Skip to main content
Everything here works below any specific service, exploiting how switches, DHCP, and ARP behave by default rather than a misconfigured application. Most of it needs to be on the same broadcast segment as the target, physically plugged in, on the same Wi-Fi, or already pivoted onto the internal network.

Layer 2 (Switching)

Abusing switch behavior itself, CAM tables, VLAN trunking, STP, DHCP, to turn a segmented network into one big collision domain or redirect traffic through you.

Man-in-the-Middle

Once traffic actually flows through you (via the above, or just being on a flat/wireless segment), intercepting, spoofing, and capturing it.

​
MAC Flooding

Switches learn which MAC address lives on which port by watching traffic, storing the mapping in a Content Addressable Memory (CAM) table of a specific size. Flooding it with nonsense source MAC adresses faster than it can handle old entries forces the switch to fail open, broadcasting every frame out every port like a hub, since it no longer knows where anything actually is.
Once the CAM table is full, plain passive sniffing (tcpdump, Wireshark) on the same segment sees traffic that normally would never have reached that port at all, no ARP spoofing needed.

​
VLAN Hopping

If a switch port has Dynamic Trunking Protocol (DTP) enabled and set to auto-negotiate, sending DTP frames that claim to be a switch convinces the real switch to turn that port into a trunk, which carries traffic for every VLAN instead of just one.

​
Man-in-the-Middle

​
ARP Spoofing

ARP has no authentication at all, a host simply believes whatever reply it receives. Answering on behalf of the real gateway (and separately, on behalf of the real victim) convinces both sides to route through the attacker instead of each other.

​
DNS Spoofing

Once traffic is already flowing through the attacker (via ARP spoofing above), dnsspoof answers DNS queries matching a filter file with attacker-controlled IPs instead of letting them reach the real DNS server.

​
Bettercap (All-in-One)

Bettercap wraps ARP spoofing, DNS spoofing, and sniffing into one tool with a scriptable console.

​
Man in the Middle IPV6

mitm6 (already covered on LLMNR/NBT-NS/mDNS Poisoning) achieves a similar MITM position over IPv6 DHCPv6 specifically, worth preferring in an AD environment since it also chains directly into NTLM relay.

​
Capturing & Extracting Credentials from Traffic

​
Live Capture

You can capture Network traffic live with Wireshark over the GUI or in the console

​
Automated Credential Extraction

Purpose-built tools that parse a pcap (or sniff live) and pull out credentials directly, rather than filtering manually protocol by protocol. Pcredz, net-creds

​
Quick Reference Tools

Yersinia

Swiss-army knife for layer 2 protocol attacks: DTP, DHCP, STP, and more beyond what’s covered here.

Bettercap

All-in-one MITM framework, see above.

net-creds

Extracts credentials and other sensitive data from a pcap or live interface.

PCredz

Similar extraction tool, also carves NTLM/Kerberos hashes specifically.

LLMNR/NBT-NS/mDNS Poisoning

The AD-specific sibling MITM technique (Responder/mitm6), not repeated here.