network-protocol-attacks

LLMNR and NBT-NS poisoning intercepts name resolution requests to capture NTLM hashes. You can configure Responder to trigger authentication workflows and record NetNTLM hashes for downstream cracking or relay attacks.

Yes, mitm6 enables DHCPv6 takeover to redirect victim name resolution to a rogue endpoint. This induces forced NTLM authentication over IPv6, facilitating WPAD abuse and credential relay on Windows domains.

Cracking attempts to recover plaintext passwords from NetNTLM hashes offline, while relaying passes the hash directly to target systems for immediate access. Select relay targets by evaluating signing requirements and analyzing hash formats.

IDS evasion during NTLM relay chaining requires coordinating post-capture actions to avoid detection. The skill provides decision logic to manipulate network protocols and execute attacks while minimizing intrusion detection system alerts.

ARP spoofing positions a Man-in-the-Middle to intercept traffic across enterprise protocols. This enables credential capture by poisoning name resolution and forcing authentication over common network protocols.

Executing a network protocol attack requires operator-provided target information and context. You must coordinate documented tools and configuration logic to poison name resolution on the same broadcast segment.