network-attack

This skill is a coherent offensive intrusion playbook, not a benign admin or diagnostic helper. It enables an AI agent to capture credentials, relay authentication, pivot across networks, and exploit services using multiple external attack tools, so it should be treated as high-risk and suspicious even though its stated purpose matches its behavior.

This is an offensive network-service exploitation and credential-abuse guide, not package malware or normal software-supply-chain code. It contains commands and procedures capable of remote code execution, credential theft, NTLM relay, lateral movement, and denial of service against Windows, MSSQL, WinRM, SMB, RDP, and LDAP services. The content should be restricted to authorized, isolated testing and defensive validation. Malware likelihood is low because no executable malware or persistence is supplied, but the operational security risk of the instructions is high.

This is highly actionable offensive tradecraft for compromising local network segments and relaying credentials into Windows environments. It contains no evident package-install malware or obfuscated payload, but it presents substantial security risk because the commands can capture credentials, redirect traffic, cause denial of service, and modify Active Directory. Use should be restricted to explicitly authorized testing.

This fragment is offensive-security documentation describing network tunneling, C2, proxy chaining, pivoting, and exfiltration techniques. It contains no executable malware or direct malicious behavior in the shown text, but its explicit stealth and lateral-movement guidance creates meaningful dual-use security risk. Assessment is limited to the visible fragment; omitted content could change the conclusion.

The fragment is offensive wireless-security documentation containing password-cracking commands and guidance for credential-capture attacks. It presents meaningful security risk if used without authorization, but the shown text is not executable malware and contains no direct implementation of data theft or persistence. Assessment is limited because the larger file is not visible.

This is attack-oriented documentation for man-in-the-middle interception and credential harvesting. It is not executable malware in the supplied form, and no direct malicious package behavior is demonstrated. If distributed as documentation in a security-testing project, the behavior may be legitimate only with explicit authorization; unauthorized use would enable severe credential and session compromise. The content presents a high security risk because it provides actionable interception and downgrade procedures.

The file is an explicit wireless attack utility, not ordinary network administration code. It performs deauthentication, rogue access-point deployment, WPA3 downgrade guidance, PMKID and handshake capture, and WPA-Enterprise credential interception. No evidence shows hidden malware, persistence, or exfiltration by the script itself; its maliciousness depends on unauthorized use. Because it directly enables disruption and credential theft and lacks authorization safeguards, it presents a high security risk in an untrusted package.

The code is a credential-capture parser and cracking workflow helper. It handles sensitive NTLM hashes and promotes submission of certain captures to crack.sh, creating a security and misuse concern. However, it performs no network upload, command execution, persistence, credential theft from the host, or other clearly malicious behavior. The primary risk is unauthorized credential cracking and insufficient protection of generated hash files.

This is an offensive Active Directory attack launcher. It intentionally combines mitm6 network poisoning with ntlmrelayx NTLM relay to intercept authentication and modify AD through RBCD or shadow credentials, or to relay SMB access. It should only be used in an explicitly authorized penetration-testing environment. The script also has command-injection exposure because user-supplied values are embedded in shell command strings executed by tmux. It is not heavily obfuscated, but its operational behavior presents a very high security risk.

The code is a network penetration-testing and VLAN security assessment utility. It contains intentionally intrusive packet-generation features, especially double-tagged VLAN frames and repeated DTP negotiation frames, which can enable VLAN hopping or trunk formation on misconfigured network equipment. It does not show evidence of malware such as credential theft, covert exfiltration, persistence, reverse shells, cryptomining, or host damage. Use should be restricted to authorized test environments.

The code is a recognizable SMB reconnaissance and NTLM-relay target-generation utility. It has dual-use offensive-security functionality and could support unauthorized lateral movement, but the fragment contains no direct credential theft, exploitation, persistence, destructive behavior, or exfiltration. The shown code also has a syntax error that prevents execution until corrected. Use should be limited to authorized assessments.

The fragment is a readable, purpose-built penetration-testing pivot launcher rather than apparent malware. It creates a TUN interface and starts Ligolo, Chisel, or SSH tunneling processes, so unauthorized use could expose or traverse internal networks. Notable security weaknesses are the displayed -ignore-cert option and Ligolo's 0.0.0.0 bind, which may broaden exposure. Use only with authorization, verify binary provenance, restrict listener addresses, and enable certificate verification where supported.

This code intentionally enables network interception, credential and session-data sniffing, HTTPS downgrade attempts, ARP spoofing, and DNS redirection. Although such functionality can be used in authorized security testing, it is directly capable of unauthorized credential theft and traffic manipulation. It should not be used against networks or users without explicit authorization.