Skip to content
Get packs

Guide · Agent skill

How to use the offensive-network-attacks Layer 2/3 agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

The offensive-network-attacks skill is a SKILL.md playbook that gives an AI agent a detailed method for attacking the local network layers (Layer 2 and Layer 3) during an authorized internal penetration test. After reading this guide you will know how to install the skill, how to ask for its help with natural requests, what it needs on your machine, and where the safety limits are.

Offensive Network Attacks (Layer 2/3)SnailSploit/Claude-Red · MIT

Quick start

  1. 1Download the ZIP. Download the offensive-network-attacks skill ZIP from this page. Confirm that it contains SKILL.md.
  2. 2Unzip into a skills folder. Unzip the archive into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder for a project install.
  3. 3Or upload in the Claude apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the ZIP.
  4. 4Set up your attack host. Use a Linux attack host with root privileges and install the tools you plan to use, such as Responder, Bettercap or ntlmrelayx.
  5. 5Ask with a plain request. Describe your authorized scope and the goal in one message, for example an internal Layer 2 assessment of a named subnet.
  6. 6Start with analyze mode. Follow the skill's Quick Workflow and observe traffic before any poisoning or relaying.

What the skill makes the agent do

An agent skill is a folder with a SKILL.md file that Claude loads when a request matches the skill's description. This one covers ARP spoofing, LLMNR, NBT-NS and mDNS poisoning, DNS poisoning, man-in-the-middle interception, VLAN hopping, DHCP attacks, 802.1X/NAC bypass and IPv6 attacks. The skill is written from the attacker's perspective and is meant for an authorized internal engagement.

Instead of general explanations, the agent can produce concrete commands and scripts for these techniques. The source file names tools including Bettercap, arpspoof, Ettercap, Responder, Inveigh, Impacket's ntlmrelayx, NetExec (nxc), dnsmasq, Scapy, hashcat, Wireshark/tcpdump, mitm6 and singularity.

  • ARP spoofing with Bettercap, arpspoof and Ettercap
  • Name-resolution poisoning with Responder and Inveigh, and NTLM hash capture
  • NTLM relay with ntlmrelayx, including LDAP privilege escalation and ADCS ESC8 examples
  • Rogue DHCP and DNS, DNS cache poisoning and DNS rebinding
  • MITM interception, HSTS bypass with sslstrip+ and credential extraction

How to install the offensive-network-attacks skill

Download the skill ZIP from this page. Unzip it into your personal skills folder at ~/.claude/skills/ so that SKILL.md sits inside a folder named offensive-network-attacks. To make the skill available only inside one project, unzip it into that project's .claude/skills/ folder instead.

If you use the Claude apps rather than a local setup, open Settings, go to Capabilities, then Skills, and upload the ZIP there.

  • Option A: personal install in ~/.claude/skills/
  • Option B: project install in the project's .claude/skills/ folder
  • Option C: upload the ZIP in the Claude apps under Settings → Capabilities → Skills
mkdir -p ~/.claude/skills && unzip offensive-network-attacks.zip -d ~/.claude/skills/

How to trigger the skill with natural requests

You do not need a special command. Describe the task in plain language that mentions the network layer and the goal, such as an internal assessment, Layer 2 or Layer 3, ARP, poisoning or relay. The skill's description lists the topics it covers, so requests that match those topics are the ones most likely to load it.

Be specific about your authorized scope and environment. The source's own workflow starts by mapping your position (VLAN, subnet, gateway, DNS, DHCP lease and IPv6 status), so giving the agent those details up front gets more useful commands back.

  • 'I have written authorization for an internal test of 10.0.0.0/24. Walk me through safe discovery with Responder in analyze mode.'
  • 'Give me the arpspoof commands to MITM 10.0.0.50 through gateway 10.0.0.1 in my lab.'
  • 'What relay targets are likely to be useful if SMB signing is off on part of the subnet?'
  • 'How do I get hashes from Responder and crack NTLMv2 with hashcat?'

Run a quick-start workflow

The skill's Quick Workflow runs in a fixed order: map your position, sniff passively, observe name-resolution queries in Responder analyze mode, enable poisoning to capture NTLMv2 hashes, relay to hosts without SMB signing, ARP spoof for targeted MITM, probe VLAN boundaries, and exploit IPv6 autoconfiguration with mitm6.

Responder's analyze mode is the safer first step because it observes queries without poisoning them. Full poisoning is a separate, more intrusive step.

sudo responder -I eth0 -A sudo responder -I eth0 -wrf

Safety, scope and what the skill does not cover

These techniques intercept credentials and can disrupt production traffic. Use the skill only on networks where you have written permission to test, or on a lab you own. Keep a record of your scope and timing before you run anything that poisons or relays traffic.

The skill does not include defensive guidance. It is written from the attacker's side, so do not expect detection or hardening advice from it. The content also assumes you are comfortable with Wireshark, Scapy and hashcat, and it expects a Linux attack host with root privileges.

The skill includes scripts and runs network traffic. Read any command before you execute it, and confirm the interface and target addresses match your authorized scope.

  • Require written authorization covering the exact subnets and techniques
  • Test on a lab you own if you are learning
  • Confirm interface names such as eth0 before running commands
  • Expect the skill to be most useful to people who already understand these tools

Tips for getting better results

Give the agent your environment details first, because the playbook depends on VLAN, subnet, gateway and DNS layout. Ask for one technique at a time so you can check each step's output before moving on.

Several techniques in the source depend on the target network configuration, such as whether SMB signing is disabled, whether a switch port is in dynamic mode, or whether static ARP entries exist. Ask the agent which preconditions each technique needs and how to check them.

  • Name your interface, subnet and gateway in the first message
  • Ask for the precondition check before the attack command
  • Keep Responder in analyze mode until you know what is on the wire

What people use it for

  • Planning an authorized internal assessment that starts with passive discovery and name-resolution analysis
  • Getting exact Responder, arpspoof or Bettercap command syntax during a red team engagement
  • Building an NTLM relay target list with NetExec and ntlmrelayx against hosts without SMB signing
  • Practising Layer 2/3 attack workflows in a lab you own as a security student

Frequently asked questions

Is the offensive-network-attacks skill free and MIT licensed?

The source is listed under the MIT licence. Check the licence file in the download for the exact terms before you redistribute or modify the skill.

Where do I put the offensive-network-attacks skill folder?

Unzip the ZIP into ~/.claude/skills/ for a personal install, or into a project's .claude/skills/ folder. In the Claude apps, upload the ZIP under Settings, Capabilities, Skills.

What do I need to run the skill's commands?

The skill expects a Linux attack host with root privileges. It references tools including Bettercap, Responder, Impacket, NetExec, dnsmasq, Scapy, hashcat, Wireshark or tcpdump and mitm6.

Can I use this skill on a network I do not own?

Only with written permission to test that network. The techniques intercept credentials and can disrupt production traffic, so the skill is for authorized internal assessments and labs you own.

What is the difference between Responder analyze mode and poisoning?

Analyze mode with the -A flag observes LLMNR, NBT-NS and mDNS queries without answering them. Full poisoning with -wrf answers the queries to capture authentication, so it is more intrusive.

How does this skill compare with other network tools?

The skill is a methodology and command reference that an agent applies to tools such as Responder, Bettercap and ntlmrelayx. It does not replace running those tools yourself, and it contains no defensive or detection guidance.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits penetration testers running authorized internal assessments, red team members who want a quick Layer 2/3 command reference, and security students practising in their own labs. It is a poor fit for anyone without written permission to test, for defenders who need detection or hardening guidance, and for people new to Wireshark, Scapy or hashcat.

Download the skill