Network protocol attack playbook. Use when exploiting layer 2/3 protocols including ARP spoofing, LLMNR/NBT-NS/mDNS poisoning, WPAD abuse, DHCPv6 attacks, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion.

SKILL: Network Protocol Attacks — Expert Attack Playbook AI LOAD INSTRUCTION : Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation. 0. RELATED ROUTING Before going deep, consider loading: [tunneling and pivoting](../tunneling and pivoting/SKILL.md) after establishing MitM position for traffic redirection [ntlm relay coercion](../ntlm relay coercion/SKILL.md) for relaying captured NTLM hashes from poisoning attacks [unauthorized access common services](../unauthorized access common services/SKILL.md) for exploiting services discovered during network attacks [traffic analysis pcap](../traffic analysis pcap/SKILL.md) for analyzing captured traffic from MitM Advanced Reference Also load [NAME RESOLUTION POISONING.md](./NAME RESOLUTION POISONING.md) when you need: Detailed Responder/mitm6 configuration and workflows NTLM relay target selection and chaining Credential format analysis and cracking priorities 1. ARP SPOOFING Gratuitous ARP — MitM Positioning Selective Targeting Detection Indicators Duplicate MAC addresses in ARP table Gratuitous ARP storms from non gateway IPs Tools: arpwatch , static ARP entries, 802.1X port authentication 2. LLMNR / NBT NS / mDNS POISONING Responder — Credential Capture Captured Hash Formats Protocol Hash Type Hashcat Mode Crackability NTLMv1 NetNTLMv1 5500 Fast — rainbow tables viable NTLMv2 NetNTLMv2 5600 Moderate — dictionary + rules NTLMv1 ESS NetNTLMv1 5500 Fast — same as NTLMv1 Relay Instead of Crack 3. WPAD ABUSE Manual WPAD PAC File 4. DHCPv6 ATTACK — mitm6 Even on IPv4 only networks, Windows clients send DHCPv6 solicitations by default. Key Conditions SMB signing disabled on targets (for SMB relay) LDAP signing not enforced on DC (for LDAP relay) Domain Computers quota 0 (for machine account creation, default: 10) 5. VLAN HOPPING Switch Spoofing (DTP) Double Tagging (802.1Q) Mitigation Disable DTP: switchport nonegotiate Set native VLAN to unused: switchport trunk native vlan 999 Prune VLANs: only allow needed VLANs on trunk ports 6. STP MANIPULATION Root Bridge Claim Topology Change Attack Mitigation BPDU Guard on access ports Root Guard on designated ports spanning tree portfast bpduguard enable 7. DNS SPOOFING DNS Cache Poisoning Kaminsky Attack Variant Flood recursive resolver with forged responses for random subdomains, each including a malicious authority section pointing the NS record to attacker controlled server. 8. IPv6 ATTACKS Router Advertisement Spoofing SLAAC Abuse 9. IDS/IPS EVASION Technique Method Tool/Flag IP Fragmentation Split payload across fragments nmap f , fragroute TTL Manipulation Set TTL to expire at IDS but reach target fragroute Encoding Evasion URL/Unicode/hex encoding Manual, custom scripts Session Splicing Split TCP payload across segments fragroute , nmap data length Timing Based Slow scan to avoid rate based detection nmap T0 , nmap T1 Decoy Scanning Mix real scan with decoy source IPs nmap D RND:10 Idle/Zombie Scan Use idle host as scan proxy nmap sI ZOMBIE IP 10. DECISION TREE

network-protocol-attacks