Network Attack

This is your toolkit for moving through a compromised network once you have that initial foothold. It handles the full lateral movement playbook: Kerberos attacks like AS-REP roasting and Kerberoasting, NTLM relay chains to LDAP for shadow credentials or RBCD, Active Directory enumeration with BloodHound, and pivoting with tools like Ligolo-ng and Chisel. The NTLM relay section is especially thorough, covering relays to ADCS for certificate theft and MSSQL for command execution. It also includes wireless attacks and protocol-level MitM work with Bettercap. You'd reach for this during internal pentests or red team engagements when you need to escalate from one compromised host to domain admin. The command examples are practical and ready to adapt.

GitHub stars: 280
last updated: May 28, 2026

View on GitHub

Install

$ npx -y skills add hypnguyen1209/offensive-claude --skill network-attack --agent claude-code

Installs into .claude/skills of the current project.

Files

Network Attack & Lateral Movement

When to Activate

Internal network pentest from an unauthenticated wire position or initial foothold
Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6)
Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2025-33073 reflection)
Pivoting / tunneling across segments (Ligolo-ng, Chisel, SSH, DNS tunneling)
Traffic interception / MitM (bettercap, RDP/SSH/STARTTLS downgrade, cookie theft)
Network-service exploitation (SMB/RDP/RDL/NEGOEX RCE, MSSQL/WinRM/LDAP abuse)
Wireless assessment (WPA2 capture/crack, WPA3-Transition downgrade, evil-twin 802.1X)
For AD-specific relay targets (LDAP RBCD/shadow-creds, ADCS ESC8, Kerberos relay) and ticket/DCSync work, hand off to active-directory-attack.