ligolo-ng (TUN-based), Chisel (SSH reverse proxy).
Verify before relying
Read SKILL.md below before installing (15 files). Open directory: indexed for reading, not audited.
Install
hypnguyen1209/offensive-claude/network-attack · repository language: Python
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What network attack lateral movement tools does network-attack cover?
Network Attack provides layer-2 and layer-3 poisoning techniques (LLMNR, ARP, DHCPv6), NTLM relay with coercion-based exploitation, and traffic interception methods. It includes TUN-based pivoting tools like Ligolo-ng and Chisel for establishing pivots across network segments, plus wireless assessment capabilities for WPA2/WPA3 credential capture. For Active Directory–specific relay work and Kerberos attacks, refer to the active-directory-attack skill.
How does network-attack perform NTLM relay and SMB exploitation?
Network Attack executes NTLM relay and coercion-based exploitation on internal networks through responder-based LLMNR poisoning, ntlmrelayx relay chains, and coercion techniques like PetitPotam and PrinterBug. These methods capture credentials and relay them across SMB and other protocols to achieve lateral movement and remote code execution on target systems within the network segment.
What pivoting and tunneling capabilities are in network-attack?
Network Attack establishes pivots and tunnels across network segments using tools like Ligolo-ng (TUN-based), Chisel (SSH reverse proxy), and DNS tunneling (iodine, dnscat2). These enable traffic forwarding through compromised hosts to reach isolated network zones and maintain persistent access across segmented infrastructure.
Can network-attack exploit wireless networks and capture WPA2/WPA3?
Network Attack includes wireless assessment for WPA2/WPA3 credential capture and exploitation. It covers evil twin attacks, 802.1X attacks, and WPA-Enterprise assessment. For comprehensive wireless penetration testing, network-attack provides the tools and techniques to identify and exploit wireless network vulnerabilities.
How does network-attack identify and exploit network service vulnerabilities?
Network Attack identifies and exploits network service vulnerabilities for remote code execution through techniques targeting MSSQL (xp_cmdshell), WinRM abuse, RDP/SSH downgrade attacks, and known CVEs like EternalBlue (MS17-010). It enables reconnaissance of internal network services and systematic exploitation for lateral movement and privilege escalation.
What does network-attack cover for ARP spoofing and MitM attacks?
Network Attack covers ARP spoofing, VLAN hopping (DTP, 802.1Q), and man-in-the-middle interception using tools like bettercap and sslstrip. These layer-2 techniques enable traffic capture, credential harvesting, and session hijacking across network segments for internal network penetration testing.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
name: network-attack description: Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless metadata: type: offensive phase: exploitation tools: responder, mitm6, impacket, ntlmrelayx, netexec, bettercap, ligolo-ng, chisel, scapy, hcxdumptool, eaphammer, hashcat, certipy mitre: TA0008 kill_chain: phase: [recon, exploit, actions] step: [1, 4, 7] attck_tactics: [TA0043, TA0008, TA0007, TA0006, TA0011] attck_techniques: [T1557, T1557.001, T1557.003, T1187, T1040, T1210, T1090, T1090.001, T1090.002, T1572, T1071.004, T1021.006, T1599, T1110, T1556] depends_on: [recon-osint] feeds_into: [active-directory-attack, privesc-linux, privesc-windows, advanced-redteam] inputs: [network_map, service_list, foothold_position] outputs: [lateral_movement_path, compromised_hosts, captured_hashes, relay_targets, pivot_routes] references: - references/l2-attacks.md - references/coercion-relay-network.md - references/pivoting-tunneling.md - references/mitm-interception.md -
(truncated - see the full file via the links below)
File tree — 15 files
skills/network-attack/SKILL.md
skills/network-attack/references/coercion-relay-network.md
skills/network-attack/references/l2-attacks.md
skills/network-attack/references/mitm-interception.md
skills/network-attack/references/pivoting-tunneling.md
skills/network-attack/references/protocol-rce.md
skills/network-attack/references/wireless-attacks.md
skills/network-attack/scripts/bettercap_mitm.sh
skills/network-attack/scripts/mitm6_relay_launcher.sh
skills/network-attack/scripts/net_service_scan.py
skills/network-attack/scripts/pivot_autoroute.sh
skills/network-attack/scripts/relay_target_finder.py
skills/network-attack/scripts/responder_loot_parser.py
skills/network-attack/scripts/vlan_hop.py
skills/network-attack/scripts/wifi_attack.sh
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Execute network-based lateral movement and credential capture attacks”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
Network Protocol Attacks provides hands-on techniques for exploiting layer 2 and layer 3 protocols to establish man-in-the-middle positions and capture credentials. Covers ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion with practical tool workflows and relay chaining.
Master NTLM relay attacks to capture and forward authentication across multiple protocols for privilege escalation. Learn relay targets, signing requirements, Responder poisoning, ntlmrelayx execution, mitm6 DNS takeover, and cross-protocol techniques including WebDAV coercion to bypass defenses.
Auth Coercion Relay guides penetration testers through forcing authentication from remote systems via coercion techniques like PetitPotam and PrinterBug, then relaying those credentials through NTLM or Kerberos to escalate privileges or move laterally. It covers relay targets (SMB, LDAP, AD CS), feasibility checks, and both credential capture and exploitation paths.
Orchestrate post-compromise domain exploitation through Kerberos attacks, coercion-relay chains, certificate template abuse, and BloodHound-guided lateral movement. Covers roasting, delegation abuse, NTLM reflection, ADCS ESC variants, ticket forgery, DCSync, and dMSA BadSuccessor attacks with integrated OPSEC and detection guidance.
Master network tunneling and pivoting techniques to access internal systems from compromised hosts. This skill covers SSH port forwarding, reverse SOCKS proxies via Chisel, transparent TUN-based pivoting with Ligolo-ng, socat relays, DNS/ICMP/HTTP tunneling, ProxyChains configuration, Windows pivoting methods, and multi-layer chaining strategies.
This skill guides you through pivoting and tunneling strategies to reach internal networks from a compromised host during authorized penetration tests. It covers SSH port forwarding, SOCKS proxies, and specialized tools like Chisel, Ligolo-ng, and sshuttle, with a decision tree to select the right approach based on available access and network constraints.
More skills crypto-analysis (MIT) · networking (MIT) · threat-hunting (MIT) · active-directory-attacks (MIT) · privilege-escalation-methods (MIT)