Tools

Coerces a target to authenticate back over HTTP, relays the credentials to the AD CS web enrolment endpoint, and returns a usable certificate — an all-in-one PetitPotam-to-ADCS chain.

ADCSPwn.exe --domain corp.local --port 8080

A Swiss-army-knife framework for network attacks and monitoring — MITM, WiFi/BLE reconnaissance and attacks, and a scriptable, extensible core.

sudo bettercap -iface eth0

A configurable DNS proxy for penetration testers — redirects specific domains to attacker-controlled infrastructure, the DNS half of a phishing or MITM lab setup.

dnschef --fakeip 10.10.14.7 --fakedomains target.tld

A long-standing comprehensive suite for man-in-the-middle attacks on a LAN — live connection sniffing, ARP poisoning and content filtering, with both a CLI and a GUI.

ettercap -T -M arp:remote /10.10.10.1// /10.10.10.10//

Node.js BLE MITM/impersonation toolkit — scans and clones a target device's GATT profile so a fake peripheral can sit between a phone app and the real hardware.

node scan.js

An interactive, scriptable HTTPS proxy for inspecting and modifying traffic on the fly — the open-source alternative to Burp when you need Python scripting against the traffic stream itself.

mitmproxy --mode transparent

PowerShell/C# LLMNR, NBNS and mDNS spoofer for Windows-based operators — the Windows-side equivalent of Responder, with an interactive console.

Import-Module .\Inveigh.ps1; Invoke-Inveigh -NBNS Y -LLMNR Y

Abuses IPv6's default-on status on most Windows networks: answers DHCPv6 requests nobody expected to get answered, then relays the resulting traffic — a very reliable AD compromise path where IPv6 is unmanaged.

sudo mitm6 -d domain.local

An LLMNR, NBT-NS and MDNS poisoner that harvests NTLM credential hashes from Windows networks that still fall back to these legacy name-resolution protocols.

sudo responder -I eth0 -wrf