network-protocol-attacks

ARP spoofing for penetration testing positions a machine-in-the-middle using tools like arpspoof, ettercap, and bettercap to intercept layer 2 network traffic. It enables traffic interception and credential capture during red team engagements.

LLMNR and NBT-NS poisoning captures NTLMv2 hashes by spoofing name resolution protocols with Responder. It intercepts broadcast queries when a target requests a non-existent host, forcing authentication against the attacker's listener.

DNS cache spoofing poisons resolver records to redirect targets to attacker-controlled domains. It manipulates layer 3 traffic to achieve DNS control, allowing redirection of application requests to malicious infrastructure.

IPv6 router advertisement spoofing and SLAAC abuse are covered explicitly. These attacks broadcast rogue IPv6 router advertisements to assign malicious DNS servers or default gateways to targets lacking proper IPv6 configuration.

IDS and IPS evasion during layer 2 and 3 attacks uses IP fragmentation and timing-based attacks to bypass network defenses. These techniques split or delay malicious packets to avoid signature matching and traffic inspection.

VLAN hopping and STP manipulation are needed to bypass network segmentation and disrupt layer 2 topology. They exploit switch configuration flaws and spanning tree protocol operations to access isolated VLANs or cause traffic redirection.