Skip to content
Get packs

Man-in-the-Middle Attack Simulation

Runs authorized MITM tests (ARP spoofing, TLS interception, DNS spoofing) to check network defences.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

When installed, this gives the agent a step-by-step playbook for simulating man-in-the-middle attacks on a network you are authorized to test. It walks through setting up ARP spoofing, TLS interception with a test certificate authority, DNS spoofing and credential sniffing using tools such as Bettercap, Ettercap and mitmproxy, then checks whether certificate validation, HSTS and intrusion detection actually catch the activity. It also includes a Python helper that performs ARP discovery, spoofing and sniffing with the Scapy library.

Great for

  • Penetration testers running an approved assessment of a internal network
  • Security teams checking whether HSTS, certificate pinning and IDS alerts work as intended
  • Trainers building lab exercises on how interception attacks happen and how to detect them

Skip it if

  • Production networks or third-party traffic without written authorization, since the steps capture credentials and cookies and can disrupt live users
  • Beginners without networking or security background, because the commands alter routing, ARP tables and firewall rules and can break connectivity if misused

Try asking

  • “Plan an authorized MITM test of our office network to check whether our web apps enforce HSTS and certificate validation”
  • “Help me write a rollback checklist for an ARP spoofing exercise in our isolated lab”
  • “Explain which Snort or Zeek alerts should fire during a DNS spoofing simulation and how to verify them”
  • “Walk me through generating a test CA and validating that a mobile app rejects it through certificate pinning”
Step-by-step guide: how to use Man-in-the-Middle Attack SimulationInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    conducting-man-in-the-middle-attack-simulation.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip conducting-man-in-the-middle-attack-simulation.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip conducting-man-in-the-middle-attack-simulation.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only run against hosts and networks named in a signed authorization, and keep a documented rollback plan before enabling any spoofing module.
  • Use a dedicated lab network first; ARP and DNS spoofing affect every device on the segment, not just the target.
  • Remove the test CA from any system where it was installed and delete capture files after the engagement, as the skill's cleanup step advises.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.