Verified:GitHub

network-sniffing-mitm

Name: network-sniffing-mitm
Availability: InStock
Author: brucesongs

Capture and analyze network traffic to identify weaknesses in internal communications and demonstrate MITM risks using Linux tools.

60|14|Updated Apr 27, 2026

Search Tags:#mitm #pentest #tshark #security-testing #tcpdump #arp-spoofing #network-sniffing

Ready to run

npx skills add https://github.com/brucesongs/kali-claw --skill network-sniffing-mitm

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: network-sniffing-mitm
Source: https://github.com/brucesongs/kali-claw/tree/main/skills/network-sniffing-mitm
Command: npx skills add https://github.com/brucesongs/kali-claw --skill network-sniffing-mitm

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Capture and analyze network traffic to identify weaknesses in internal communications and demonstrate MITM risks.

Core Features & Use Cases

Passive capture and protocol analysis with tcpdump and tshark
Active MITM positioning via ARP spoofing, IPv6 mitm6, and DNS spoofing
Traffic manipulation and credential harvesting with bettercap, Responder, dnsspoof, and mitmproxy
Ethical guidelines, safety checks, and thorough cleanup

Quick Start

Initiate an active MITM workflow against a test network to demonstrate traffic interception and credential harvesting.

Frequently Asked Questions about network-sniffing-mitm

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I capture and analyze network traffic to demonstrate MITM risks?▼

To capture network traffic and demonstrate MITM risks, use passive analysis tools like tcpdump and tshark for protocol inspection, and active tools like bettercap for ARP spoofing. This combination reveals internal communication weaknesses during permitted security assessments.

What is the best way to perform ARP spoofing and DNS spoofing for internal network assessments?▼

The best approach for ARP spoofing and DNS spoofing in internal network assessments uses bettercap, ettercap, and dnsspoof to actively position your machine as a man-in-the-middle. This allows traffic manipulation and credential harvesting in a controlled testing environment.

Does network sniffing with bettercap and mitmproxy work for red-team exercises?▼

Bettercap and mitmproxy are fully compatible with red-team exercises, providing active MITM positioning, SSL stripping, and credential harvesting capabilities. They effectively identify and demonstrate internal communication weaknesses during security testing.

Can I use tshark and Responder for credential harvesting in security training scenarios?▼

Tshark and Responder are effective for credential harvesting in security training scenarios. Tshark performs passive protocol analysis while Responder actively manipulates traffic to capture credentials, demonstrating MITM risks during internal network assessments.

Do I need a permitted testing environment to run IPv6 mitm6 and SSL stripping?▼

Running IPv6 mitm6 and SSL stripping requires a permitted testing environment and compatible Linux tools. Ethical guidelines, safety checks, and thorough cleanup are mandatory to prevent unauthorized disruption during internal network assessments.