| name | network-attack |
| description | Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless |
| metadata | {"type":"offensive","phase":"exploitation","tools":"responder, mitm6, impacket, ntlmrelayx, netexec, bettercap, ligolo-ng, chisel, scapy, hcxdumptool, eaphammer, hashcat, certipy","mitre":"TA0008"} |
| kill_chain | {"phase":["recon","exploit","actions"],"step":[1,4,7],"attck_tactics":["TA0043","TA0008","TA0007","TA0006","TA0011"],"attck_techniques":["T1557","T1557.001","T1557.003","T1187","T1040","T1210","T1090","T1090.001","T1090.002","T1572","T1071.004","T1021.006","T1599","T1110","T1556"]} |
| depends_on | ["recon-osint"] |
| feeds_into | ["active-directory-attack","privesc-linux","privesc-windows","advanced-redteam"] |
| inputs | ["network_map","service_list","foothold_position"] |
| outputs | ["lateral_movement_path","compromised_hosts","captured_hashes","relay_targets","pivot_routes"] |
| references | ["references/l2-attacks.md","references/coercion-relay-network.md","references/pivoting-tunneling.md","references/mitm-interception.md","references/protocol-rce.md","references/wireless-attacks.md"] |
| scripts | ["scripts/responder_loot_parser.py","scripts/mitm6_relay_launcher.sh","scripts/vlan_hop.py","scripts/relay_target_finder.py","scripts/pivot_autoroute.sh","scripts/bettercap_mitm.sh","scripts/net_service_scan.py","scripts/wifi_attack.sh"] |
