skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-internal-network-pentesting

Guides internal network penetration testing from host discovery through NTLM relay attacks.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#responder#internal network#Active Directory#NTLM relay#mitm6#llmnr poisoning
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-internal-network-pentesting
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-internal-network-pentesting
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/penetration-testing/performing-internal-network-pentesting
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-internal-network-pentesting

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Once you have a foothold on an internal LAN during an authorized engagement, it is easy to miss high-value attack paths like LLMNR/NBT-NS poisoning and NTLM relay. This Skill provides a structured methodology so testers systematically discover hosts, capture credentials, and execute relay attacks instead of relying on ad-hoc commands.

Core Features & Use Cases

  • Host and Service Discovery: ARP sweeps, NetBIOS scans, broadcast pings, and full TCP/UDP port scanning with nmap and masscan.
  • Credential Capture: LLMNR/NBT-NS/mDNS poisoning with Responder to harvest NetNTLMv1/v2 hashes, plus passive sniffing with tcpdump and PCredz.
  • MitM and Relay Attacks: ARP/DNS/ICMP spoofing, mitm6 IPv6 takeover, and NTLM relay with ntlmrelayx against hosts without SMB signing.
  • Use Case: During an internal assessment, run Responder to capture a NetNTLMv2 hash, build a relay target list with CrackMapExec, and relay the authentication to an unsigned SMB host for command execution.

Quick Start

Ask the agent to perform an internal network pentest on the 10.10.20.0/24 subnet starting with host discovery and Responder poisoning.

Frequently Asked Questions about performing-internal-network-pentesting

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I capture NTLM hashes on an internal network?▼

Run Responder with 'responder -I eth0 -wv' to poison LLMNR, NBT-NS, and mDNS broadcast name resolution. When a Windows host queries an unresolvable name, it authenticates to you and the NetNTLMv2 hash is logged for offline cracking with hashcat -m 5600.

How to relay NTLM authentication instead of cracking it?▼

Use crackmapexec smb with --gen-relay-list to find hosts where SMB signing is not enforced, disable Responder's SMB and HTTP servers, then run ntlmrelayx.py -tf targets.txt -smb2support to relay captured authentication for SOCKS access or command execution.

What tools are needed for internal network pentesting?▼

The methodology uses nmap and masscan for scanning, netdiscover and nbtscan for L2 discovery, Responder for poisoning, Impacket ntlmrelayx for relay attacks, CrackMapExec for SMB enumeration, bettercap or arpspoof for MitM, and mitm6 for IPv6 takeover.

Does NTLM relay work when SMB signing is enabled?▼

No, relaying to SMB fails when the target enforces SMB signing because the relayed authentication cannot be validated. Use crackmapexec to identify hosts with signing disabled and target only those, or relay to other protocols like LDAP where applicable.

Why is mitm6 effective in Active Directory environments?▼

Windows prefers IPv6 by default, but most networks leave IPv6 unmanaged. mitm6 answers DHCPv6 requests to become the DNS server, then serves a rogue WPAD configuration that funnels authentication into ntlmrelayx for relay attacks against LDAP or SMB.

Related Skills

Explore More Software Engineering Skills→
rennerenne

internet-setup

Guide FRITZ!Box 7690 internet setup across DSL, VDSL, FTTH, and cable connections.

Community
Intermediate
bpnrockstarbpnrockstar

active-directory

Execute full-phased Active Directory penetration testing from network recon to domain dominance.

Community
Advanced
rahmatullahbossrahmatullahboss

Active Directory Attacks

Test Windows Active Directory security with reconnaissance, credential extraction, and Kerberos attacks.

Community
Advanced
AgentSecOpsAgentSecOps
183

recon-nmap

Perform authorized network reconnaissance with Nmap port scanning and service enumeration.

Official
Advanced