All tools

Modern network attack and monitoring framework for ARP/DNS spoofing, sniffing, and credential attacks on authorized LANs.

LAN MITM framework for ARP poisoning, sniffing, and filter-based traffic manipulation on authorized networks.

Custom TCP/UDP/ICMP packet crafting for firewall testing, traceroute, and port probing on authorized hosts.

TCP/UDP connect, listen, and port relay for banners, shells, and file transfer on authorized networks.

SSH tunneling, port forwarding, SOCKS proxies, and pivoting with chisel/ligolo to reach internal networks during authorized engagements.

Force TCP connections through SOCKS4/5 or HTTP proxies for pivoting during authorized internal assessments.

LLMNR/NBT-NS/mDNS poisoner and rogue authentication server for capturing NetNTLM hashes on authorized Windows networks.

MS-RPC client for SAMR/LSA enumeration and user management via null or authenticated sessions on authorized domains.

Enumerate SMB: shares, null sessions, users, and versions with nmap, netexec, smbclient, and enum4linux on authorized networks.

SMB/CIFS client for share enumeration, file access, and null-session testing on authorized Windows hosts.

Bidirectional data relay for shells, port forwarding, and protocol bridging on authorized networks.

Command-line packet capture and filtering for authorized network analysis and troubleshooting.

CLI Wireshark for capture, display filters, and protocol field extraction on authorized traffic.

Wireshark display and capture filter syntax for slicing packet captures during analysis and forensics.