Agent skill · security · yaklang
network-protocol-attacks
Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.
Why this skill is useful
Adds executable scripts and detailed workflows for exploiting network protocol vulnerabilities that aren't commonly known or documented.
What it needs
Requires bettercap, dsniff, ettercap, hashcat, john installed locally. About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Network Protocol Attacks — Expert Attack Playbook AI LOAD INSTRUCTION: Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT-NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation. 0. RELATED ROUTING Before going deep, consider loading: tunneling-and-pivoting after establishing MitM position for traffic redirection ntlm-relay-coercion for relaying captured NTLM hashes from poisoning attacks unauthorized-access-common-services for exploiting services discovered during network attacks traffic-analysis-pcap for analyzing captured traffic from MitM Advanced Reference Also load NAMERESOLUTIONPOISONING.md when you need: Detailed Responder/mitm6 configuration and workflows NTLM relay target selection and chaining Credential format analysis and cracking priorities --- 1. ARP SPOOFING Gratuitous ARP — MitM Positioning Selective Targeting Detection Indicators Duplicate MAC addresses in ARP table Gratuitous ARP storms from non-gateway IPs Tools: arpwatch, static ARP entries, 802.1X port authentication --- 2. LLMNR / NBT-NS / mDNS POISONING Responder — Credential Capture Captured Hash Formats Protocol Hash Type Hashcat Mode Crackability --- --- --- --- NTLMv1 NetNTLMv1 5500 Fast — rainbow tables viable NTLMv2 NetNTLMv2 5600 Moderate — dictionary + rules NTLMv1-ESS NetNTLMv1 5500 Fast — same as NTLMv1 Relay Instead of Crack --- 3. WPAD ABUSE Manual WPAD PAC File --- 4. DHCPv6 ATTACK — mitm6 Even on IPv4-only networks, Windows clients send DHCPv6 solicitations by default. Key Conditions SMB signing disabled on targets (for SMB relay) LDAP signing not enforced on DC (for LDAP relay) Domain Computers quota > 0 (for machine account creation, default: 10) --- 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/network-protocol-attacks