The Agent Skills Directory

[COMMAND_EXECUTION]: The skill provides numerous pre-configured command templates for high-risk network exploitation tools across both analyzed files.
Commands for ARP spoofing and sniffing using arpspoof, ettercap, and bettercap in SKILL.md.
Instructions for executing Responder to poison name resolution and capture credentials.
Usage of yersinia and frogger.sh for DTP and STP attacks targeting network infrastructure.
Execution of IPv6 attack tools from the THC-IPv6 suite.
Detailed commands for post-exploitation tools like secretsdump.py and getST.py in NAME_RESOLUTION_POISONING.md.
[DATA_EXFILTRATION]: The skill focus is on the capture and exfiltration of sensitive authentication data.
Workflow for capturing NetNTLMv1/v2 hashes via LLMNR/NBT-NS/mDNS poisoning.
Commands to crack captured hashes using hashcat and john the ripper.
Relaying captured credentials to external services (SMB, LDAP, MSSQL) to steal data or gain access.
[REMOTE_CODE_EXECUTION]: Multiple attack paths are documented to achieve remote code execution on target systems.
ntlmrelayx.py commands specifically targeting MSSQL to execute commands via xp_cmdshell.
SMB relay attacks targeting hosts with signing disabled to gain administrative command execution.
RBCD (Resource-Based Constrained Delegation) attack chains to compromise domain controllers or servers.
[PRIVILEGE_ESCALATION]: The skill contains advanced techniques for escalating privileges within the network layer.
VLAN hopping via DTP switch spoofing and 802.1Q double tagging.
Spanning Tree Protocol (STP) manipulation to claim the Root Bridge and intercept all segment traffic.
DNS takeover and DHCPv6 poisoning to redirect traffic for higher-level credential theft.
[INDIRECT_PROMPT_INJECTION]: The skill represents a significant indirect injection surface as it is designed to process and act upon untrusted network data.
Ingestion points: Network traffic including ARP, DHCP, LLMNR, and DNS queries (via tools like Responder and mitm6).
Boundary markers: None identified; the skill assumes all captured traffic is a valid target for automated response/poisoning.
Capability inventory: Extensive command execution, file writing (loot), and network operations capabilities.
Sanitization: No evidence of input validation or sanitization before passing captured network data into attack command templates.

network-protocol-attacks