Skip to content
Get packs

Offensive Network Attacks (Layer 2/3)

Guides an agent through authorized internal network attacks: ARP/LLMNR poisoning, MITM, relay and DNS spoofing.

Source Download skill
Repository
SnailSploit/Claude-Red
Stars
10,230
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a detailed playbook for attacking the local network layer (Layers 2 and 3) during an authorized internal penetration test. It covers ARP spoofing, name-resolution poisoning with Responder and Inveigh, NTLM hash capture and relay with ntlmrelayx, rogue DHCP/DNS, man-in-the-middle interception and SSL stripping, plus VLAN hopping and IPv6 attacks. Once installed, the agent can produce concrete commands and scripts for these techniques instead of general explanations.

Great for

  • Penetration testers running an authorized internal network assessment
  • Red team members who want a quick reference for Layer 2/3 attack commands
  • Security students practicing in a lab they own

Skip it if

  • Anyone testing networks they do not have written permission to test, since these techniques intercept credentials and can disrupt production traffic
  • Defenders looking for detection or hardening guidance, because the skill is written from the attacker's perspective and does not cover mitigations
  • Non-security users, because the content assumes familiarity with tools like Wireshark, Scapy and hashcat

Try asking

  • “Map my position on this internal subnet and check whether SMB signing is disabled on hosts I am authorized to test”
  • “Walk me through using Responder in analyze mode, then poisoning mode, on our lab VLAN”
  • “Write a Scapy script that sends gratuitous ARP replies for a lab target and gateway”
  • “Show how to set up ntlmrelayx against hosts without SMB signing from my engagement scope”
Step-by-step guide: how to use Offensive Network Attacks (Layer 2/3)Install, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    offensive-network-attacks.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip offensive-network-attacks.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip offensive-network-attacks.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only use this skill with written authorization and a defined scope; the file itself frames every technique as part of an authorized engagement.
  • Start with passive or analyze-mode steps (Responder -A, net.probe) before any active poisoning, to limit disruption.
  • Ask the agent to explain each command's effect before running it, since the skill includes commands that alter ARP tables, DNS responses and DHCP settings.

What's inside

  • SKILL.md

Redistributed unmodified from SnailSploit/Claude-Red under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.