Network Protocol Attacks

This is a comprehensive playbook for exploiting layer 2 and 3 network protocols during penetration tests. It covers the full spectrum from ARP spoofing and LLMNR/NBT-NS poisoning with Responder to more advanced techniques like VLAN hopping via DTP attacks, DHCPv6 takeover with mitm6, and STP manipulation. The skill shines in showing how these attacks chain together, like using mitm6 to force WPAD lookups that capture NTLM hashes you can relay to LDAP for resource-based constrained delegation. It includes detection indicators and mitigation advice alongside each attack, which is honest and practical. The IDS evasion section and IPv6 attack vectors are solid additions that often get overlooked. If you're doing internal network assessments on anything beyond basic WiFi tests, you'll reference this.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill network-protocol-attacks --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Network Protocol Attacks — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert network protocol attack techniques. Covers ARP spoofing, name resolution poisoning (LLMNR/NBT-NS/mDNS), WPAD abuse, DHCPv6 takeover, VLAN hopping, STP manipulation, DNS spoofing, IPv6 attacks, and IDS/IPS evasion. Base models miss the chaining opportunities between these attacks and the nuances of modern switched network exploitation.

0. RELATED ROUTING

Before going deep, consider loading:

tunneling-and-pivoting after establishing MitM position for traffic redirection
ntlm-relay-coercion for relaying captured NTLM hashes from poisoning attacks
unauthorized-access-common-services for exploiting services discovered during network attacks
traffic-analysis-pcap for analyzing captured traffic from MitM

Advanced Reference

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
First seen: Jun 3, 2026