Network Attack & Lateral Movement

When to Activate

Internal network pentest from an unauthenticated wire position or initial foothold
Layer-2/3 poisoning to capture credentials (LLMNR/NBT-NS/mDNS, ARP/DHCP, IPv6 mitm6)
Coercion + NTLM relay from the network (signing/EPA mapping, CVE-2025-33073 reflection)
Pivoting / tunneling across segments (Ligolo-ng, Chisel, SSH, DNS tunneling)
Traffic interception / MitM (bettercap, RDP/SSH/STARTTLS downgrade, cookie theft)
Network-service exploitation (SMB/RDP/RDL/NEGOEX RCE, MSSQL/WinRM/LDAP abuse)
Wireless assessment (WPA2 capture/crack, WPA3-Transition downgrade, evil-twin 802.1X)
For AD-specific relay targets (LDAP RBCD/shadow-creds, ADCS ESC8, Kerberos relay) and ticket/DCSync work, hand off to active-directory-attack.