network-attack

name	network-attack
description	Use when attacking a network or moving laterally — L2/L3 poisoning (LLMNR/mDNS, ARP/DHCP, mitm6), coercion + NTLM relay (CVE-2025-33073), TUN pivoting (Ligolo-ng/Chisel), MitM, network-service RCE (CVE-2024-38077), WPA2/WPA3 wireless
metadata	{"type":"offensive","phase":"exploitation","tools":"responder, mitm6, impacket, ntlmrelayx, netexec, bettercap, ligolo-ng, chisel, scapy, hcxdumptool, eaphammer, hashcat, certipy","mitre":"TA0008"}
kill_chain	{"phase":["recon","exploit","actions"],"step":[1,4,7],"attck_tactics":["TA0043","TA0008","TA0007","TA0006","TA0011"],"attck_techniques":["T1557","T1557.001","T1557.003","T1187","T1040","T1210","T1090","T1090.001","T1090.002","T1572","T1071.004","T1021.006","T1599","T1110","T1556"]}
depends_on	["recon-osint"]
feeds_into	["active-directory-attack","privesc-linux","privesc-windows","advanced-redteam"]
inputs	["network_map","service_list","foothold_position"]
outputs	["lateral_movement_path","compromised_hosts","captured_hashes","relay_targets","pivot_routes"]
references	["references/l2-attacks.md","references/coercion-relay-network.md","references/pivoting-tunneling.md","references/mitm-interception.md","references/protocol-rce.md","references/wireless-attacks.md"]
scripts	["scripts/responder_loot_parser.py","scripts/mitm6_relay_launcher.sh","scripts/vlan_hop.py","scripts/relay_target_finder.py","scripts/pivot_autoroute.sh","scripts/bettercap_mitm.sh","scripts/net_service_scan.py","scripts/wifi_attack.sh"]

Network Attack & Lateral Movement

When to Activate

• Internal network pentest from an unauthenticated wire position or initial foothold
• Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6)
• Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2025-33073 reflection)
• Pivoting / tunneling across segments (Ligolo-ng, Chisel, SSH, DNS tunneling)
• Traffic interception / MitM (bettercap, RDP/SSH/STARTTLS downgrade, cookie theft)
• Network-service exploitation (SMB/RDP/RDL/NEGOEX RCE, MSSQL/WinRM/LDAP abuse)
• Wireless assessment (WPA2 capture/crack, WPA3-Transition downgrade, evil-twin 802.1X)
• For AD-specific relay targets (LDAP RBCD/shadow-creds, ADCS ESC8, Kerberos relay) and ticket/DCSync work, hand off to active-directory-attack.

Technique Map

Technique	ATT&CK	CWE	Reference	Script
LLMNR/NBT-NS/mDNS poisoning (Responder)	T1557.001	CWE-300	references/l2-attacks.md	scripts/responder_loot_parser.py
ARP spoofing MitM	T1557.002	CWE-300	references/l2-attacks.md	scripts/bettercap_mitm.sh
DHCP starvation / rogue DHCP	T1557.003	CWE-300	references/l2-attacks.md	-
IPv6 takeover (mitm6 DHCPv6/DNS → relay)	T1557.001	CWE-300	references/l2-attacks.md	scripts/mitm6_relay_launcher.sh
STP root hijack / VLAN hopping (DTP, 802.1Q)	T1599	CWE-284	references/l2-attacks.md	scripts/vlan_hop.py
Coercion (PetitPotam/PrinterBug/DFSCoerce/WebDAV)	T1187	CWE-294	references/coercion-relay-network.md	scripts/relay_target_finder.py
NTLM relay (SMB/MSSQL/WinRM)	T1557.001	CWE-294	references/coercion-relay-network.md	scripts/relay_target_finder.py
NTLM reflection → SYSTEM (CVE-2025-33073)	T1187, T1557.001	CWE-287	references/coercion-relay-network.md	scripts/relay_target_finder.py